Computer Hope
Microsoft => Microsoft Windows => Windows XP => Topic started by: nymph4 on December 02, 2008, 08:19:02 PM
-
I have my Pop Up turned on and when I go to Google.com and do a search for something and hit Search it brings back all I need.
But then my Pop Up Blocker Bar drops down under the Internet Address Bar. And it tell me that this Site is Blocked.
OK I get this but then all of these ads start Poping Up.
So if it is working why is all of these adss comeing up after the Pop Up Blocker comes down and tells me it is Blocking??
-
Adware/Spyware infection?
-
I use PC Tools for my Anti Virus program and it has Spyware DR with it.
When I run it it finds 4. Viruses and I get rid of them but they are still in my MSCONFIG startup List and I can not keep them out of the MSCONFIG startup list.
I ram it again in Salf Mode and it found the same 4. Viruses and I got rid of them but they still come back.
They make the My Document Folder open on startup and make a Lot Lot Lot of Pop Ups hapen.
So it is some kind of Ad Aware I think.
Is there a free Program that I can try to hel me
-
If they keep coming back then PCTools isn't getting rid of them...
Travel to our Virus and Spyware section and read the instructions at the top of the page for posting your logs.
-
I use PC Tools for my Anti Virus program and it has Spyware DR with it.
I ram it again in Salf Mode and it found the same 4. Viruses and I got rid of them but they still come back.
next time turn off system restore FIRST, then clean up in safe mode, then remember to turn system restore back on when booting back to normal mode...see if that helps...Good Luck
-
I think I found what keeps going back into my msconfig startup List.
FHAAF
and it says it is in
c:\program files\uninstall information\fhaaf.exe
SVCHOST
And it says it is in
c:\program files\windows\inf\svchost.exe
If I go directly to these folders can I just Delete the Item by hand and that will be that???
-
I turned off System Restore Point and whent into Safe Mode and did a Scan.
It still finds the ssame 4 things and says it is getting rid of them. and NOTHING.
Anyone???
-
Anyone???
-
I turned off System Restore Point and whent into Safe Mode and did a Scan.
It still finds the ssame 4 things and says it is getting rid of them. and NOTHING.
Anyone???
in safe mode scan with the following:
AdAware, Spybot, and a good antivirus(avast/whatever)...after all cleaned up do
a Hijack this and post results for people to check...
then boot back to normal mode and run the 3 I mentioned again..
Good Luck
-
I tryed Spybot and Adaware and you have to pay for them.
Is there anything for free
-
I tryed Spybot and Adaware and you have to pay for them.
Is there anything for free
they are BOTH free...
http://www.lavasoft.com/products/ad_aware_free.php
http://www.safer-networking.org/en/download/
-
nymph there is very little info on fhaaf.exe...
svchost is a normal Windows process.
You need to follow the advice i gave you above if you want this fixed.
-
I tryed Spybot and it finds 190 Infections but when I got to remove them it asks me to Register the program.
And when I do it tell me I have to buy it to rid my self of the Infactions??
The same thing with Adaware
-
Ok ignore me....
I'm not the one that's infected.
-
OK I tryed Spybot and it wont work unless I buy it.
And Adaware will not even start because A Modual at location and then a string of numbers and letters.
Now what??
-
Spybot IS free it is here http://www.spybot.info/index2.html (http://www.spybot.info/index2.html)
If it asks you to register then register. It will not ask you for any money or card numbers etc
-
Spybot IS free it is here http://www.spybot.info/index2.html (http://www.spybot.info/index2.html)
If it asks you to register then register. It will not ask you for any money or card numbers etc
they are BOTH still FREE..provided pointers..who knows what is being downloaded...???LOL
-
I ran Spybot and Adaware thanks and they found a lot of things.
So I ckliked Fix and it says it Removed the things it found.
Now I whent back to run my Spyware DR with Anti Virus program and it found the same two things.
FHAAF
and it says it is in
c:\program files\uninstall information\fhaaf.exe
SVCHOST
And it says it is in
c:\program files\windows\inf\svchost.exe
I think these have something to do with my problem because the same things still happen.
When I startup my Computer the My Documents Folder Opens???
When I go on the Internet and I get floaded with Pop Ups and at the same time my Pop Up Blocker is telling me it is Blocking the Web Site.
-
I ran Spybot and Adaware thanks and they found a lot of things.
So I ckliked Fix and it says it Removed the things it found.
Now I whent back to run my Spyware DR with Anti Virus program and it found the same two things.
FHAAF
and it says it is in
c:\program files\uninstall information\fhaaf.exe
SVCHOST
And it says it is in
c:\program files\windows\inf\svchost.exe
I think these have something to do with my problem because the same things still happen.
When I startup my Computer the My Documents Folder Opens???
When I go on the Internet and I get floaded with Pop Ups and at the same time my Pop Up Blocker is telling me it is Blocking the Web Site.
PC Tools maybe fine...but try another anti-virus program..just for giggles...AVAST is free and many others...
http://www.avast.com/eng/download-avast-home.html
select the first one on the list if you want to use this...and if you do
remove your other one first...
Oh forgot...I'm assuming your doing this all in safe mode...with system restore turned off...!!!
-
I downloaded Advast and ran it and it found the File I can't get rid of so I whent to see if I could use Advast to get rid of it and it needs a Lissens Key.
I did not see one when I downloaded it ware do I get it or what do I put in
-
I downloaded Advast and ran it and it found the File I can't get rid of so I whent to see if I could use Advast to get rid of it and it needs a Lissens Key.
I did not see one when I downloaded it ware do I get it or what do I put in
use the demo version instead of putting in a license...good for 90 days...you only need it for a few days...
-
OK I whent into Safe Mode and ran the Avast Program and it found
FHAAF
and it says it is in
c:\program files\uninstall information\fhaaf.exe
And it told me that I Deletted it.
It still is in my msconfig List and my Anti Virus Programs still find it.
And my Documents Folder still opens on Startup.
And I still get floaded it with Pop Ups.
Now what
-
Try CCleaner or Have you tried deleting the file manually
-
OK I whent into Safe Mode and ran the Avast Program and it found
FHAAF
and it says it is in
c:\program files\uninstall information\fhaaf.exe
And it told me that I Deletted it.
It still is in my msconfig List and my Anti Virus Programs still find it.
And my Documents Folder still opens on Startup.
And I still get floaded it with Pop Ups.
Now what
If you type windows key r, then type msconfig you can uncheck it from msconfig list...
the folders on startup could be registry issues because of the infection, so you may want
to read about then try this...
http://www.windowsstartup.com/startupinspector.php
good luck
-
OK I have used CCleaner and it fixed the Registry it told me and gt rid of a lot of things.
But not
FHAAF.exe
If I go to
c:\program files\uninstall information\fhaaf.exe
can I just delete it?
I don't know what it is and if this is what is making My Document Folder oipen on startup.
And all of the Pop Ups
-
You're chasing a red herring here...
I'll try once more then i'm done.
First DLoad and install ERUNT which will make a backup of the Registry.
After doing that set a system restore point and give it a title you can remember just in case.
1.Start>Run>Regedit>ok
2.Now navigate to the following key:-
HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3.Look down the list in the Right Hand pane,scroll down to the value Userinit This value should read: C:\WINDOWS\system32\userinit.exe, (The comma at the end must also be there)
4.If the value is different from that mentioned above then Right Click on the Userinit value and, from the drop down menu, select Modify. Type in the value C:\WINDOWS\system32\userinit.exe,in the Modify dialogue box click OK
5.Exit the Registry.Restart your computer.
-
Ok thanks for all the help I will do what you told me.
But I just want to know why sould it say
C:\WINDOWS\system32\userinit.exe
what is this or what does this do??
-
It's the initialisation file that runs your User Profile.
-
No I am soory what I also ment is what are we doing to it what hapened?
-
I had one thing I was thinking of doing but I wanted to ask if I just sould not even try it.
I have 2. accounts set up on my Computer.
Admin account and Limited account
What if I delete the Limited account and make a New one.
And make a new Admin account and then delete the old one.
Would this not fix a Hang ups in the Registry belonging to both accounts?
I can go into the Regedit by hand but if I mass up it will meen a Full re format and install.
And I thought that this may clear any trhing that is Cloging my Internet Explorer Browser and in the Registry for these Accounts.
What do you think??
-
I can go into the Regedit by hand but if I mass up it will meen a Full re format and install.
It all depends upon whether you take notice of Patio's advice.
If you have an ERUNT registry backup it only needs about 10 seconds + a reboot to correct any mistakes.
Regards
Alan
-
First DLoad and install ERUNT which will make a backup of the Registry.
After doing that set a system restore point and give it a title you can remember just in case.
That's what these steps are for...you have a tendency to jump forward in the process ignoring important steps.
ERUNT backs up the registry in case you foul things up.
But don't let this lull you into a false sense of security...read up on how to use it beforehand.
-
Can I just use GREGEDIT and export the whole Registry?
Do I need a Program to do it??
-
I only see this
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSON
that is all no WINLOGON
And because it is the Registry I want to ask befor I dig around and start doing anything.
What is going on how can I look for what you told me to
-
WINLOGON is in
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WINLOGON
-
I am running win xp pro and this ios what I have
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSON
After Current Verson it stops no WINLOGON does this meen I am up shits creek???
-
WINLOGON is in
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WINLOGON
-
I am running win xp pro and this ios what I have
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSON
After Current Verson it stops no WINLOGON does this meen I am up shits creek???
take notice of Patio's advice
-
Ok I am there and I have nothing that says
c:/\windows\system32\userinit.exe
Nothing at all like this???????????????????
-
Ok I am there and I have nothing that says
c:/\windows\system32\userinit.exe
Nothing at all like this???????????????????
You are no longer in the Registry if the syntax you posted here is correct...
I think you're in over your head at this point and you need someone there that's familiar with this procedure rather than us who cannot see your machine.
If you do find assistance have them read this Thread for how to proceed...
-
I whent to regedit.
Then on the left hand side I go throught all the Folders.
And yes I did get to
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSON
Then I look at the right hand side of the window and I do not see anything that says
c:\windows/system32\userinit.exe
I am still in the registry what did you meen??
-
Nymph4
You have sent many posts,
but seem to often ignore technical replies,
or disbelieve replies (e.g. whether or not download software is free).
Several times you were told to use ERUNT. Instead you replied :-
Can I just use GREGEDIT and export the whole Registry?
Do I need a Program to do it??
I know nothing of GREGEDIT, other than Google has many hits referring to Gregorian Chants, and I only saw 1 hit referring to a registry question.
It is definitely not a feature of Windows. Therefore if you could use it to export the registry you would still be "using a Program to do it".
You may be lucky and get your machine fixed with our assistance,
but I think eventually you could finish up with some one else mending it for you.
Because you can still send us posts you still have a usable computer, and many computer enthusiasts would be able to fix it for you if they were on your keyboard.
Only a very small subset of these enthusiasts would be able to help if you do the wrong things and render the computer incapable of booting up.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WINLOGON
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSON
Can you see the difference ?
Not just upper case and lower case, which are irrelevant,
but several times you were told the FIRST line which includes "\Windows NT\"
and you always look in the SECOND line with the WRONG item "\WINDOWS\".
You should have STARTED by telling us your operating system, it can make a difference.
If you are using Windows 95 etc there will be no "\Windows NT\"
I cannot see what operating system you are using. You should have told us.
I strongly recommend that your next post should state your operating system,
and even better if you update your profile to show this plus your security systems (antivirus / firewall / etc.) - perhaps you revealed this somewhere, but with 3 pages of postings I only bother to look at the starting post and the profile.
I wish you luck, but I fear for your safety.
Regards
Alan
-
Someone had ask me what Operating System I was running and things like that so they can help me. I will put down all my information about the System I have and my Problem and what I did.
I am running Win XP PRO. with Service Pack 2. and I am useing Win XP Biltin Firewall. I have one Admin Account and One Limited Account and every time Log onto the Admin Account or the Limited Account the My Documents Folder opens up when it gets to Desktop.
Now someone had told me here to check my Registry and make shure I see
c:\windowsystem32\userinit.exe
and nothingels if I have two of these that may be what is doing this.
So I go to Start Run and type REGEDIT and OK
Now the Windows Registry comes up and on the Left Hand side I click on the + next to HKEY_LOCAL_MACHINE
Then under that I click on the + next to SOFTWARE
Then under that I click on the + next to WINDOWS
Then under that I click on the + next to CURRENT USER
There is no WINLOGON or anything closs to this.
Then I go to the Right Hand side of the screen and I see nothing that says
c:\windows\\system32\userinit.exe
If I am not doing these steps right tell me what I am missing?
Thanks
-
we've said it three times. the key your after is
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WINLOGON
regardless- that doesn't really have any references to userinit. Your probably aiming for the RUN keys, which can be (more safely) handled with other programs, such as Autoruns or Hijackthis.
I might add that autoruns also supports removing/disabling winlogon hooks
-
Ok you tell me to looke for
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WINLOGON
This is how far I get
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
After that is nothing just Windows no NT
Then just
CurrentVersion
Not WINLOGON
I would like to to knoe why I can't find what you tell me
-
Sorry to quote the pantomine, but
ITS BEHIND YOU
To be exact, it is BELOW what you are looking at.
The picture attached shows :-
"WINDOWS" at the top, which you are wrongly looking at.
"WINDOWS NT" at the bottom which you SHOULD be looking at.
Your mistake is in wrongly assuming that "NT" a sub-folder of WINDOWS.
Life was simple with DOS 3.2 and no registry problems.
Windows XP has many more complications,
and embedded spaces within the names of files and folders is the least of them.
I admire your bravery and persistence, and I do hope you survive
Regards
Alan
[Saving space - attachment deleted by admin]
-
I found the right fath in the Registry.
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT \WINDOS NT\ CURRENT VERSON
But when I go to the Right side of the screen I go down the list and I do nnot se
c:\windos\system32\userinit.exe
what doe this meen I do not see it. I see a Lot of HEX Code and maybe two things that say Local????????????????
-
regardless- that doesn't really have any references to userinit. Your probably aiming for the RUN keys, which can be (more safely) handled with other programs, such as Autoruns or Hijackthis.
I might add that autoruns also supports removing/disabling winlogon hooks
-
You are not looking at quite the right thing.
Having made the correct selection on the left, do NOT look for C:\Windows etc. on the right of right, because it is there but DATA is horribly out of sequence.
Instead look for UnserInit on the LEFT of right, because NAMEs are in sequence.
See attached GIF
After nearly a 40 year career designing and implementing real-time embedded computer systems that never needed a reboot nor had BSODs, I find Windows unreliable, and fear that dabbling with the registry can make it worse, and only do it if I really have to. You really have to be careful.
Regards
Alan
OOPS I took too long taking the snapshot, and BC_Programmer has beaten me to it.
As Bamber would say "I have started, so I shall finish" - just to add to your education for the future - BUT for now please follow BC_Programmer 's advice.
[Saving space - attachment deleted by admin]
-
:FACEPALM:
So that's what we were shooting for. Alright;
hopefully Nymph can finish their task!
-
OK thank GOD I found it.
I found userinit.exe but this is what it says under the Data Section
userinit.exe,EXPLORER.EXE
Because it has Explorer at the end of Userinit.exe is this why the My Documents Folder opens up at Start up????????????
And do I backspace over Explorer?
-
right-click and modify the value.
that was surely the reason for the problem. userinit.exe starts explorer when t finishes all the other boot-up tasks, so that duplicate entry caused it to run again; showing my documents.
-
OK so I change
userinit.exe,explorer
to just
userinit.exe
But if windows needs it to start explorer after everything els like you say will it not do something bad to the way windows starts up???
-
mine currently reads
C:\WINDOWS\system32\userinit.exe,
not sure if the comma at the end is necessary.
-
Hahahahahahahaha! ROFLMAO Hahahahahahahah!
I just spent 30 minutes going through this thread.
Another classic Nymph4 post - it's like a maze. Nymph4 will never read or digest any information and seems incapable of following the simplest of advice. As for turning him loose on his Registry - wow - some brave members out there!
Here's another classic by him http://www.computerhope.com/forum/index.php/topic,67935.0.html
I've not had such a good laugh for some time, I can feel the frustration of members trying to assist. I'm of the opinion he's just winding us up!!! ;D
BTW Nymph4 is studying for A+ certification.
Good luck to all...
-
he's been warned of the dangers of editing the registry multiple times; and then redirected to those same posts when he expressed uncertainty.
there are other members I can think of that are more aggravating; besides, it's always good to have patience, even if it takes 50 or 500 pages to pass along fairly basic information.
I think the problem is- Nymphy is too unsure of themselves, and want confirmation at every step. The best way to learn is to put your OWN best foot forward, not borrow somebody elses foot. besides, if you do that, your shoes won't match, and that would just be wrong.
Although I suppose one could take both feet and thus have matching metatarsals, that's just a loophole in my metaphor, not the entire context of the analogy.
-
OK in the Registry on the Right Hand Side Under Name I see
userinit.exe
This is the only thing I can rename and this I don't have to.
But if I folow userinit.exe over to the right side under Data this is ware it says userinit.exe,explorer
And this is what I have to rename and this will not let me rename it there is no rename option for this.
-
I don't recall saying anything about rename. right click the VALUE, on the right hand side- and select MODIFY.
change the value to the new value that you want it to be. Press OK.
-
Thanks to everyone who has helped me I found the right Registry Paths and fixed userinit.exe and now the computer startsup without opening My Documents Folder.
-
congratulations, I suppose. ;D
-
BC i show a comma as well...
-
I imagine it's simply part of the format used. I wonder what happens if I remove it...
-
Ok now my Computer starts up and goes to Desktop and does not open The My Documents Folder.
One thing tht did come back is this.
If I go on the internet and just type in a Web Address in the Internet Explorer Address Bar it will go to it and no Pop Ups.
But if I go to Google.com first and type in something and let Google saerch for it and window opens.
In the Title Bar of this window it says
Click 2 Find Internet Explorer.
And I have to click the X Tab in the upper Right Hand side to get back to Google.
Now I looked in my Ad Remove Prgrams list to see if there is something in there like
Google Search Bar
or
Click 2 Find Internet Explorer.
I founf nothing.
Did anyone ever have this happen to them and what can I do??
Thanks
-
Anyone????
-
Ok I di a search on Google for svchost.exe
And it is a Windows Process and it is in c:\windows\sytem32
And it is used for 32 Bit Prosess.
But it can be a Virus it says it some casses and that is all it told me.
My Scan always shows it in
c:\windos\inf\schost.exe
And if I take it out of the msconfig startup lints and click apply and then OK and then click on exit without re starting and then go back.
I see it put itself back in the list.
I think this may be what is making Google give me Pop Ups and because it is not in w32 Folder like they say it sould be I think it may be a Virus.
And the fhaah.exe keeps puting itself back in the msconfig list and I never can find any information about this file.
I think this is a BUG to.
What what sould I try next I think because they come back they may be Re Building or in the system deep.
Does anyone know???
-
Do you have googe toobar or googe Destop search istaed ? ?
If so get rid of both of the...
-
Ok they way my Internet Explorer is setup is I have Google.com set as my home page.
And I have DSL so as soon as I go online Google.com is there.
And when I type in something into Google and hit the Search Tab under Google a window comes up.
And it covers the screen and inb the title bar it says
Click2 Find Internet Explorer.
And it has Ads and a lot of gooffy *censored*. And when I close it then I see the Search listings from Google that I asked for.
But in Ad Remove Programs I see no Google Search Bar or anything like you said.
What now is any of the 2 Files I put above Spyware or Virusess???
-
Anyone have any thing??
-
I am NOT a malware expert, but I seem to recall that :-
svchost.exe is a normal and essential feature of Windows when it is in its proper place;
there are numerous malware versions of svchost.exe that generally reside outside its proper place.
I have just searched for "c:\windows\inf\svchost.exe"
there were 89 results, many of which had Chinese pictograms or Arabic letters.
I am not racist, but I prefer to never click on a link if I do not know what it is saying.
Also I do not want to waste time going to a site I cannot read.
I used "Advanced Search" and set Language to English and got 27 hits,
and on the first page 10 out of 10 said "c:\windos\inf\schost.exe" is a virus.
For two reasons I was very interested in
https://forums.comodo.com/feedbackcommentsannouncementsnews/new_thread_in_town-t22013.0.html
1. It also cited "gaefh.exe", which reminded me of your "fhaah.exe";
2. I use Comodo myself.
I hesitate to give malware advice - and I believe forum rules prohibit it anyway.
I will however say that if I was in your situation, I think I would accept the invitation
"If you think you're infected ....Click Here".
Which Patio gave under his signature at "Reply #65 on: December 09, 2008, 01:49:08 PM".
I have just clicked and after 40 years with computers I reckon I could cope.
I think you are going to get a lot of experience the hard way.
You truly have my sympathy.
Regards and best wishes
Alan
-
Just two Qs about the Program Comodo.
Is it free to download and to use all the time?
And ware do I get it?
Is it for getting rid Spy Ware or Virus Programs
-
Hi
Start at http://www.comodo.com/products/free_products.html
There is an increasing range of products available, free for ever.
I use the Firewall Pro.
It not only blocks nasty stuff coming in, it also blocks keyloggers etc. from sending out.
http://www.personalfirewall.comodo.com/index.html
This shows with side by side comparison the relative features of the Free and The Purchase versions. Purchase is mostly for the benefit of telephone support.
Free still gives you email support by Comodo employees, plus forum support by Comodo users.
It does include the option of a virus scan when installed, but there is no virus signature update. You should still have real-time Anti-virus, and their forum is a good place for advice upon free Anti-Virus that is compatible with their Firewall. They also have a free real time anti-virus product which I will investigate when my existing anti-virus licence expires.
But if you have not yet done so, please get existing malware fixed, AND get their advice before you install any protection from anywhere.
There is no danger that Comodo will do anything nasty, BUT if you install it and it removes SOME malware, this MIGHT make subsequent Hijack analysis more difficult.
Best of luck
Alan
-
Please Click Here... (http://www.computerhope.com/forum/index.php/topic,46313.0.html)
This should have been done 3 pages ago...
-
Ok I whent to
http://www.comodo.com/products/free_products.html
Is the Programs listed her for free they look realy good?
The first one say it has Ani Virus Protaction but I did not know if it would realy be a good one.
And because they have amlot of Firewalls and one of them had a Anti Virus program in it I did not know what I sould get.
-
Comodo is a Firewall program...
Installing a firewall is probably not going to resolve your issues...
On top of that having more than one firewall is a no-no.
-
OK since I Un Installed Internet Explorer and got Firefox I did a Scan.
I come up clean and if I go into my msconfig startup list I do not see svchost.exe
or that fhaah.exe
I do not know why this is maybe it attached it'self to Internet Explorer.
Anyway I need some help with Firefox and I did read the Help Files on this.
To set a home page go to Tools then Options and in here I click on the Main Tab I think or what ever it is.
I pick from the dropdown list Show Home Page.
Then in the Box I type the name of my Home Page and I make shure that it starts right after the http:\\
But my Home page seems to always go to the last page I was on.
Can anyone please help or tell me if I mist a step.
Thanks
-
Anyone??????????????????
-
Probably the reason no-body is replying is that after 5 pages of advice you have basically ignored it all and done your own thing. What is the point of asking for advice then not taking it.
Nevermind
Open Firefox, then open the page you want as your home page, then open Tools, Main Tab, and click on Use Current Page, the dialogue box will then change names. Job Done.