Widows Explorer/Dr. Morten

[AcesMonkey]

I downloaded what I think was a bad file from a torrent about a month ago and now I can't open the folder I downloaded it in. I use Windows XP. I put it in My Documents>My Videos>My Movies. Sometimes I can open my videos, but most of the time I can't. If I try and delete it or open it I get an error message saying that Windows Explorer has encountered a problem and needs to close. Then it freezes up. A couple time it would came up with a Dr. Morten's Postmortem Debugger error message. Can you help me fix it?

I tried to put a hijackthis log in but it exceded the maximum amount of characters, so I attached it in a text file.

Edit: Also I ran a virus scan with McAfee nothing came up

[getting space - attachment deleted by admin]

[Broni]

You have quiet few bad guys there, but it's getting late, so I'll get back to you tomorrow, unless someone else chimes in.

[Broni]

Did you turn your firewall on, yet?

[AcesMonkey]

Yeah the firewall is and has been on.

[Broni]

Let me check your HJT log...

[Broni]

1. Print this post out, since you won't have an access to it, at some point.

2. Download, and install Spybot (if you don't have it) from here: http://www.safer-networking.org/en/download/index.html

3. Close all windows, except for HJT.

4. Put a checkmark next to following HJT entries:

- R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html

- O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video Access ActiveX Object\isadd.dll (file missing)

- O2 - BHO: XBTBPos00 - {E552EEFC-DE97-45D4-BA1A-F534A1B4A579} - C:\PROGRA~1\MORPHE~1\MORPHE~1.DLL (file missing)

- O3 - Toolbar: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - C:\Program Files\Morpheus Toolbar\morpheustoolbar.dll (file missing)

- O3 - Toolbar: (no name) - {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - (no file)

- O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot (remove from "msconfig/startup")

- O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon.dll",VerifyStatus

- O9 - Extra button: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - C:\Program Files\Morpheus Toolbar\morpheustoolbar.dll (file missing)

- O9 - Extra 'Tools' menuitem: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - C:\Program Files\Morpheus Toolbar\morpheustoolbar.dll (file missing)

- O9 - Extra button: Start EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\PROGRA~1\EASYWE~1\easywebcam.exe (file missing)

- O9 - Extra 'Tools' menuitem: &EasyFreeWebCam - {ECC5777A-6E88-BFCE-13CE-81F134789E8B} - C:\PROGRA~1\EASYWE~1\easywebcam.exe (file missing)

- O22 - SharedTaskScheduler: homina - {df8c3aed-b58e-4bcb-96b3-aa1b7bbdbbd4} - C:\WINDOWS\system32\oyopu.dll (file missing)


***Is "RIPE Network Coordination Centre" your ISP provider?***


5. Click on "Fix It" button.

6. Restart your computer in Safe Mode (F8)

7. Run Spybot (click on updates, first), and fix whatever it asks you to fix.

8. Open Windows Explorer. Go Tools>Folder Options, put a checkmark next to "Show hidden files, and folders".

9. Delete following files (if they still exist):

nothing to delete, for now

10. Turn off System Restore.

11. Restart in Normal Mode.

12. Turn System Restore on.

13. Run HJT again, and post back its log back here.

[AcesMonkey]

I did as you said, but I don't think it did much. I attached the log again.

[getting space - attachment deleted by admin]

[Broni]

I'm not sure what you did, because basically everything is back, nothing was fixed.
Follow EXACT steps from my previous post with couple of extra steps:

While in "Safe Mode", go Start>Control Panel>Add/Remove, and look for:
Acceleration Software, or Stop Sign program
If exist, uninstall.
Then...
Open Windows Explorer, navigate to:
C:\Program Files\Acceleration Software\ directory, right click on Acceleration Software, and click "Delete".

Post new HJT log.

[AcesMonkey]

Alright I did as you said here's the new log. It didn't fix the problem I was having though. Also the StopSign and Accelleration wasn't there.

[getting space - attachment deleted by admin]

[Broni]

OK...your HJT log is clean, now, so the culprit must be somewhere else.
Do you still have that "bad" downloaded file on your computer, and still can't delete it?

[AcesMonkey]

Yeah I'm pretty sure it's there still I can't get to the file to check though. Also if I try and delete any folder that contains it, it freezes up.

[patio]

Remove the offending folder and it's contents in safemode...

[AcesMonkey]

I've tried that it doesn't work, the same thing happens.

[Broni]

Does freezing happen in Safe Mode, too?
Did you try to access that folder from Command Prompt?

[patio]

Move On Boot...

Make sure to read the tutorial at the bottom of the DLoad page.