Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows cannot find 'vkbf.exe'


  • Please log in to reply
13 replies to this topic

#1 gesus

gesus

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 10:18 AM

So far I havent been able to find any information on this specific error. The error is generated when trying to access the C: drive through My Computer. The C: drive can be accessed by right clicking and selecting explore, however a double click on the drive itself generates this error. A large amount of viruses have been removed from this computer recently. Malawarbytes now reports 0 infections and tweaknow reg cleaner reports that the registry is clean. Other than this error everything else seems to be functioning properly. Any ideas on this one.

BC AdBot (Login to Remove)

 


#2 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 10:26 AM

Here is a picture of the error.
Ive also ran chk dsk aswell as sfc /scannow.
Attached File  vkbf_error.PNG   317.07KB   17 downloads

Edited by gesus, 19 February 2010 - 10:28 AM.


#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,249 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:02 PM

Posted 19 February 2010 - 10:49 AM

I've no clue as to why trying to open C: should do anything other than open C:, but I would suspect that this is some type of marker to trigger malware which has been removed.

I would install AutoRuns for Windows - http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx and...no, I think I'd first do a manual search of my registry for such string (vkbf.exe) and delete anything that comes up. Then I'd do a search of all files and delete anything that turned up.

Files that are referred to that have few clues using Google...are to be removed, IMO.

After that or possibly in lieu of that...I would use Autoruns (Logon tab) to see if there is a startup pointer related to the string. If so, I would remove it.

Louis

#4 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 11:06 AM

Thank you for your reply.
Well this is intresting. Ive done a manual search for a registry key containing vkbf.exe. It came back with one in HKEY_CURRENT_USER/Software/Google/NavClient/1.1/History.
The entry was entitled "vkbf.exe" and i removed it. However the error is still present.
I also searched the computer for any files related to this and no results were found.
There was also nothing in the logon tab of autoruns, which seems to be a very useful tool. I combed through a few other tabs and couldnt find anything else relevent. Im going to do some google searching on this google nav client and see if anything is related.

#5 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 11:25 AM

I searched reg again and found a second entry in: HKEY_CURRENT_USER/software/microsoft/windows/CurrentVersion/explorer/mountpoints2/{f0220f.../shell/autorun/command.
I did not take note of the entry before i deleted it. I will do a restart to see if anythng has changed.

#6 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 11:31 AM

We now have a new error when trying to access C: drive. The error reads "This file does not have a program associated with it for performing this action. Create and association in the Folder Options control panel."
I will check the folder options control panel to see if this is possible.

#7 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:02 PM

Posted 19 February 2010 - 11:50 AM

Is there an autorun.inf file or some other curious file like that in c:\ and what's in it?

I am not sure why I think that. I am guessing :thumbsup:

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#8 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 12:14 PM

nope there is no autorun.inf file in the C drive. I made sure to select show hidden files aswell as uncheck hide protected system files and still no autorun.inf. I found a drive association fix at this link. http://www.dougknox.com/xp/file_assoc.htm
It added a registry fix. I then did a restart and now when trying to access c: drive i get the first error again: windows cannot find vkbf.exe (refer to image above in post #2).
So we have come full circle on this.

#9 hamluis

hamluis

    Moderator


  • Moderator
  • 55,249 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:02 PM

Posted 19 February 2010 - 12:30 PM

<<{f0220f.../shell/autorun/command>>

None of my entries for that key...look like that. Mine look this way: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0452146c-14de-11df-913d-001d72b2ea51}, with Default, Autorun Status, and Base Class reflected as subs.

You might right-click on that key and take a look at the permissions, just to see if they look normal.

Louis

#10 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 12:41 PM

Everything seems normal for permission. All the numbered files in MousePoints2 have the same permissions which include: Administrators, Compaq_Owner, RESTRICTED, and SYSTEM.

#11 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:06:02 PM

Posted 19 February 2010 - 01:05 PM

I would post this in the "Am I infected?" section. Seems to me like you have been infected with a rootkit.

#12 gesus

gesus
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Location:Northern Ontario
  • Local time:12:02 PM

Posted 19 February 2010 - 01:18 PM

I apologize, when searching for the autorun.inf file i overlooked it. This file was in fact there. I removed it and performed a restart and now C drive is accessible. Problem Solved. Please note that C: drive was not accessible until restart was done. Therefore solution is:
1. Open my computer.
2. Go to Tools> folder options..> view tab
3. Select "show hidden files and folders"
4. Uncheck "hide protected operating system files"
5. Right click on drive that is effected by this issue and select explore.
6. Locate and delete autorun.inf
7. Delete Autorun.inf from recycle bin.
8. Restart computer.
9. Drive should now be accessible.

Thanks you for your support everyone.
Very much appreciated.

#13 hamluis

hamluis

    Moderator


  • Moderator
  • 55,249 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:02 PM

Posted 19 February 2010 - 01:48 PM

"Restricted" is not a normal permissions group...unless it's something added by a boxmaker as a vehicle for remote assistance.

Louis

#14 joseibarra

joseibarra

  • Members
  • 1,085 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:02:02 PM

Posted 19 February 2010 - 04:01 PM

:thumbsup:

It would be interesting to know the contents of the autorun.inf file if you happened to notice.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users