Posted 25 February 2010 - 02:02 PM
This may be a self inflected wound.
Windows XP Pro Version 2002 SP2, Core Duo. I noticed that occasionally on boot a message from Flash would pop up offering a new version. I don't like things running on my computer without knowing how they got started. After checking the usual places I found the offending program was /windows/system32/Macromed/Flash/NPSWF32_FlashUtil.exe but was not able to determine how it got started. As a test I changed the ending of the program from exe to xex (have done this for years, maybe just lucky up to now) to see if the message would go away and rebooted. On reboot the system spouted unintelligible characters on the screen and hung. Rebooting in safe mode I found that NPSWF32_FlashUtil.exe had been replaced in the directory along with my renamed copy. I used (in the same directory) uninstall_plugin.exe go get rid of the plugin, rebooted, uninstalled Flash, reinstalled Flash and thought things were OK.
After a similar hang this a.m. I did the uninstall again but the system still hung on rebooot. Used regedit to remove HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/ThreatFire (some have had problems with this prog) from the registry and successfully rebooted. The Flash player was reinstalled and the \Windows\system32\Macromed\Flash directory looks normal again but i am not sure things will boot up properly. Thought I would post this before trying. Last time I have had 5-10 reboots before the problem cropped up again so one reboot won't necessarily prove everything is OK.
The system has been running slower recently so the possibility of a virus is present. I use MalwareBytes, Avast, ZoneAlarm, and a firewall router to try to keep things safe.
Does any one have any thoughts on this or what to do next to assure that all is well?