Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help with removing HKLM file


  • Please log in to reply
2 replies to this topic

#1 TanneGFX

TanneGFX

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:41 PM

Posted 31 October 2013 - 06:15 AM

Hey,
 

for some rather bizarre reason my computer had started to open a strange website called ''gameroover'' upon startup.

So I looked into this further using Hijack this and found the following : 

''O4 - HKLM\..\Run: [Babakan] cmd.exe /k if %date:~6,4%%date:~3,2%%date:~0,2% LEQ 20131027 (exit) else (start Mod Edit:  Removed link - Hamluis.

 

But I have no clue on how to remove this, any help would be gladly appreciated.  I tried to fix it in Hijack this, but that did not help. 

Thank you very much. 


Edited by hamluis, 31 October 2013 - 09:06 AM.
Moved from Win 7 to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,405 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:41 AM

Posted 31 October 2013 - 09:09 AM

You may post your HJT llog, along with the requested DDS log, at BC Virus, Trojan, Spyware, and Malware Removal Logs - http://www.bleepingcomputer.com/forums/forum22.html .  The folks there will assist you in determining what's up, since malware topics are not worked in the Windows 7 forum.

 

Louis



#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,136 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:41 AM

Posted 31 October 2013 - 12:11 PM

I am only finding that startup entry on non-English sites so I don't have any information on it. If you don't want a specific program or scheduled task to run at startup you can either disable it in MSConfig or disable/delete the entry using a third-party utility.

Please download AutoRuns and save it to your Desktop.
  • Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there.
  • Open the folder and double-click on autoruns.exe to launch it.
    Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Please be patient as it scans and populates the entries.
  • When finished scanning, it will say Ready at the bottom and list all entries under the Everything tab.
  • In the top menu, click File > Find... and type the file name of the startup you want to remove, then click Find Next.
  • Alternatively, you can scroll through the list and look for any entry related to the file you need to remove.
  • If found, right-click on the entry and choose delete.
  • Exit Autoruns and reboot your computer when done.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users