Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Critical System Errors!


  • Please log in to reply
2 replies to this topic

#1 TBaloney1

TBaloney1

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 14 November 2006 - 01:50 AM

Hi,

For the past couple of days, I've been having a problem with my computer. I believe this has already been discussed, but I'm still confused about it. Anyway, here goes:

The bottom right of my task bar has a blinking yellow X / question mark that shows the bubble "Critical System Errors!" When clicked, the bubble leads me to a site for Virusbursters (an anti-virus product site). Also, my Internet Explorer homepage keeps getting redirected to "eprotectpage.com," which says things like "you have a system virus, etc." On top of all of that, sometimes a site will be blocked and a bar will tell me to "click here to download a spyware removal program, etc."

I managed to get a copy of McAfee and it took care of some of my problems, such as a popup that periodically displayed adult ads saying "If Abuse, Click Here." Anyway, to make a long story short, what exactly do I need to do? I read some of the prior posts regarding this problem, and they recommended Hijackthis and SmitFraudFix, so I downloaded both of them and they're now on my desktop. Where do I go from here? Any help would be greatly appreciated. Thanks in advance.

BC AdBot (Login to Remove)

 


m

#2 SpiritWind

SpiritWind

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:07:31 PM

Posted 14 November 2006 - 03:16 AM

:thumbsup: Hi TBaloney :



Open the SmitfraudFix folder


Double-click smitfraudfix.cmd

Select option #1 - Search by


a. typing 1

b. pressing "Enter"



A text file will appear which lists infected files (if present).

Please copy/paste the content of that report into a new topic of your own .


Note
process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. (See http://www.beyondlogic.org/consulting/proc...processutil.htm )
_________________

Also post a log of the HijackThis program in a thread you start in the HijackThis forum .

Edited by SpiritWind, 14 November 2006 - 03:17 AM.


#3 TBaloney1

TBaloney1
  • Topic Starter

  • Members
  • 28 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 14 November 2006 - 05:19 AM

Hello, I was able to get rid of the yellow x/bubble by following the directions for removing VirusBursters. Unfortunately, I am still having a problem with my browser (my homepage is still getting redirected to eprotectpage.com)

This is what I got from SmitFraudFix:



SmitFraudFix v2.120

Scan done at 2:11:54.73, Tue 11/14/2006
Run from C:\Documents and Settings\Owner\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

C:\


C:\WINDOWS


C:\WINDOWS\system


C:\WINDOWS\Web


C:\WINDOWS\system32


C:\WINDOWS\system32\LogFiles


C:\Documents and Settings\Owner


C:\Documents and Settings\Owner\Application Data


Start Menu


C:\DOCUME~1\Owner\FAVORI~1


Desktop


C:\Program Files

C:\Program Files\QualityCodec\ FOUND !

Corrupted keys


Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}"="bonspells"

[HKEY_CLASSES_ROOT\CLSID\{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}\InProcServer32]
@="C:\WINDOWS\system32\okkmtv.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{11853d5f-f894-4cc7-bbc3-fc7a9dcfd896}\InProcServer32]
@="C:\WINDOWS\system32\okkmtv.dll"



AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


pe386-msguard-lzx32


Scanning wininet.dll infection


End




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users