Give me a clue....

D

Deenem

Expert Member
Joined
Apr 20, 2005
Messages
1,724
Reaction score
2
Location
JHB
Hello nice people,

I've got something wierd going on with my laptop at work.Not sure if it's a virus or something else.

I have McAfee installed so any virii should (in theory) be detected.

The problem is, in Explorer, I go into Folder Options and chage the setting to 'Show Hidden Files And Folders', I click on OK, but the settings doesn't change (hidden files are not shown). I go back and check it and it's been reset to 'Do not show hidden files and folders'

This looks like some sort of process running in the backround to prevent me from changing the setting in order to hide the virus files from me. Very suspicious.

I've looked in task manager, can't see anything unusual, I've run Rootkit Revealer, nothing found.

This one has really go me confounded.

Does anyone have any suggestions about other options to try?
 
Telkomisaloser said:
Could you post the entire process list that is displayed in the task manager?
Click to expand...

Easy and quick way to do so :

Go to Start, Run, type in CMD and press Enter.

At the prompt, type in the following

tasklist > tasks.txt

All the current running tasks will be in a file called tasks.txt - you can edit this file with notepad, and copy/paste the contents of said file here.

Regards

Libs
 
The_Librarian said:
Easy and quick way to do so :

Go to Start, Run, type in CMD and press Enter.

At the prompt, type in the following

tasklist > tasks.txt

All the current running tasks will be in a file called tasks.txt - you can edit this file with notepad, and copy/paste the contents of said file here.

Regards

Libs
Click to expand...

Thanks, good to know! :)
 
Telkomisaloser said:
Could you post the entire process list that is displayed in the task manager?
Click to expand...


Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 28 K
System 4 Console 0 248 K
smss.exe 1268 Console 0 424 K
csrss.exe 1376 Console 0 4,312 K
winlogon.exe 1404 Console 0 5,900 K
services.exe 1448 Console 0 3,716 K
lsass.exe 1460 Console 0 8,396 K
svchost.exe 1640 Console 0 9,396 K
svchost.exe 1668 Console 0 5,280 K
svchost.exe 1728 Console 0 4,700 K
svchost.exe 704 Console 0 22,136 K
svchost.exe 980 Console 0 3,632 K
svchost.exe 1856 Console 0 23,156 K
spoolsv.exe 228 Console 0 8,092 K
scardsvr.exe 264 Console 0 2,700 K
msdtc.exe 1040 Console 0 5,196 K
APServer.exe 1232 Console 0 1,796 K
btwdins.exe 1308 Console 0 3,220 K
cvpnd.exe 1332 Console 0 5,464 K
DkService.exe 1356 Console 0 6,956 K
IFXSPMGT.exe 1624 Console 0 8,584 K
IFXTCS.exe 1784 Console 0 6,656 K
inetinfo.exe 1820 Console 0 8,340 K
FrameworkService.exe 356 Console 0 9,176 K
Mcshield.exe 576 Console 0 54,368 K
VsTskMgr.exe 832 Console 0 1,148 K
NMSAccessU.exe 1424 Console 0 1,896 K
PSDsrvc.EXE 1968 Console 0 2,248 K
naPrdMgr.exe 1988 Console 0 924 K
svchost.exe 916 Console 0 4,268 K
vmount2.exe 1868 Console 0 4,756 K
vmnat.exe 2032 Console 0 2,204 K
mqsvc.exe 520 Console 0 9,032 K
vmware-authd.exe 864 Console 0 6,624 K
vmnetdhcp.exe 2540 Console 0 1,768 K
hpqwmiex.exe 2580 Console 0 3,424 K
mqtgsvc.exe 2708 Console 0 3,992 K
alg.exe 3408 Console 0 3,632 K
msiexec.exe 4016 Console 0 9,176 K
asghost.exe 2828 Console 0 14,100 K
explorer.exe 2636 Console 0 28,692 K
PSDrt.exe 2924 Console 0 13,324 K
TSVNCache.exe 3216 Console 0 26,476 K
googletalk.exe 3740 Console 0 16,188 K
ipoint.exe 2324 Console 0 14,216 K
igfxtray.exe 3508 Console 0 3,708 K
igfxsrvc.exe 3604 Console 0 3,816 K
hkcmd.exe 476 Console 0 3,668 K
dpupdchk.exe 3660 Console 0 2,456 K
igfxpers.exe 3792 Console 0 3,224 K
UdaterUI.exe 3808 Console 0 2,340 K
shstat.exe 3840 Console 0 868 K
McTray.exe 784 Console 0 2,748 K
itype.exe 1440 Console 0 13,696 K
UberIcon Manager.exe 3960 Console 0 3,204 K
YzShadow.exe 440 Console 0 4,672 K
strokeit.exe 996 Console 0 332 K
daemon.exe 992 Console 0 11,076 K
RocketDock.exe 1616 Console 0 6,696 K
BTTray.exe 1176 Console 0 4,776 K
Client.exe 2172 Console 0 1,600 K
wmiprvse.exe 3600 Console 0 5,092 K
firefox.exe 3212 Console 0 80,428 K
cmd.exe 2420 Console 0 2,796 K
tasklist.exe 3268 Console 0 4,732 K
wmiprvse.exe 3296 Console 0 5,800 K

Rebooted in Safe Mode as well, same problem.
 
Eish, that laptop must be crawling with all that stuff running in the background.

Create a shortcut to explorer.exe (Not My Computer). Right click on that and select "Run as". Type in your admin details and then show the hidden setting in that explorer window.
 
I also had this problem on my home pc, after it had been infected with one of those flash drive trojans. Even after cleaning it out, I discovered that it had messed something up in the Registry.

Luckily I did a search, and found the needed and correct Registry entries to merge back and sort the issue out.

That strokeit file sounds suspicious. The flash trojans have some crative names these days.

Btw, change your AV to something faster and not so system intensive.
 
Telkomisaloser said:
Now that's a lot of applications:eek:
I suggest stopping some of the applications
Click to expand...

2Gb of memory, runs just fine ;)

Turiko said:
looks really suspicious
Click to expand...

It's a mouse gesture app I run (http://www.tcbmi.com/strokeit/)

I'm convinced it's either:

a) A very clever virus that's doing everything it can to hide itself.

b) Some innocent app that thinks it's protecting me from myself by not allowing me to see hidden files and folder.

Just wish I could find out which.
 
Asha'man X said:
I also had this problem on my home pc, after it had been infected with one of those flash drive trojans. Even after cleaning it out, I discovered that it had messed something up in the Registry.

Luckily I did a search, and found the needed and correct Registry entries to merge back and sort the issue out.
Click to expand...

I had a nasty little thing called RavMon a while ago. I managed to delete it but could it have changed my settings when it was active?

Asha'man X said:
Btw, change your AV to something faster and not so system intensive.
Click to expand...

I wish, corporate network, no choice of the AV program :(
 
Deenem said:
I had a nasty little thing called RavMon a while ago. I managed to delete it but could it have changed my settings when it was active?



I wish, corporate network, no choice of the AV program :(
Click to expand...

Pity about the AV, but then again if it's corp enforced, they have their reasons for it. I've hightlighted RavMon, as that is definitely the cause of your issues.

I know for a fact that this stupid thing does that with the hidden files and folders option. Do a search for hidden files and folders not showing, and you should find the correct Windows Registry entries which you can merge back to sort things out.
 
Asha'man X said:
I know for a fact that this stupid thing does that with the hidden files and folders option. Do a search for hidden files and folders not showing, and you should find the correct Windows Registry entries which you can merge back to sort things out.
Click to expand...

Go to registry editor by running regedit in the run box.
Go to this key:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced
In the right hand area, double click hidden and change the value to 1.
Click to expand...

Thank you peoples !
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X