[hewwo2u2]

Originally Posted by new tech guy

Another thing you could do in vista is turn off the aero effects, to do that, right click the desktop>personalize. then click window color and appearance. Then click to open the classic properties pane and select either vista basic or windows classic and hit apply. Should lighten up vista a bit if it doesnt have to load the bloated aero effect. (linux did similar layouts that use a fraction of the recources, microsoft should take a page from their book).

what is the difference between aero and basic? from the preview they look the same....

[hewwo2u2]

another question:
when ending processes, services, and startup programs what are the differences between doing it via msconfig, windows task manager, and windows defender? Which one should I use to make changes?

[hewwo2u2]

Help please- I just found something very disturbing!!!!!

I'm looking in my Windows Defender and I have something running called

"Microsoft Userinit Logon Application" File name: userinit.exe
it says in the info section beside it that its publisher is Microsoft corporation and that it is digitally signed by Microsoft Windows Verification PCA. It even says that it ships with the operating system.

Then while searching the first site you listed I found this:

name: userinit.exe
status command: userinit.exe
description: Added by the HAXDOOR-DP TROJAN!

is this the same thing????? if so what do I do? how do I remove it!!!! and how come AVG never detected it??? help!

[flavallee]

Black Viper Services Guide For Vista:

http://www.blackviper.com/WinVista/servicecfg.htm

Use the "Safe" column as a starting point.

----------------------------------------------------------------

[hewwo2u2]

I have gone through and disabled the services the safe column listed. Is there any more advice that can be given or do I just need to accept that my computer will never be like it was when I bought it?

[Rich-M]

Originally Posted by hewwo2u2

I have gone through and disabled the services the safe column listed. Is there any more advice that can be given or do I just need to accept that my computer will never be like it was when I bought it?

The way to return it to the state you bought it in, is to reformat and reinstall Windows.

[hewwo2u2]

This is what I was considering doing from the very beginning but my computer did not come with a cd with windows on it. I guess the next best thing to do is to use the option on my computer to restore to its factory state.

but from the logs... is there anything else that could be causing my problem?

[new tech guy]

May not be and if it is a known trojan, our malware removal forum should be cleaning up your computer. If you want a mod to check the logs for spyware just put a report in for it.

[hewwo2u2]

Originally Posted by new tech guy

May not be and if it is a known trojan, our malware removal forum should be cleaning up your computer. If you want a mod to check the logs for spyware just put a report in for it.

is this a separate forum? do I just run a log and post it there?

[new tech guy]

I will drop a report for you.

[hewwo2u2]

thanks!

[new tech guy]

No problem, hopefully a moderator appears shortly to take a look.

[Cookiegal]

I haven't read back through over 70 posts but I looked at the log and don't see anything malicious. There is one item of foistware that should be removed via the Control Panel - Add/Remove programs and that is anything with the following names:

Viewpoint
Viewpoint Manager
Viewpoint Media Player


As for the userinit.exe file, the valid file should be in System32 whereas a Haxdoor file would likely be in C:\Windows

Keep in mind even the userinit.exe in the valid location can be infected but I don't see any signs of infection in your HijackThis log, although not everything would show in a HijackThis log.

I also noted two anti-virus programs but I'm sure that would have been mentioned that you should uninstall one of them.

I will ask for a couple of simple scans which will tell us more but I won't move the thread just yet.

Download GMER from: http://gmer.net/index.php

Save it on your desktop and unzip it.

Double click the gmer.exe to run it and select the rootkit tab and press scan. When the scan is done, click Copy. This will copy the report to the clipboard. Paste it into Notepad and save it and also paste the log report back here please.


Please download Malwarebytes Anti-Malware form Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply along with a new HijackThis log please.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Also, if you receive an (Error Loading) error on reboot please reboot a second time . It is normal for this error to occur once and does not need to be reported unless it returns on future reboots.

[new tech guy]

Thanks cookie, wanted to rule malware out of the equation .

[hewwo2u2]

i believe i disabled this viewpoint manager thing when going through my services from that website