[jazznanny]

Hello,
Ive found a file on two computers I own
that have been Hijacked by unknown source.
Whatever or whom ever owns this file its the same on both computers , that did at one time share DSL.
I am not allowed to delete these files and whatever they are they run everything on both computers. My notebook and desktop have the same S-1-5-21 and so on.I don't know what it is or where they came from. All I know is that these files are unremoveable.And errors pop all over when I click delete.
How do I remove files that stop you from deleting them?Please help because what has happened now is when I do a reinstall they are still on both computers.
I can't use my notebook with my two wire connection , its not allowed by whatever is on the computers ,so I unplug one to use the other. Yes, I even have to use my notebook with my modem or I don't get to use it at all. This is getting to be a big problem.
Ive found out also that both computers cut off when I try to delete anything. All windows services get disabled if I manage to get the computers in safemode. And security software is stopped from running and are disabled.
Please if you have any suggestions as to something that might work I will be grateful.
Thank You Jazznanny

[1002richards]

I think you should 'report' the thread to ask for it to be moved to the Malware forum, and I think you should post a HJT log - as per this TSG link:
http://forums.techguy.org/malware-re...st-before.html

Richard

[jazznanny]

Hello!,
I will get hijackthis as soon as I log out.But I didnt understand what if you meant
for me report the files here or somewhere else. Never the less I will report it any where
I need to.
This Hijack has been going on for a year now and Im way past a little tired of it.
The files are in the registry two times on both computers, here's the full file name-
Hkey_Users/S-1-5-21-1417001333-412668190.
I wonder if I could ever find out what they are and where they came from?
I do know that when a computer has them they rule everything.
Thanks Again Jazznanny

[1002richards]

Hi,
Bottom right hand corner of the thread, just along from where you've typed Jazznanny - that's the 'report' button you need to click on.

Richard

[Frank4d]

S-1-5-21-1417001333-412668190 is the security ID for the computer. If the whole number after 'S-1-5-21' is the same on your laptop and desktop then one drive was cloned from the other. Why do you think there is a problem with these keys that are present on every PC running Windows XP?