Strange behavior

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

tlund_99

Thread Starter
Joined
Apr 6, 2000
Messages
205
I'm trying to help an elderly friend,whose computer is doing the following...Win98 stops booting just before the desktop appears...hit ctrl-alt-delete...a strange name is shown in task box(ie:margo1 c)I hilight this name and end task...the computer then boots to desktop.He then randomly gets "this program has performed an illegal operation etc."If you click close the program closes and goes back to desktop.If you do not close the error box you can continue to work(in Windows Explorer for example)
Ran HiJackThis found...C:\Windows\Margo1 c.exe...had HijackThis fix it.I the checked and searched the registry and found C;\Windows\margo1 c.exe in the "Run once" key under Windows.I deleted the margo1 c.exe .
When I restarted the computer it stopped at the same place during the boot,found another strange name(ie: zpj2x4.exe) in the task box and in the Run Once key in the registry....I went to the Windows folder and deleted all the strange .exe files and now the computer boots O.K. Does this activity ring any bells for anyone as to what virus-worm or trojan whatever might be causing this.I have checked the viruses listed at Trendmicro for this type of activity and could find none....
 
Joined
Jan 30, 2004
Messages
820
If you could use paragraphs next time its alot easier on the eye.

and try these steps after you eventually boot into desktop.

Before doing anything turn of system restore
My computer > Control Panel > System > System Restore Tab > Check Turn off system restore on all Drives

When your done dont forget to turn it back on

1)Go to Online Av Scan And run a free anti-virus test
1a)reboot

2)Then dowload ad-aware
Ad-Aware
Before you scan with AdAware, check for updates of the reference file by clicking on "Check for updates now", connect.

Click on Start, Use custom scanning options, Customize.

Make sure the following settings are made and on -------"ON=GREEN"

"Scan within archives"
"Scan active processes"
"Scan registry"
"Deep scan registry"
"Scan my IE Favorites for banned URL"
"Scan my host-file"

Click on Tweak,
Select scanning engine and click on "Unload recognized processes during scanning"
Select cleaning engine and click on "Automatically try to unregister objects prior to deletion" and "Let windows remove files in use at next reboot"

Then click "proceed" to save your settings.

Click on Next

Run the scan and fix everything.

2a)Reboot

3)Then get Spybot S&D to clear remaining spyware.

Short tutorial and download link here:
Spybot

Fix everything SpybotSD labels in red, and immunize.

4)Then download Spyware Blaster
Spyware Blaster
to prevent future spyware/ad-aware make sure u update weekly

5)Then after reboot:

6)Also run CWSShredder to remove Variants of the CoolwebVirus
get it Here Note: Make sure to have all windows closed except for CWSShredder.
Run the program and let it do it's thing. Make sure to click on "Fix" and not scan only.
6a)Reboot.

7)Download 'Hijack This to its own folder Get it Here
Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet

8)Also Download StartupCPL HERE
and uncheck unecesarry startups. Use Pacs startup list to identify what you need and dont need search the exe's
Website Here
Zip of Startup list Here

Use Startup List to generate the things that startup on your computer with info get it Here

Make sure you have the Latest Window Updates get them Here

How to boot into safe mode: here
 

tlund_99

Thread Starter
Joined
Apr 6, 2000
Messages
205
I'm sorry ,I am not at the problem computer..I have already run AVG anti virus
Adaware,Spybot and CWshedder..I just thought someone might recognize the strange activity....the Run once etc. and associate it with a malware product.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top