Xp starting with pop up message

[shemeerali]

Dear freinds !!!! MY managers pc is showing the error msg that "You raped me *******" whenevr it starts. There were some virus in the pc.But now all the virus have been removed using macfee but the pop up is coming now. i Searched my registry for this entyr but nohng found. Lots of other pop up were there but all removed by checking in regedit. but this one really eating my time Please help

Thanx in advance

 

[draceplace]

look in mfsconfig and check out the items in startup. If not there scan the PC hard drive (although it could be on the network is starts locally) looking for *.vbs files (hidden and system). This prank is often done with vbscript and thats where I would start. One of those HJT logs may list this also. The name may be vague so you may have to "Edit" not Open the *.vbs file and see whats in it.

Also if this only happens when manager logs in, only on reboot, or anyone logging in will be a clue on the setup of this 'prank'. Before you delete or rename the offending file check advance properties and see who the file owner is?

 

[Sief9]

Like draceplace said, that's most likely a prank, no virus (that I've seen) is that specific.

Umm, to add on with what drace said, you could check the "Startup" folder on the computer, maybe the *.vbs file is in there.

 

[oshwyn5]

Dear freinds !!!! MY managers pc is showing the error msg that "You raped me *******" whenevr it starts. There were some virus in the pc.But now all the virus have been removed using macfee but the pop up is coming now. i Searched my registry for this entyr but nohng found. Lots of other pop up were there but all removed by checking in regedit. but this one really eating my time Please help

Thanx in advance

I would have a malware expert check into this.
have them review a combofix log for files created on or about the time of this as well as abnormal entries.

Is this a text message or could it be a picture? I have seen this where a virus put in a preboot image and screensaver file which load even after the virus is removed.


Also , X-Setup (free version will do) may help you find these entries
(version 6.3 )
http://www.majorgeeks.com/article.php?sid=127

It will be something like this
Launch and agree to terms
Choose default classic interface
Go to startup / shutdown => startup=> Win2k/xp
Section 30 before login
Check legal notice
Check pre login screen saver
check pre login wall paper

 

[shemeerali]

But my frnd i uncheckd all the items on the startup using msconfig. But still that comes. And i tried 2 in administrator also !! the same popup comes dear

thanks for spenting ur valuable time for me. Pls revert me back

 

[draceplace]

Any results from the *.vbs file search or did you try X-Setup?

I now concur with oshwyn5 that you need to have a malware expert check it out. More problems can be caused by acting without knowing the problem.

Have your Boss log onto a different computer and see if it goes away. Do you have roaming profiles? If it goes away get your boss a different computer with his files and programs. Then fix this one.