Windows Explorer open in System32 folder
 
  Tweaks.com
 Home    Members    Calendar    Who's On        Main Site
 



««12

Windows Explorer open in System32 folderExpand / Collapse
Author
Message
Posted 7/27/2003 10:56 AM


New Member

New MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew Member

Group: Forum Members
Last Login: 3/4/2005 7:16 AM
Posts: 39, Visits: 1

From nothing, allways I boot the Windows Explorer now opens in C:\Windows\System32 folder. This happens since today morning...


Post #668
Posted 7/27/2003 10:56 AM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5

Hi Madera,


HAve you done a virus scan with an updated signature lately


If not, please do, and you might also want to check the system32 folder for the file system32.exe which would be the viral file if present.


Please post back with info.



Cheers

Post #26476
Posted 7/27/2003 10:56 AM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 6/28/2008 11:26 AM
Posts: 3,282, Visits: 803
Another thing that can cause this is removing a program that starts up with windows, but the entry is still present in either MSCONFIG or the startup folder in the start menu.



Write your questions down on the back of a $20 dollar bill and send them to me.

j79zlr's tips and tweaks
Post #26477
Posted 7/27/2003 10:56 AM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5
Yes, if it isn't viral could you please do the following:

Go to Start > Run, and type or paste the following into the box, then click OK:

regedit /e C:\run.txt HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

That will export the contents of the Registry Machine Run key to a C:\TestRun.txt file
Please do a copy and paste of that Run.txt file, and show us its contents.
Now run this one:

regedit /e C:\TestRun2.txt HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

That will export the contents of that key to a "run2.txt" file
Show us the contents of that one as well.


Cheers

Post #26478
Posted 7/27/2003 10:56 AM


New Member

New MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew Member

Group: Forum Members
Last Login: 3/4/2005 7:16 AM
Posts: 39, Visits: 1

OK! While I´m sccaning C:. I´ll show you results of your posts:


Run.txt


Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="\"C:\\WINDOWS\\UpdReg.EXE\""
"Fix-It AV"="\"C:\\ARQUIV~1\\Ontrack\\SYSTEM~1\\MemCheck.exe\""
"NvCplDaemon"="\"RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup\""
"nwiz"="\"nwiz.exe \" /install"
"MS Updates"="\"C:\\WINDOWS\\mscache.exe\""


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"


TestRun2.txt


Windows Registry Editor Version 5.00


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"BlockAds"="\"\""
"Tweak-XP"="\"\""
"NVIEW"="\"rundll32.exe \" nview.dll,nViewLoadHook"


SystemSuite 4 Virus Scann in System32 folder


Context Menu Virus Scanner Results:


Run: 27/7/2003 Madera 19:47:44


Categories checked:
All files


Files not scanned:
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM


Results Summary
Total files scanned: 5335
Total files not scannable: 10
Total infected files found: 0
Total files treated: 0


Recommended action:


Some files could not be scanned.  These files may be encrypted or in use by either Windows or another application.


The scanner cannot scan files that are locked by Windows, but most of these files are at a very low risk of infection. These include files with a .log extension (or no extension at all), virtual memory files (*.swp in Windows 95/98 or pagefile.sys in Windows NT/2000) and System Registry files (user.dat, system.dat, ntuser.dat).


If you would like to scan these files, close all open applications, decrypt any encrypted files, and try again. If you still cannot access the files, use the Virus Rescue Disk to scan them.


In some cases you may need to use the Virus Rescue Disk set.  The disk set, including instructions, can be downloaded from http://www.ontrack.com/virusinfo/rescue.asp.  Please use a machine that is not infected with a virus to create the disk set.


Post #26479
Posted 7/27/2003 10:56 AM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5

Are these two programs removed ?


"BlockAds"="\"\""
"Tweak-XP"="\"\""



Cheers

Post #26480
Posted 7/27/2003 10:56 AM


New Member

New MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew Member

Group: Forum Members
Last Login: 3/4/2005 7:16 AM
Posts: 39, Visits: 1

Yes. I turn TweakXP on again!! But BlockAds I don´t know what is it!! I have Advertiser Block active in my browser - MyIE2.



 

Post #26481
Posted 7/27/2003 10:56 AM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5

Lets see if j79zlr can help us out here.



Cheers

Post #26482