problem about program in startup

[sabajordan]

i have os 7 in my startup i have many program with differ name such as 36ABB.exe that i don't recognize it plz help if i delete these program maybe i destroy my windows ofcurse when i login to my windows these program take my cpu and memory and decrese my pc.s speed help me

 

[zigzag3143]

i have os 7 in my startup i have many program with differ name such as 36ABB.exe that i don't recognize it plz help if i delete these program maybe i destroy my windows ofcurse when i login to my windows these program take my cpu and memory and decrese my pc.s speed help me

You have to realize your system is woefully under powered in CPU, Ram, built in video etc. Your best bet for improving performance would be to add memory.

The files that you are concerned with should be googled to see what they are and if they should be running
\
\
Let us know if you need help


Ken

 

[Thorsen]

Do you have an AV (anti-virus program running)
If so, what is it? have you done a full system scan recently?

You can go through MSconfig (Start menu > Search > msconfig) and disable all of the non-essential programs.

Also, you can use Process Explorer (microsoft 3rd party App) to see better what is running on your computer: Process Explorer

When you find the program running, you can right click on it and select search online for online resources.

Edit: you can also, in Process Explorer, click on File then Save As and save a log of your running programs and post the .txt file here and we can review it to see know virus programs

 

[fishnbanjo]

Not at all familiar with the program 36ABB.exe and Google did not provide anything to assist. I would uncheck it so it does not load and reboot your system, the worst that can happen would be you'd get an error that something could not load and it would more than likely tell you what the program is.

I suspect you will not have ny such error and it was something either downloaded and set itself up to run. I certainly would make sure your A/V is up to date and run it after booting.

 

[Thorsen]

Please post in the thread instead of PM'ing. I think you have a virus on your computer so I will ask some pro's to look at the thread. One of the Security Experts might know what these programs are.

 

[sabajordan]

don't believe when i first see those files i 'm login by admin and then deleted them & then everything is good but then i 'm login to limited user and see the those files are running in taskmanager and i go & delete them of startup now i'am sure those file are virus but i can't find source them because i delete them & i don't know when i see them again i am updating my av (nod32 ver 4) but i 'm not sure this help me those file take whole of memory and system already is unusefull i 'm listing some of file's name such as 0A6A7.exe.exe , 0A6E6.exe.exe , 0A008.exe.exe , 0A197.exe.exe and etc number of those files in firsttime was 3000

 

[Thorsen]

Thanks for posting that sabajordan. I posted in another thread for help for you. Hopefully a guru will see and can help. I have done virus removal before, but always locally. There are people on this forum who can help you more than I can.

 

[Thorsen]

I think there is a program that is running at startup need to know what other prgrams are running that could be creating these files.

you can use Task manager to see what is running, but we need to see all programs that have ran from startup. I would like you to do the following.

Get Process Monitor Process Monitor

UnZip it and run it. Set it to do BootLogging. This will allow it to capture all the programs that run from the moment the OS Starts. Restart your computer so we can have a full list of what runs. When you get back in, go to the program again. You should have a full list of programs in the list. In Files or somewhere, there should be an option to save the list as a .txt file.

Post the .txt file here so we can see what program ran that could be a virus

 

[WindowsStar]

I have never seen these: 0A6A7.exe.exe , 0A6E6.exe.exe , 0A008.exe.exe , 0A197.exe.exe before. The naming looks like a BAD virus. I would build a boot CD off another known clean machine and boot off the CD and do a complete virus scan before doing anything else.

Downloadable Computer Repair CDs | Technibble
http://www.microsoft.com/security_essentials/
Malwarebytes

 

[Corrine]

Hi, sabajordan.

Indeed, those random file names are indicative of an infection. With Windows 7, you may want to first try System Restore to a point prior to when those files started appearing. Windows 7 has a much more robust System Restore than Windows XP and Windows Vista. If that doesn't work, I suggest an on-line scan. Since you have already scanned with NOD32, try F-Secure :

Go here and run an on-line scan with the F-Secure scanner .

• Use IE (Internet Explorer), accept the license terms, and allow the Active-X controls to load.
• Click Full System Scan and allow the components to download and the scan to complete.
• If malware is found during the scan, check Submit samples to F-Secure and Automatic cleaning.

I suggest following that with an MBAM scan:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, be sure Quick scan is selected, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, EXCEPT items in System Restore as shown in this sample:
  
  
• Click Remove Selected.

Let us know how you make out.

 

[sabajordan]

for my country everything doesn't do

I have never seen these: 0A6A7.exe.exe , 0A6E6.exe.exe , 0A008.exe.exe , 0A197.exe.exe before. The naming looks like a BAD virus. I would build a boot CD off another known clean machine and boot off the CD and do a complete virus scan before doing anything else.

Downloadable Computer Repair CDs | Technibble
http://www.microsoft.com/security_essentials/
Malwarebytes

in website microsoft this warning appear "You appear to be in a country or region where Microsoft Security Essentials is not available. Thank you for your interest in Microsoft Security Essentials." thx for your rep

 

[Thorsen]

Did you try Malwarebytes? The free version can scan your comp and probably will correct it. I would also so as soon as you install AV, update it so it has the latest virus definitions. This is ensure you find all the stuff on your comp.

Also, MS has support for Iraq: Microsoft Iraq Home Page
MSE is listed in the "Using your computer" section
There might be another reason why you are getting this message. If you are behind a proxy or firewall and MS is not able to see your computer or ip address, then this might be messing it up. Try disabling proxy or allowing access through firewall.

another thing to check would be in Control Panel > Regional Settings Make sure your time zone is set to your region correctly.

 

[sabajordan]

Hi, sabajordan.

Indeed, those random file names are indicative of an infection. With Windows 7, you may want to first try System Restore to a point prior to when those files started appearing. Windows 7 has a much more robust System Restore than Windows XP and Windows Vista. If that doesn't work, I suggest an on-line scan. Since you have already scanned with NOD32, try F-Secure :

Go here and run an on-line scan with the F-Secure scanner .

• Use IE (Internet Explorer), accept the license terms, and allow the Active-X controls to load.
• Click Full System Scan and allow the components to download and the scan to complete.
• If malware is found during the scan, check Submit samples to F-Secure and Automatic cleaning.

I suggest following that with an MBAM scan:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, be sure Quick scan is selected, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, EXCEPT items in System Restore as shown in this sample:
  
  
• Click Remove Selected.

Let us know how you make out.

this software sucessed to find this (C:\Windows\System32\{1E465794-1F7C-470d-A1C1-845C35A1D351}.dll) i don't know what do i do now ? plz help me and tell me what 's this is it trojan ? how can i remove this?
ps: i can't update software the latest it's signature is 29/4/2010 i hope it isn't important

 

[sabajordan]

Did you try Malwarebytes? The free version can scan your comp and probably will correct it. I would also so as soon as you install AV, update it so it has the latest virus definitions. This is ensure you find all the stuff on your comp.

Also, MS has support for Iraq: Microsoft Iraq Home Page
MSE is listed in the "Using your computer" section
There might be another reason why you are getting this message. If you are behind a proxy or firewall and MS is not able to see your computer or ip address, then this might be messing it up. Try disabling proxy or allowing access through firewall.

another thing to check would be in Control Panel > Regional Settings Make sure your time zone is set to your region correctly.

thx for your piteous but i 'm living in IRAN and no iraq many years ago iraq attached to iran and now it's seperate region anyway i download process monitor and active it but i can't save results in txt file and the software saved to xml & PML & csv so i can't send any information but malware found result and i tell about it in other post if you help me i 'm very gartefull

 

[Corrine]

this software sucessed to find this (C:\Windows\System32\{1E465794-1F7C-470d-A1C1-845C35A1D351}.dll) i don't know what do i do now ? plz help me and tell me what 's this is it trojan ? how can i remove this?
ps: i can't update software the latest it's signature is 29/4/2010 i hope it isn't important

Hi, sabajordan.

Yes, that is a trojan agent.

When you say you can't update the software to the most recent signature, do you mean MBAM (Malwarebytes)? If that is what you mean, please do the following to get the latest signature:

Download the latest MBAM update from here http://www.gt500.org/malwarebytes/database.jsp and manually install it. After updating, run a new scan. When the results appear, be sure that everything is checked and then click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found at C:\Users\UserName\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt on Windows Vista and Windows 7.

Please post the contents of that file in your next reply.

 

[sabajordan]

this software sucessed to find this (C:\Windows\System32\{1E465794-1F7C-470d-A1C1-845C35A1D351}.dll) i don't know what do i do now ? plz help me and tell me what 's this is it trojan ? how can i remove this?
ps: i can't update software the latest it's signature is 29/4/2010 i hope it isn't important

Hi, sabajordan.

Yes, that is a trojan agent.

When you say you can't update the software to the most recent signature, do you mean MBAM (Malwarebytes)? If that is what you mean, please do the following to get the latest signature:

Download the latest MBAM update from here http://www.gt500.org/malwarebytes/database.jsp and manually install it. After updating, run a new scan. When the results appear, be sure that everything is checked and then click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found at C:\Users\UserName\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt on Windows Vista and Windows 7.

Please post the contents of that file in your next reply.

thx for your help you want contents of this file & i show these contents :
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4189
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
06/12/2010 03:03:50 ?.?
mbam-log-2010-06-12 (15-03-50).txt
Scan type: Quick scan
Objects scanned: 125671
Time elapsed: 12 minute(s), 53 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Windows\System32\{1E465794-1F7C-470d-A1C1-845C35A1D351}.dll (Trojan.Agent) -> Delete on reboot.
i hope those files in my startup created by this trojan & i hope with delete this trojan my problem disapper

 

[Corrine]

Hi, sabajordan.

After restarting your computer, I suggest you clear temp files. This simple tool does a nice job. With Windows 7, right-click and run as Administrator.

Please download ATF Cleaner by Atribune from ATF-Cleaner.exe - www.atribune.org . Save it to your Desktop.

Run ATF Cleaner

• Right-click ATF-Cleaner.exe and select Run as Administrator.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.
• Click Exit on the Main menu to close the program.
• Shutdown/restart the computer.

Following that, I suggest you check that ESET NOD32 is updated and run a full system scan.

Let us know how you make out.

 

[sabajordan]

thx

Hi, sabajordan.

After restarting your computer, I suggest you clear temp files. This simple tool does a nice job. With Windows 7, right-click and run as Administrator.

Please download ATF Cleaner by Atribune from ATF-Cleaner.exe - www.atribune.org . Save it to your Desktop.


Run ATF Cleaner

• Right-click ATF-Cleaner.exe and select Run as Administrator.
• Click Select All found at the bottom of the list.
• Click the Empty Selected button.
• Click Exit on the Main menu to close the program.
• Shutdown/restart the computer.

Following that, I suggest you check that ESET NOD32 is updated and run a full system scan.

Let us know how you make out.

hi
i did your suggest and thankyou if you have time plz other post i wrote i 'm studing class MCSA and my teacher wanted that install VMware but i can't install it if you can help me i 'm gratful from you http://www.sevenforums.com/virtualization/90505-problem-install-vmware.html

 

[Thorsen]

Did Corrine's instructions solve problem? clean up your computer completely?

 

[sabajordan]

Did Corrine's instructions solve problem? clean up your computer completely?

i don't know exactly .everything is ok now & i think i 'm free from preproblem