View Single Post
  #6 (permalink)  
Old August 5th, 2007
maggieduke maggieduke is offline
Novicius
 
Join Date: August 5th, 2007
Posts: 1
maggieduke is flying high
Default

Hello all, and thanks for the information posted here.
There were some problems on one of my systems after several different people had been using the system -- I do no know when the problem started. However, I fixed the problems.

Problem one -- even though uninstalled, there was a recurring pop-up purporting to be Limeware complaining about the Java run time environment.

Problem one fix: Run regedit, search for anyting with limeware in it, and delete the entry (assuming you have already uninstalled limeware!) The limeware uninstall did not remove some registry entires.

Problem 2: Typing "cmd" at the start --> run prompt does not run cmd.exe (nothing happens)
Problem 2 fix: Someone or something added an empty file "cmd.com" to Windows/system32. Just delete the file, but check properties first to make certain the file is o bytes. If you are unsure, just rename the file to cmd1.com. You can recovery by just renaming the file back to cmd.com. If you can't see system32, be sure to select Tools -- Folder options -- view and check the show system folders and show hidden folders radio buttons.

Problem 3: Cannot launch task manager by ctl-alt-del. typing taskmgr at the run prompt gives "process in use by another user" message.
Problem 3 fix: First, as noted in a previous post, copy taskmgr.exe from Windows\system32 and paste to the desktop. Double-click the desktop icon for taskmgr.exe, and an instance of taskmgr should open.
In my case, there was a process named "outlook" running. Since Outlook is an application, it should not show up under processes, so I ended the process. Then I could launch taskmgr by ctl-alt-delete. (In general, I am not concerned about ending any process -- the worst that ususally happens is the system will force a restart. ) taskmgr.exe was starting at system boot with a process name outlook, so there were two possibilities: the culprit was in the Documents and Settings - <probaly all users> - start folder -- startup folder (where it was not hiding), or in the registry under software/Windows/run key (which is where I found it). A trojan horse had created a folder "outlook" under the Programs directory and set the attributes of the folder to Hidden and System. In this folder was an executable "outlook.exe" with a Description as "Setup.exe", and a zip file and a data file. Step one: change the name of the file Programs\outlook\outlook.exe to outlook1.exe (if you get a complaint about the task running, use taskmgr to end the process "outlook". Restart the system, and you should be able to launch taskmgr by ctl-alt-delete. If you, too, find this fixes the problem, permanently fix the problem in the registery. First, you might wish to save a current copy of your registry (File- export), just in case you delete something that you did not mean to delete. Search for entires with outlook\outlook. You should find an entry in /run and in /cache. Delete both. Next, right-click My Computer, choose properties, and stop the restore process ( so you do not save a restore point with the problem), and restart your system. If all is well, turn on the restore process. Finally, you should rename or remove the "outlook" folder from Program Files.

I expect the vector for this trojan horse is most likely a limeware download. The security breach is that someone was running with Administrator privledges (which allowed the virus to access the registry). Know your source when downloading, especially if the download is a pckage requiring installation on the local machine. Always check the signature (checksum) against the primary source's signature.

Hope this may help.
Reply With Quote