Software on machine I'm unable to remove/error on startup

Andybtsn

Andybtsn

Andybtsn

Don
Joined
23 Oct 2005
Posts
44,364
Location
North Yorkshire
Hi all,

Long shot but I have a really annoying issue. Somehow some software managed to get on my machine and when my PC boots into Windows the following messages are shown:

error.png


error2-1.png


I could never see anything in add/remove programs so i search for this software and found the website here. I re-downloaded this .NET Reactor software and installed it, it then showed in add/remove. I subsequently removed it but the same messages appear on bootup.

I've done malware checks and googled this message which appears quite common but am yet to find a working fix. Some say a windows.exe is hidden in a temp folder, I found the folder but no such exe. Also others say malware should find and quarantine the software, again this hasn't worked.

Has anyone any idea on what I could try? Having just built this rig and stuck Windows 7 on a format is a last resort.
 
Disable system restore (to remove ghost traces of it)
Run ccleaner slim (to remove temp files to speed up scanning)
Download, update and run MBAM. Use the free version, decline the trial for full version.

Should get rid of it.

After that, run a nod32 online scan too.
Then run spybot s&d
 
By the looks of it the message is simply telling you that one
piece of software on your machine is protected by this license tool
and that you do not have a license for said software

I would try a system restore to take it back to as close to windows install date
as possible
 
Right, it's still there. I went to MSConfig and it's listed in there, de-selecting it only makes it come back. There's three of them as three appear on bootup, the minute I press 'OK' another appears. I've made bold the 'thing' that it is in the below hijackthis log

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:08:33, on 12/09/2012
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\HsMgr.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Users\Andy\AppData\Local\Temp\Windows8.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Andy\AppData\Local\Google\Chrome\Application\chrome.exe
F:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe,
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [Google Update] "C:\Users\Andy\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [0a60e58c98a52b3a977e96a8c9cccfd9] "C:\Users\Andy\AppData\Local\Temp\Windows8.exe" ..
O4 - Startup: 0a60e58c98a52b3a977e96a8c9cccfd9.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: devolo Network Service (DevoloNetworkService) - Unknown owner - C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Splashtop® Remote Service (SplashtopRemoteService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Splashtop Software Updater Service (SSUService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 5816 bytes
Click to expand...
 
Now you know where it is, did you try deleting it? It may be set as a system file. So make sure both those and hidden files is set to show.
 
Funnily enough when first researching this people said there was a windows.exe like I explained in the OP now I've gone to the temp folder and the windows.exe is there!

So I've deleted it and touch wood, that's the end of it.

I only assume when I installed the software again it put the exe there.

Thanks all for your help :)
 
You must log in or register to reply here.
Back
Top Bottom