Error Message on Windows Startup in XP

[sushantvirdi]

I receive the following message when i start XP. It appears eveytime i log on to my computer. What should i do?

[wizrulz]

Finding a program called temp2.exe running on your computer means that your computer might be infected with a worm known as 'irc.momma'.

temp2.exe is considered to be a security risk, not only because antivirus programs flag irc.momma worm as a virus, but also because a number of users have complained about its performance.

CHECK UR COMPUTER

Go here and check ur comp for viruses and worms..or check ur comp with spybot s/w, antivirus...updated one's if uhave any

[vijay_7287]

thx for the info wiz!

[sushantvirdi]

thx..

[anandk]

yep, temp2.exe is malware as refered to as Backdoor.Win32.small.lo
though it appears that the malware has been removed i suggest u nevertheless scan in SAFE MODE ur pc with ur av AND avg anti-spyware or a-squared anti-malware.

then clean ur ur residual pc junk with ccleaner.

if problem stl persists pls post ur hjt logfile here; v may have to remove some startup entries.

[sushantvirdi]

I scanned my system using SpyBot and removed all adware but the problem persists...

[wizrulz]

Originally Posted by sushantvirdi

I scanned my system using SpyBot and removed all adware but the problem persists...

did u used the link i gave???

[g_goyal2000]

Find out the path of "temp2.exe" file. The restart the PC in "safe mode with command prompt". Goto the file's path & erase it using command "erase temp2.exe".

Else,

Then use this cleaner:
http://www.trendmicro.com/ftp/products/tsc/sysclean.com (executable)

And it's definition file from here:
http://www.trendmicro.com/ftp/produc...ern/lpt211.zip

Extract the zip file, make sure both the def & exe file are in same folder.

Restart in safe mode.

Run the sysclean.com file.

[sushantvirdi]

Ok mates, the above error message has vanished as i deleted it using Kaspersky AV. But now a new problem has come up. Whenever i try to Click any of my hard drives to acces it i get error listed below. Also an Autoplay menu has also up on all drives when i right click on the drives.... So in order to acces my drives i have to use Windows Explorer...

[n2casey]

Find a hidden file on ur all drives (not folder) named as autorun.inf, Delete all those files.

[wizrulz]

Finding a program by the name of copy.exe running on your computer is usually a sign that your pc might be infected with a worm that goes by the name of salga.a.

Salga.a Worm is likely a virus and as such, presents a serious vulnerability which should be fixed immediately! Delaying the removal of copy.exe may cause serious harm to your system and will likely cause a number of problems, such as slow performance, loss of data.

Update ur KASPERSKY AV and run it agian in safe mode....

AND/OR

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
windows
%SYSTEM%\system copy.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
system xp
%WINDOWS%\acdsee demo.exe

and delete them if they exist.

Close the registry editor.

[sakumar79]

It appears that the AV removed the virus file, but not the startup entry. Use msconfig to locate the startup entry for copy.exe and remove.

On the safer side, you can run the AV scan and an anti-spyware scan in safe mode.

Arun

[sushantvirdi]

i have scanned my computer in Safe mode with latest definations, but the problem is persisting.. Please help how to remove the autoplay command...

[sakumar79]

Go to Start Menu and press Run... Type in "msconfig" (without the quoutes) and press enter. Go to Startup Entries Tab and look at the list of entries. Make sure the entry for copy.exe is unchecked. Press Ok and restart.

Arun

[Vishal Gupta]

Open regedit and goto:

HKEY_CLASSES_ROOT\Drive

and under this key, u'll get many keys but only 2 keys are of our interest:

Shell
Shellex

just open these 2 keys and look for any key which has the same name as u get in Drives context menu and that key will contain the same application name "copy.exe" in its value.

So if u find such key, just delete it.

[sushantvirdi]

There is no entry for copy.exe

[Vishal Gupta]

^^ are u talking about my regedit entry or Arun's msconfig entry?

If u r talking about regedit, then look into:

HKEY_CLASSES_ROOT\directory
HKEY_CLASSES_ROOT\folder

Just search for copy.exe in regedit and u'll surely get an entry for it and then post the result here.

[sushantvirdi]

I searched the registery for copy.exe and got this....

[Vishal Gupta]

Simply delete the key {6cc6ff02-.............. under MountPoints2 key.

PS: pls use thumbnails.

[sushantvirdi]

Thanks mate.. That worked.....

Thanks everyone who helped me....

[Vishal Gupta]

Thats gr8 buddy that ur problem solved!

[khattam_]

Originally Posted by n2casey

Find a hidden file on ur all drives (not folder) named as autorun.ini, Delete all those files.

I think autorun.inf.... anyways, congratz problem solved

[n2casey]

Originally Posted by khattam_

I think autorun.inf.... anyways, congratz problem solved

OOPSss! silly mistake.
Thx for correcting.

[sushantvirdi]

Oh sorry to say, i deleted all the enteries which u said.. but after restart i am getting the same problem....Will i have to stay like that whole life...

[Arsenal_Gunners]

Originally Posted by sushantvirdi

Will i have to stay like that whole life...

no dude we will find something
__________
see this thread-i have find the solution of the copy.exe problem here
error opening my hard drive partition