Irritating error message.

[groucho]

Right....When my computer has finished booting up, I have a couple of irritating information dialogs.

They read.......

The path to 'C:\WINNT\system32\27.tmp' does not exist or is not a directory.

The second one.........

Cannot find the file 'C:\WINNT\system32\27.tmp' (or one of its components). Make sure the path and filename are correct and that all required libraries are available.

Now, when I was running AVG, it flagged 27.tmp as a trojan, so it fixed it. (yeah right)

I was advised by somebody to go to Start > Run and type in msconfig and then untick the offending file in the startup list.

The trouble is I get this error message when typing in msconfig...


Cannot find the file 'msconfig' (or one of its components). Make sure the path and filename are correct and that all required libraries are available.

Anybody got any ideas?

Cheers.

[groucho]

I just tried that but it said 'Could not find file 27.tmp'

[thepassenger]

Ok, try your best to get something like notepad to open.

Open system.ini & win.ini
system.ini: Shell=Explorer.exe Openme.exe
win.ini: run=hpfsched

Make sure the Shell line only has Explorer.exe in it.

Whilst Win.ini is an old way of starting up stuff it is still a valid way of getting a trojan to start up, so make sure it's not pointing towards anything annoyingly familiar.

Edit: Borrowed the above from www.spywareinfo.com/~merijn/htlogtutorial.php

Edited by thepassenger on Friday 1st September 21:12

[groucho]

To be honest, that doesn't make a lot of sense to me.

[BliarOut]

Download hijackthis and then run a scan only. You'll find a couple of entries relating to the temp file. Tick them and select fix, job done.

[groucho]

BliarOut said:

Download hijackthis and then run a scan only. You'll find a couple of entries relating to the temp file. Tick them and select fix, job done.

Well, that got rid of it. I don't know whether it was a one off, but the My Documents folder initiated on boot-up.

[BliarOut]

It's trying to open a non-existant file located in my documents now... Hijackthis can fix it if you can figure out which file it's trying to do... Probably be something with a weird name.

[groucho]

I've cleared up a lot of stuff that HiJackThis generated using thePassenger's link above, but 'My Documents' is still loading on boot-up.

This is what I have left....

Logfile of HijackThis v1.99.1
Scan saved at 09:04:03, on 02/09/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINNTSystem32smss.exe
C:WINNTsystem32winlogon.exe
C:WINNTsystem32services.exe
C:WINNTsystem32lsass.exe
C:WINNTsystem32svchost.exe
C:WINNTsystem32spoolsv.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINNTSystem32svchost.exe
C:WINNTsystem32MSTask.exe
C:WINNTsystem32stisvc.exe
C:WINNTSystem32WBEMWinMgmt.exe
C:WINNTsystem32mspmspsv.exe
C:WINNTsystem32svchost.exe
C:Program FilesAlwil SoftwareAvast4ashWebSv.exe
C:WINNTExplorer.EXE
C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:WINNTsystem32spoolDRIVERSW32X863E_S4I0R2.EXE
C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe
C:Documents and Settingsgroucho.groucho-LW8VPD4My Documentsspyware utilities and wormshijackthis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.tiscali.co.uk/broadband
F2 - REG:system.ini: UserInit=C:WINNTsystem32userinit.exe,userinit.exe
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:Program FilesEPSONEPSON Web-To-PageEPSON Web-To-Page.dll
O4 - HKLM..Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 - HKCU..Run: [EPSON Stylus C86 Series] C:WINNTsystem32spoolDRIVERSW32X863E_S4I0R2.EXE /P23 "EPSON Stylus C86 Series" /M "Stylus C86" /EF "HKCU"
O4 - Global Startup: DSLMON.lnk = C:Program FilesSAGEMSAGEM F@st 800-840dslmon.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:WINNTsystem32Shdocvw.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linki
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/26afc1715
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoft
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://support.epson-europe.com/selft
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:Program FilesAlwil SoftwareAvast4ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:WINNTSystem32dmadmin.exe
O23 - Service: Windows Network Security Management Service (nsms) - Unknown owner - C:WINNTsystem3227.tmp (file missing)
O23 - Service: Windows Genuine Advantage Registration Service (wgareg) - Unknown owner - C:WINNTsystem32wgareg.exe (file missing)

[BliarOut]

Have a look in your startup folder, there's probably a shortcut to something that's in My Doucments.

If you can't find it, download autoruns www.sysinternals.com/Utilities/Autoruns.html and that'll show you everything that's loading at startup and where from.

[groucho]

The last two 23s on there were once flagged as Trojans. The trouble is when I fix them with HiJackThis they are still there on subsequent runs. I can't seem to get rid of them.

[groucho]

The only thing in my Starup list from Start > Programs > Strartup is DSLMon which is my ADSL modem.

[groucho]

BliarOut said:

Have a look in your startup folder, there's probably a shortcut to something that's in My Doucments.

If you can't find it, download autoruns www.sysinternals.com/Utilities/Autoruns.html and that'll show you everything that's loading at startup and where from.

Damn! It's a zip file and my WinZip has expired.

[BliarOut]

Download a fresh eval of winzip I'd e-mail it across but most ISP's filter .exe's out.

Edited to add:

Just right click the file and select Explore if it's XP.

Edited by BliarOut on Saturday 2nd September 10:18

[groucho]

BliarOut said:

Download a fresh eval of winzip I'd e-mail it across but most ISP's filter .exe's out.

Will do! It'll have to wait though, I have breakfast and a gutful of beer to consume.