Every time one of the users logs in a message pops up that says "Windows cannot find C:\WINDOWS\Downloaded. I have no idea what is calling the file. Can anyone help me to get ride of this popup. Thanks for any help.
Had a look around and it sounds like it may be due too adware/spyware trying to load up. Download something like spysweeper (make sure to update the definitions) and run to see if it makes any difference. http://www.webroot.com/downloads/
I ran my adware/spyware program. it found a bunch of spyware but when I removed it the popup is still coming up.
Is there any type of file that doesn't do anything. I figure I could just call it downloaded and the popup will go away.
What site doesn’t, but if it’s a big worry Otherone here's a link on how to block unwanted cookies. http://www.mvps.org/winhelp2002/cookies.htm
Try finding the culprit using start/run "msconfig". select "selective startup" and untick anything you don't need - also clean out your start/programs/startup folder. If you don't know what a particular item is use the search function to locate the install folder or google it This will also help speedup your system. I use: Zonealarm 4.5 Adaware AVG HijackThis Firefox 0.93 with imagetool and spiderzilla extensions ALL FREE.
Hi nownthen, I assume the pop up is still there. I am unclear on a few things: 1 what users on what system? When windows starts or users on something else? 2 there is a "downloaded Installations" and a "downloaded program files" directory in windows. Seems the program or what ever has a mistake, which might be good for you, you may never have known it was there. I agree with Adavis's idea. I wonder what would happen if you created a directory called Downloaded, would the pop up still be there and would there be anything appearing in the directory? give it what it wants and maybe it will go away Try the system configuration utility/startup tab and see if anything suspicious is loading. And guys, I'm not so worried about cookies n popups, but there's websites out there that infect a computer just going there so i dont usually even click on links without all defenses on. So, cookies n pop ups make me nervous. So when a popup breaks thru, I feel there's a weakness in my defenses. I use: Netscape 7 PeerGaurdian Avaste anti-virus Win XP SP2 firewall Sygate firewall spybot S&D Spyblaster Y! anti popup & antispy MSN anti popup DSL router P2P Identity Secure Port monitors Java and AxtiveX disabled, And with all this, I still got a trojan from a fake site run by the RIAA that used Java and a fake free mp3 shield program that taged all my mp3's with XML extensions, to install a MP3 file search & tag trojan. I suppose they will be coming for me next. Found and deleted it with good ol Avaste and a boot time scan!
When you put a folder in its place it opens when you log into windows. I'm using Windows XP Home. Windows loads to a Welcome Screen. The users are listed there. There are three users my family including my brother, sister and myself.
I would be doing a serious boot time full scan using Avast anti virus. This is not a normal windows routine and sure looks like some weird trojan virus. where is that ramboo file located?
Location HKCU\SOFTWARE\Microsoft\Windows\CurrentVer... Then it cut off So is this something that I can take off my startup list?
My startup list shows ctfmon in the same HKCU registry key I used regedit to search the registry and found simalar refernces, and the seemed to have something to do with msmsgs.exe, or it could be windows messenger. That is either the message maker for system popups or.... If you disable it, and restart, you can see if anything changes. If you cant start, hit F8 at bootup and start in safe mode and re enable it. I donno, I did not find any exact match such as "HKCU\SOFTWARE\Microsoft\Windows\CurrentVer..", but if you go into the registry using regedit, you can see ecactly what is loading there too under current user or local machine. That ramboo thing sounds kinda scarey. You might also try a trojan finder program and use it. But if no virus turns up on a boot time scan, then maybe it is nothing to be really worried about, but I know I would not sleep until the mystery is solved.. You could always try a system restore as a last resort to a time just before the pop up happened, but some trojans insert themselves in system restore files so that you can't even do that to get rid of it. I hope somebody else had a better clue than I do. What I would do? I'd go into the registry, back it up first, edit/find then "find" that ramboo thing and delete that key. I searched mine for "I RAMBOO~1" and found nothing (if i typed it right) Write down exactly where it is and what the key value is before you delete so you know how to restore it. Might even do a system restore point first too. Just be careful and dont do anything ya cant undo.
Nowthen try this site: www.grc.com and use the "three muskateers" shootthemessenger.exe will disable messenger and you won't have to install any annoying windowz sp packs - I NEVER have and my system is a jam packed p4 with only 512mb of ram and 3 pci cards/dvd/cd writer and a whole lotta cable -still very fast. xpidite.exe upnp.exe shootthemessenger.exe dcommob.exe as far as i can tell from zonealarm 4.5 the only program that i've allowed internet access(server rights) to is svchost.exe - apparently you have to, not sure exactly what it does but none of my browsers will work without it - all other programs I configured independently as the required access...this will help prevent future "infection" if you do get this sorted out. I know this doesn't really solve your problem but when u do get it sorted these any my above mentioned post will help prevent it happening again.
