Jump to content


Photo

Hijacker starting from unknown location


  • This topic is locked This topic is locked
1 reply to this topic

#1 biker

biker

    Member

  • New Member
  • Pip
  • 4 posts

Posted 22 July 2004 - 07:18 PM

I'm running WinXP. When I run the system configuration utillity I found
I have a hijacker starting from SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
It doesn't run from a location that starts with an HK
(eg. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run).
I've gone through the registry manually and ran a search without any luck,
although I did find some locations that had the file (apirf.exe) listed.

Does anyone know where I can find
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Thanks

#2 JG427

JG427

    Forum Deity

  • Retired Staff
  • PipPipPipPipPip
  • 1,020 posts

Posted 22 July 2004 - 09:38 PM

That is not a location in the registry. It must be preceded by HKCU or HKLM.
Run a hijackthis scan. It should show the run key as well as other possible problems.

Download HijackThis

Post a hjt log.
Posted Image
-----------Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button