Start up

1731 Views 17 Replies 6 Participants Last post by Anne Troy, Sep 14, 2003

T.Power

Discussion Starter · Sep 6, 2003

A file has appeared in the systems files ,it is called IJUTWON and has the small blue and white box in front of it and it is in capital letters.
I went to msconfig and it was there in start up and the box was checked, I unchecked the box and rebooted and it went,however,every time I start up it is back and the box is checked , I went to System files and tried to delete it from there but it refused and said the file was in use.
Since this file appeared,every time I boot up, the connection box to the internet appears automatically , the Google page does not appear, and I have to close the box down and click the icon for entering the internet for Google to appear
I am familiar with all the items in start up and I know that this file was never there until recently.
A member fo the family had downloaded an item from the internet and the problem began almos immediately.
I will be grateful for any advice.
Tom

Status: Not open for further replies.

1 - 18 of 18 Posts

Miz

· #2 · Sep 6, 2003

Have you scanned for spyware? If not, download, install, immediately update and then run Spybot and/or AdAware (you can use them both.) Let whichever one you choose clean up any spyware it finds.

More and more software, especially that with spyware packed inside, are being written to override/ignore the settings in msconfig and start up anyway.

T.Power

Discussion Starter · #3 · Sep 7, 2003

I do have spybot and Norton systems and I did run both to see if it was a virus,but neither found anything.
Tom.
[email protected]

JenniferLore

· #4 · Sep 8, 2003

End the process for IJUTWON;
Then you can delete it.

T.Power

Discussion Starter · #5 · Sep 8, 2003

Thanks Jennifer,
When you say end the process for IJUTWON,do you mean open it?
I opened it in Word but it was just a jumble of letters and symbols.
I have tried to delete it from System but it says "access denied".
As you may have surmised, I am not yet familliar with all computer terms so I am not sure what "process "means.
Tom

JenniferLore

· #6 · Sep 8, 2003

To end the process. Press Ctrl-Alt-Del on the keyboard.
Select task manager.
Select the processes tab
check if IJUTWON is there
if it is then click on it and then click [end process] toward the lower right of the dialogue box.

This is how you end it. If it states Access Denied when you try this then we'll have to delete it from another location. But first thing's first.

If you can end it then now you should be able to delete it.

Let me know.

T.Power

Discussion Starter · #7 · Sep 9, 2003

Jennifer,
When I clicked Cntrl/Alt/Delete a box appeared saying "close programme" at the top left, and.. End Task-Shut down-Cancel at the bottom ,but I could not see 'Task manager',there was a list of things there which coincided with the ones in start up,but not all of them,thank you again for your help.
Tom

Anne Troy

· #8 · Sep 9, 2003

What version of Windows, Tom?

T.Power

Discussion Starter · #9 · Sep 9, 2003

Win 98SE,
Tom

Anne Troy

· #10 · Sep 9, 2003

In Win98, hitting ctrl+alt+del brings up the "task manager". I forget if that's its exact name tho...

You should see a window with a list of items in it. If you don't, hit the X to exit, start up any program, and ctrl+Alt+del again so you can now see that program in there.

We're trying to find out exactly what's running and, specifically, if IJUTWON is in that list.

Personally, I might try running msconfig and unchecking everything on the startup tab and rebooting. See if you can delete that file then.

T.Power

Discussion Starter · #11 · Sep 10, 2003

Jennifer,
I did as you suggested and IJUTWON was not on the list,I went to msconfig/startup and unchecked everything,rebooted and when I looked in msconfig/start up,IJUTWON had reappeared and the box was checked,also, there was another box which reappeared-NCS_ss and it was also checked.
I tried again to delete IJUTWON from System but got the usual "access denied" message.
Can you tell me what the following items in start up mean....Cs inject/systray/ and if I should recheck those boxes and what items should there be in start up as a nescessity?
Thanks again for your help
Tom

THoey

· #12 · Sep 10, 2003

I know Jennifer and Dreamie are trying to help, but if you start a thread (or move this one) to the Security forum on the main page you would probably get faster help. There are a bunch of Guru's there that do nothing but fix things like this. Especially that TonyKlein guy...

JenniferLore

· #13 · Sep 11, 2003

go to START-> RUN
type regedit
press enter
go to these keys

*HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
*HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run once
*HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run once ex
*HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
*HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run once
*HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run once ex

each of these keys have values on the right pane. Look at every value in each key. If there is one with IJUTWON delete it and reboot your computer. NOTE: some of these keys may not exist on your system.

If this doesn't work for you you'll have to create a windows 98 boot disk and delete IJUTWON from DOS. You won't get an access denied messase there because the file won't be in use.
Try this suggestion first: if it doesn't work for you I'll tell how to delete the file from DOS.

See less See more

T.Power

Discussion Starter · #14 · Sep 12, 2003

Jennifer,
I did as you suggested but could not find IJUTWON anywhere on the registery,
Thanks again
Tom

roban

· #15 · Sep 12, 2003

Tom,
Run msconfig and see if it is loading from sys.ini or win.ini also search your registry for the file. You might also run a scanner such as aatools which will pick it up as a background program. This sounds like a Trojan to me so you might also run a trojan scanner or try one of the free scanners on the web. It is in your Windows or Windows/System folder somewhere.

JenniferLore

· #16 · Sep 13, 2003

OK - let's go through DOS
Go to control panel->add/remove programs
One of the tabs is to create a boot disk - select this tab and create one. Before you boot to DOS you have to know the folder where IJUTwon is. Do a search for it and write down where it is.
Let's use an example since I don't know where it is in your system. Another option is to go to msconfig and it will tell you the folder where it is. Since I don't know I'll use an example and you just adjust the folder name.

the example folder is c:windows\system32

Boot off that floppy disk and select start without cd rom support.
when you get to
a:>
type c:
type cd windows/system32
type del UJUTWON.exe
That's it - remove the disk and you are done.

I can give you exactly the command if you tell me what folder IJUTWON is in.

See less See more

T.Power

Discussion Starter · #17 · Sep 14, 2003

To all who offered help,
I did not have a lot on my PC,MS office and a few minor programmes,a friend suggested formatting the H/D, and he did so ,and re-installed everything,this has solved the problem so many thanks for all the help offered,I do really appreciate it.
TOM

Anne Troy

· #18 · Sep 14, 2003

Hee hee. Run msconfig, T.Power. What's in the startup now? Windows and the apps often put things I don't want in there!

1 - 18 of 18 Posts

Status: Not open for further replies.