Guest normalnorm Posted September 7, 2008 Posted September 7, 2008 Every time I start my computer I get an error window saying "Windows cannot find C:\WINDOWS\system32\proper.exe". Is This a real concern or should I ignore it. The funtionality of the computer does not seem compromised. However, I am no longer able to do a "system restore". Is this a result of the above error? -- normalnorm
Guest Lem Posted September 7, 2008 Posted September 7, 2008 Re: start up error normalnorm wrote: > Every time I start my computer I get an error window saying "Windows cannot > find > C:\WINDOWS\system32\proper.exe". Is This a real concern or should I ignore > it. The funtionality of the computer does not seem compromised. However, I > am no longer able to do a "system restore". Is this a result of the above > error? Proper.exe is not in my ...\system32 directory, so it most likely isn't a standard Windows XP file. Download and run Autoruns from MS to find out what is attempting to start this file. Once you know what is trying to start it, you can decide either to delete that startup entry or reinstall whatever application is involved. http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx -- Lem -- MS-MVP To the moon and back with 2K words of RAM and 36K words of ROM. http://en.wikipedia.org/wiki/Apollo_Guidance_Computer http://history.nasa.gov/afj/compessay.htm
Guest Nightowl Posted September 7, 2008 Posted September 7, 2008 Re: start up error normalnorm <normalnorm@discussions.microsoft.com> wrote on Sun, 7 Sep 2008: >Every time I start my computer I get an error window saying "Windows cannot >find >C:\WINDOWS\system32\proper.exe". Is This a real concern or should I ignore >it. The funtionality of the computer does not seem compromised. However, I >am no longer able to do a "system restore". Is this a result of the above >error? Hello normalnorm The error message itself is harmless, but it's an indication that your computer has been and still might be infected. Proper.exe is associated with the Win32/Qhost.ZR trojan, which pops up fake security alerts on your PC. Looks like your antivirus or other security programs have deleted proper.exe, but the command telling Windows to load it on startup is still in the Registry. Your problem running System Restore could be because of some of the system changes this malware makes, or an indication that the machine isn't totally clean yet. You might want to Google proper.exe for more information or get help from malware removal experts in a specialist forum. Here's some info that might help, courtesy of MS MVP PA Bear: ------------------ Checking for/Help with Hijackware http://aumha.org/a/parasite.htm http://aumha.org/a/quickfix.htm http://aumha.net/viewtopic.php?t=5878 http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction http://mvps.org/winhelp2002/unwanted.htm http://inetexplorer.mvps.org/data/prevention.htm http://inetexplorer.mvps.org/tshoot.html http://www.mvps.org/sramesh2k/Malware_Defence.htm http://defendingyourmachine2.blogspot.com/ http://www.elephantboycomputers.com/page2.html#Removing_Malware When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in conjuction with some other utilities). HijackThis will NOT fix anything on its own, but it will help you to both identify and remove any hijackware/spyware with assistance from an expert. **Post your log to http://aumha.net/viewforum.php?f=30, http://forums.spybot.info/forumdisplay.php?f=22, http://castlecops.com/forum67.html, or other appropriate forums for review by an expert in such matters, not here.** ------------------ Good luck! -- Nightowl
Guest PA Bear [MS MVP] Posted September 7, 2008 Posted September 7, 2008 Re: start up error Unexplained computer behavior may be caused by deceptive software http://support.microsoft.com/kb/827315 Run a /thorough/ check for hijackware, including posting your hijackthis log to an appropriate forum. Checking for/Help with Hijackware http://aumha.org/a/parasite.htm http://aumha.org/a/quickfix.htm http://aumha.net/viewtopic.php?t=5878 http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction http://mvps.org/winhelp2002/unwanted.htm http://inetexplorer.mvps.org/data/prevention.htm http://inetexplorer.mvps.org/tshoot.html http://www.mvps.org/sramesh2k/Malware_Defence.htm http://defendingyourmachine2.blogspot.com/ http://www.elephantboycomputers.com/page2.html#Removing_Malware When all else fails, HijackThis v2.0.2 (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in conjuction with some other utilities). HijackThis will NOT fix anything on its own, but it will help you to both identify and remove any hijackware/spyware with assistance from an expert. **Post your log to http://aumha.net/viewforum.php?f=30, http://forums.spybot.info/forumdisplay.php?f=22, http://castlecops.com/forum67.html, or other appropriate forums for review by an expert in such matters, not here.** If the procedures look too complex - and there is no shame in admitting this isn't your cup of tea - take the machine to a local, reputable and independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop. -- ~Robear Dyer (PA Bear) MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002 AumHa VSOP & Admin http://aumha.net DTS-L http://dts-l.net/ normalnorm wrote: > Every time I start my computer I get an error window saying "Windows > cannot > find > C:\WINDOWS\system32\proper.exe". Is This a real concern or should I > ignore > it. The funtionality of the computer does not seem compromised. However, > I > am no longer able to do a "system restore". Is this a result of the above > error?
Recommended Posts