please help me with this unknown ctpmon.exe

[edchar]

Ahhh.. I'm sorry cause I didn't understand well ur first instruction when you told me about the RUN box,but I already performed this process without the RUN box.I'm sorry,I thought I still didn't done the system restore,I thought it would only run if there's the RUN box. What I mean by using the administrators account is it is the original account of this computer, not the extension. I've done all the processes in this account,this original account.

[edchar]

So what shall I do now?

[tetonbob]

Copy and paste the following into Notepad (don't forget to copy and paste REGEDIT4):

REGEDIT4

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRun"=-

Save the file as "delete.reg". Make sure to save it with the quotes. It should look like this:

Close Notepad.

Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

---------------------------------------------------------------------------------------------

Let me know....

[edchar]

It's already done. I already done that process. so what shall I do next?Is my computer already safe and has no problems?

[tetonbob]

It's already done. I already done that process.

Not sure what you mean. I don't see where we did this already?

Did you perform this task? Does your Run Box work now?

[edchar]

I've already done that task. But still there's no RUN box here in my start tab. I really don't know why it disappeared.

[tetonbob]

I have attached a file to this post - look.zip Download this file to your desktop. Double click on the zip folder, then double click on the batch file within. A window will open and close, and notepad will open with some text in it. Please post the contents of the notepad file.

[edchar]

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer
NoDriveTypeAutoRun REG_DWORD 0x91
NoRun REG_DWORD 0x1
ClassicShell REG_DWORD 0x0

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run



This is the result of the look.zip

[tetonbob]

I have attached a file to this post - edcharfix2.zip Download this file to your desktop. Double click on the zip folder, then double click on the reg file within. Click yes to allow it to merge into your registry.

Then run the look.bat file within the look.zip folder once again, and post those results.

[edchar]

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer
NoDriveTypeAutoRun REG_DWORD 0x91
NoRun REG_DWORD 0x1
ClassicShell REG_DWORD 0x0

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer
NoDriveTypeAutoRun REG_DWORD 0x91
ClassicShell REG_DWORD 0x0

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run



The result of look.bat.

[tetonbob]

Do you have a run box now?

[edchar]

Yes. The run box already appeared. Is my computer back to normal? does it still have viruses here in my computer?

[tetonbob]

Yep, that appears to be it.

Well done. Your logs are clean. Any more issues? If not you should be good to go. We still have a few items to address.

AVG Anti-Spyware would be a good program to keep, update and run a scan with once a week or so. It adds another layer of protection to your system's security tools. You may want to prevent AVG Anti-Spyware from running at Windows startup, and just call it into service when needed. This may help with system boot times. To do so, right click on the AVG A/S system tray icon, and uncheck Start with Windows. Also disable it's real time protection, as this will also use system resources, and will time out at the end of the trial period in 30 days. To do so:

Open AVG Anti-Spyware.

• On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.

Reset hidden/system files and folders

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

Create a new System Restore point

• click Start >> Run - type SYSDM.CPL & press Enter
• select the System Restore Tab
• tick on the checkbox - "Turn off System Restore on all drives"
• click Apply
• then untick the same checkbox & click OK

Enable Windows Auto Update

• Go to Start>Run - type wuaucpl.cpl
• tick on the checkbox - "Automatically download the updates, and install them on the schedule that I specify".
• Click on "OK".

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• SpywareGuard to catch and block spyware before it can execute.
  
• SPYBOT - SEARCH & DESTROY
  Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
  
• AD-AWARE
  Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
  
  
• IE-SPYAD - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Download IE-SpyAD - Extract the contents to a new folder
    From within the folder, double-click install.bat
    Select Option #2 - Install the new IE-SPYAD list.
    Then return to the main menu.
    Select option #4 - Add the old porn sites domain
  
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
    
  • Click Next, click Next, select the option:
    "Show Extracted files", click Finish
    
  • This will open the newly created hosts folder on your Desktop.
    
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  
  
• FIREWALL
  If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:
  
  Do not install more than one firewall program because they will conflict with each other.

• Comodo Personal Firewall
• ZoneAlarm

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• HOW DID I GET INFECTED IN THE FIRST PLACE?
• THE ANTI-SPYWARE TUTORIAL
• MAKING INTERNET EXPLORER SAFER

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[edchar]

Thank you very much. You've turned my computer back to safe. I thought the best way to remove all of those problems is to reformat this computer. But thanks to this website,its all OK. Thank you very much you've helped me a lot. Thank You.