start up error

Every time I start my computer I get an error window saying "Windows cannot
find
C:\WINDOWS\system32\proper.exe". Is This a real concern or should I ignore
it. The funtionality of the computer does not seem compromised. However, I
am no longer able to do a "system restore". Is this a result of the above
error?
--
normalnorm

normalnorm wrote:
> Every time I start my computer I get an error window saying "Windows cannot
> find
> C:\WINDOWS\system32\proper.exe". Is This a real concern or should I ignore
> it. The funtionality of the computer does not seem compromised. However, I
> am no longer able to do a "system restore". Is this a result of the above
> error?

Proper.exe is not in my ...\system32 directory, so it most likely isn't
a standard Windows XP file. Download and run Autoruns from MS to find
out what is attempting to start this file. Once you know what is trying
to start it, you can decide either to delete that startup entry or
reinstall whatever application is involved.
http://technet.microsoft.com/en-us/s.../bb963902.aspx

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

normalnorm <normalnorm@discussions.microsoft.com> wrote on Sun, 7 Sep
2008:

>Every time I start my computer I get an error window saying "Windows cannot
>find
>C:\WINDOWS\system32\proper.exe". Is This a real concern or should I ignore
>it. The funtionality of the computer does not seem compromised. However, I
>am no longer able to do a "system restore". Is this a result of the above
>error?

Hello normalnorm

The error message itself is harmless, but it's an indication that your
computer has been and still might be infected. Proper.exe is associated
with the Win32/Qhost.ZR trojan, which pops up fake security alerts on
your PC.

Looks like your antivirus or other security programs have deleted
proper.exe, but the command telling Windows to load it on startup is
still in the Registry. Your problem running System Restore could be
because of some of the system changes this malware makes, or an
indication that the machine isn't totally clean yet.

You might want to Google proper.exe for more information or get help
from malware removal experts in a specialist forum. Here's some info
that might help, courtesy of MS MVP PA Bear:
------------------
Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
(in conjuction with some other utilities). HijackThis will NOT fix
anything on its own, but it will help you to both identify and remove
any hijackware/spyware with assistance from an expert. **Post your log
to http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for
review by an expert in such matters, not here.**
------------------

Good luck!

--
Nightowl

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

normalnorm wrote:
> Every time I start my computer I get an error window saying "Windows
> cannot
> find
> C:\WINDOWS\system32\proper.exe". Is This a real concern or should I
> ignore
> it. The funtionality of the computer does not seem compromised. However,
> I
> am no longer able to do a "system restore". Is this a result of the above
> error?