VideoHelp Forum
+ Reply to Thread
Results 1 to 15 of 15
Thread
  1. I'm a Super Moderator johns0's Avatar
    Join Date: Jun 2002
    Location: canada
    Search Comp PM
    Anybody else get res://C:\WINDOWS\system32\nusrmgr.cpl/nusrmgr.hta script error showing up on winxp sp2 when trying to open the user accounts in control panel?
    I think,therefore i am a hamster.
    Quote Quote  
  2. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    ANYTHING with res:// at the beginning is SPYWARE.
    Download a program called Hijackthis and you'll see exactly where it is on your computer.
    Quote Quote  
  3. Member Faustus's Avatar
    Join Date: Apr 2002
    Location: Dallas, TX
    Search Comp PM
    Originally Posted by hech54
    ANYTHING with res:// at the beginning is SPYWARE.
    Download a program called Hijackthis and you'll see exactly where it is on your computer.
    yup yup, welcome to spyware city population YOU.

    http://www.crystalmidnight.com/modules/xoopsfaq/index.php?cat_id=2#q10
    Quote Quote  
  4. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    Hell...I was even somewhat afraid to click this thread. I've dealt with that RES crap before. Don't rely on Adaware(?) or Spybot alone either.
    These guys are back up and running as well.
    http://www.spywareinfo.com/
    Post your log from Hijackthis in the appropriate spot on the message board...explain that you have tried Spybot and Adaware(?)...in other words follow the instructions on the website carefully...and someone will be along to help you remove it....if you don't know how already.
    Quote Quote  
  5. I'm a Super Moderator johns0's Avatar
    Join Date: Jun 2002
    Location: canada
    Search Comp PM
    Ive scrubbed my puter to find that line but no success.

    Logfile of HijackThis v1.96.0
    Scan saved at 8:12:11 AM, on 28/09/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Hijackthis log file

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\hijackthis\HijackThis.exe

    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    I think,therefore i am a hamster.
    Quote Quote  
  6. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    Is that the entire log?
    Quote Quote  
  7. I'm a Super Moderator johns0's Avatar
    Join Date: Jun 2002
    Location: canada
    Search Comp PM
    Yup,entire file,i keep my system running with least amount of crap,just cant find that line.
    I think,therefore i am a hamster.
    Quote Quote  
  8. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    Try CWShredder yet?
    I'm sorry...forgot about that program.
    http://www.spywareinfo.com/~merijn/downloads.html
    Quote Quote  
  9. I'm a Super Moderator johns0's Avatar
    Join Date: Jun 2002
    Location: canada
    Search Comp PM
    I tried CWShredder but no help,i do this type of repair for customers but this one is my own system and it is well hidden.I can get into my user accounts if i click again and this problem is intermittent in that it doesnt happen all the time.
    I think,therefore i am a hamster.
    Quote Quote  
  10. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    I'm pretty computer stupid...it took me a while to get rid of that RES crap....but mine was also visable on my Hijackthis log. I say also because it WAS hidden in another entry of the log where RES did not show up in writing.
    Try a Google search on those .exe's and see what comes up.
    Quote Quote  
  11. I'm a Super Moderator johns0's Avatar
    Join Date: Jun 2002
    Location: canada
    Search Comp PM
    This is the closest i got to an answer:

    quote:
    I'm an OEM builder and have noticed this only occurs with XP's Servicepack2 installed, I've seen the problem vanish when uninstalling SP2 (obviously not an acceptable solution) so IMHO I believe its somehow tied to changes SP2 makes to the operating system. I'm able to reproduce the error by quickly double clicking on the picture in the start menu aswell. as yet my MS rep hasnt heard anything from his techs about a possible solution because the script error does not produce the standard error report they're used to working with. Just my 2 cents.

    If i turn on script debugging i get this error:
    A runtime error has occurred,do you wish to debug?
    Line 3
    Error:access is denied.
    I think,therefore i am a hamster.
    Quote Quote  
  12. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    Like I said...I'm no expert but....that RES crap had my computer tied up for DAYS. It's main objective on my system was to hijack my IE Start Page. If it is not doing that on your machine....the "infection" may just be sitting there somewhere useless because SP2 has plugged the holes...so to speak?
    I have the SP2 CD here....but have not installed it yet....too chicken..
    Quote Quote  
  13. Member hech54's Avatar
    Join Date: Jul 2001
    Location: Yank in Europe
    Search Comp PM
    Here's a site that wasn't around when my computer was acting up:
    http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htm
    Quote Quote  
  14. I'm a Super Moderator johns0's Avatar
    Join Date: Jun 2002
    Location: canada
    Search Comp PM
    Well i deleted my winxp sp2 partition and reinstalled winxsp2 and sure enough i got the same error opening users account and didnt even go on the net so installed winxpsp1 and no error so it never was a virus or trojan or pest program,proly athlon64 incompatibilty with sp2.

    Res isnt a virus command alone,its just a script pointer to the path.
    I think,therefore i am a hamster.
    Quote Quote  
  15. Member
    Join Date: Jul 2002
    Location: Up in yo' bitch.
    Search Comp PM
    "Like I said...I'm no expert but....that RES crap had my computer tied up for DAYS. It's main objective on my system was to hijack my IE Start Page. If it is not doing that on your machine....the "infection" may just be sitting there somewhere useless because SP2 has plugged the holes...so to speak?"

    I had the same problem (sort of). I ran adaware and found I had several infections, which I promptly deleted. After this, everytime I would restart I would get these same things back. I tried removing them from startup in MSCONFIG but to no avail. After puzzling over where these files could be starting from, I checked the Prefetch folder and BOOYAA!!!! all of the .exe files for these little pieces of spyware/adware were in there. After deleting them from prefetch, I never had a problem again.
    Quote Quote  



Similar Threads