Is this a virus, spyware, or normal?

[sup3rcarrx8]

Hey guys. My friend's computer pops up with an "About Windows" screen everytime he boots up and i scanned both for viruses using AVG and spyware with spybot s&d. Nothing came up. So is this window normal or a virus? If it's normal, how can I disable this screen for him? He's running Win XP with SP2. Thanks.


http://img.photobucket.com/albums/v56/sup3rcarrx7/about.jpg

[DavidJa]

odd i'v never seen that screen before, did you look through startup entries for anything irregular?

[sup3rcarrx8]

I checked the services and msconfig and everything looked normal to me.

[sup3rcarrx8]

I forgot to mention that he did not encounter any performance problems once this window started popping up. So i'm pretty confused. =?

[thideras]

Did you check the registry keys?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\RunOnce

[sup3rcarrx8]

Did you check the registry keys?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\RunOnce


Thanks! I went through the RunOnce folder and found something that looked sketchy and deleted it. Now the virus is gone. Its name was "mruinfo57.exe" or something. :clap:

[thideras]

Make sure to try and locate the file so you can get more info on it ;)

[RJARRRPCGP]

It looks like a virus may have changed the registered name and organization settings. Did it?