Strange code in win.ini

~~HawK~~ · Nov 19, 2004, 04:36 AM

Someone had trouble with his computer, i checked it out and found a very strange entry in his win.ini

i didn't want to copy paste the code in here so made a screenshot
anybody have any idea what this might be ?

PangingJr · Nov 19, 2004, 08:55 AM

win XP ?

~~HawK~~ · Nov 19, 2004, 10:21 AM

Yes XP SP1 nothing strange in software or registry or anywhere, just this in win.ini
was one mention on a web site but it was in french, but then the code may be different for others

PangingJr · Nov 19, 2004, 11:09 AM

pls detail more info of the problems that you found.
not sure, if it was viruses or worms you should also see entries that starts with Load= or Run=. this seems like one or more of 16-bit Windows programs has written to the file incorrectly.. try booting the PC without WIN.INI and see if Windows still seem ok,
Run msconfig, on the General tab, select the Selective Startup, only uncheck in front of Process WIN.INI, and reboot. then i'd just backup the file or its info and remove all of the strange entries and rebooting again with Normal Startup option.

~~REGENERAT1ON~~ · Nov 19, 2004, 11:20 AM

trojan/worm/irc zombie bot

pr0digal jenius · Nov 19, 2004, 01:11 PM

that's really wierd lookin....and not anythign that i would wanna keep in there. Here's mine:

Code:

; for 16-bit app support
 [fonts]
 [extensions]
 [mci extensions]
 [files]
 [Mail]
 MAPI=1
 CMCDLLNAME32=mapi32.dll
 CMCDLLNAME=mapi.dll
 CMC=1
 MAPIX=1
 MAPIXVER=1.0.0.1
 OLEMessaging=1
 [MCI Extensions.BAK]
 asf=MPEGVideo2
 asx=MPEGVideo2
 m1v=MPEGVideo
 mp2=MPEGVideo
 mp2v=MPEGVideo
 mpa=MPEGVideo
 mpe=MPEGVideo
 mpeg=MPEGVideo
 mpg=MPEGVideo
 mpv2=MPEGVideo
 wm=MPEGVideo2
 wmv=MPEGVideo2
 wmx=MPEGVideo2
 wvx=MPEGVideo2
 wpl=MPEGVideo
 m2x=MPEGVideo
 [WebImageOptimizer]
 LastSavePath=C:\Documents and Settings\PaniK.XEOCUBE\Desktop\
 [hkjhk]
 nnhjhkj15=1091920090
 [hkjhkW]
 nnhjhkj15=1091920162
 [SciCalc]
 layout=0
 [Hex Workshop]
 Path=C:\PROGRA~1\HEXWOR~1.2\hworks32.exe
 CurrentVersion=4.20

~~HawK~~ · Nov 19, 2004, 02:24 PM

Quote:

Originally Posted by Ctrl-Alt-Del

pls detail more info of the problems that you found.
not sure, if it was viruses or worms you should also see entries that starts with Load= or Run=. this seems like one or more of 16-bit Windows programs has written to the file incorrectly.. try booting the PC without WIN.INI and see if Windows still seem ok,
Run msconfig, on the General tab, select the Selective Startup, only uncheck in front of Process WIN.INI, and reboot. then i'd just backup the file or its info and remove all of the strange entries and rebooting again with Normal Startup option.

yah well there isn't anymore info, nothing to find in run= or in start-up, neither any suspective programs
this machine also need to use a msdos env. AFAIK, so maybe it has to do with that. will advise him as you wrote; to run the msconfig