I found a French post with this in their win.ini...
[lkliohkjhkW2]
; msconfig nnhgh87hjhkj15=1171482422
[lkliorkjhkW2]
; msconfig nnhgh87hjhkj15=1171482495
This was after they had contacted a trojan or virus that they cannot get rid
of. My guess would be that the trojan\virus added those lines and added
something in the registry to start something bad.
Neither the System.ini or Win.ini files are required by Windows XP and
these files are maintained only for compatibility with older software that
does not use the registry to save settings. The System.ini file is used to
start and store information for drivers and services; the Win.ini file plays
a similar role for applications. Malware can also use the win.ini and
system.ini for hiding startup locations.
In Windows NT/XP:
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"run"=""
"load"=""
Can be used from the win.ini or system.ini if either has load or run.
From my win.ini.....
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[MCI Extensions.BAK]
aif=MPEGVideo
aifc=MPEGVideo
aiff=MPEGVideo
asf=MPEGVideo
asx=MPEGVideo
au=MPEGVideo
m1v=MPEGVideo
m3u=MPEGVideo
mp2=MPEGVideo
mp2v=MPEGVideo
mp3=MPEGVideo
mpa=MPEGVideo
mpe=MPEGVideo
mpeg=MPEGVideo
mpg=MPEGVideo
mpv2=MPEGVideo
snd=MPEGVideo
wax=MPEGVideo
wm=MPEGVideo
wma=MPEGVideo
wmv=MPEGVideo
wmx=MPEGVideo
wpl=MPEGVideo
wvx=MPEGVideo
[SciCalc]
layout=0
UseSep=0
[MSUCE]
Advanced=1
CodePage=Unicode
Font=Tahoma
From my system.ini.....
; for 16-bit app support
[drivers]
wave=mmdrv.dll
timer=timer.drv
[mci]
[driver32]
[386enh]
woafont=dosapp.FON
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON
See if you have a folder called C:\WINDOWS\pss
C:\WINDOWS\pss should have win.ini.backup and system.ini.backup. They would
have been created when you installed XP.
Open win.ini.backup with Notepad copy the contents and paste into win.ini.
Unless you get rid of whatever changed your win.ini, it will get changed
again.
You can copy both win.ini.backup and system.ini.backup and paste them to
your Desktop.
Change the names to: win.ini and system.ini
Drag both of them into C:\WINDOWS and answer YES to the Do you want to
replace prompt.
UPDATE your antivirus software and run a full system scan.
UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.
You might want to start in Safe Mode to run your antivirus and anti-spyware
software.
Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode can prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.
''In safe mode, you have access to only basic files and drivers
(mouse, monitor, keyboard, mass storage, base video, default system
services), just the minimum device drivers required to start Windows.''
Because of that some malware does not load in Safe Mode and is easier to get
rid of.
How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/forums/index.php?showtutorial=61#winxo
--
Hope this helps. Let us know.
Wes
MS-MVP Windows Shell/User
In
Ray said:
In my win.ini folder I have the following:
[lkliorkjhkW2]
nnhgh87hjhkj15=1170601868 (this appears twice)
[annie]
then a number of lines relating to video
They all have ticks nexts to them.
Should they be there in the win.ini folder?
Thanks
