scotiabahn

Hi! I know this subject has been dormant for a while, but I thought I'd share a bit of my own anecdotal evidence on the subject. I bought two Toshiba laptops about 18 months back to replace a couple of aged noisy XP boxes. One my son used for schoolwork and some lightweight browser gaming (we have separate Games machine plus the odd console...) and the other one sat alongside my work laptop and shares the mess of my study area along with monitor, keyboard and mouse via a KVM switch... About 6 months back, the laptop on my desk started getting really noisy when it tried to do anything vaguely CPU intensive, like an AV scan, and then moved on to shutting down. From the scorching heat on the base of the laptop, even I could work out there was a heat problem. Initially I just tried to reduce the CPU performance of the AV scan but it kept on happening, so I moved on to a laptop cooler base - a raised base with 3 usb fans to move the air around, but even that hasn't been enough in the warmest parts of the summer... Then a few days back I started rummaging around for an answer (again), having decided that I would have one last try before giving up on the machine (new laptop versus repair costs including new power supply pretty much even out...) I saw an article or two about dust clogging up the laptop cooling fans and vents that I hadn't seen previously. I suspect you can see where this is going... Yesterday afternoon I disconnected all the cables and took the laptop off it's stand and took a look at it - very dusty underneath. One of the threads I found recommended using a compressed air canister to blow through the air vents but I wasn't organised enough for that - no can - so I just tried blowing through the intake vents on the side and - tada! - I have dust bunnies coming out of the fan port! After several iterations of blowing, picking lumps out with tweezers and using a mini vacuum cleaner on it, the dust clouds dissapated... I then did a good clean around the whole area (it had to happen sometime..) Strangely enough the laptop is running much quieter now, not even getting excited about the latest AV scan... Methinks a better housekeeping situation around my study area might help... I offer my experience as a potential solution to others who may have a laptop that has similar issues that could also have an attack of dust bunnies...

We've upgraded to the next release (2.07.575) but we're still having the same problem - we're having to run IE as Administrator to print anything from IE... Is that the right 'next' release or is there another one coming? Thanks.

umm... I'm pretty sure I haven't moved the Temp folder...

We're setup as C:\Users\office\AppData\Local\Temp\Low as we've never moved/deleted the folder - with UAC, it wouldn't let me For some reason, I now seem to have a subordinate folder called the same... i.e. C:\Users\office\AppData\Local\Temp\Low\Low which is kind of odd... still doesn't print, though

I'll provide what detail I can, but our situation is such that we've really only discovered the problem after the event that caused it. We have a couple of new Toshiba Equium laptops with Vista Premium installed and as part of the migration from our old XP pcs, I naturally installed CCleaner. I have one of the machines, my son the other for study. Since we deployed the laptops he has been printing out all sorts of stuff from all sorts of places, including IE7, until this last weekend when I went to use his machine (my wife had snaffled mine...) While I was using my son's machine I thought I'd better do a quick cleanup and clear out the cache etc as it hadn't been done since first use about a month or so back. Since then, IE7 printing hasn't worked. As I print less than my son, it's only subsequently that I've discovered mine is the same, but I run CCleaner a couple of times a week... The only thing I'm not sure about here is that I'd have thought I must have run CCleaner when first installed just to prove it works, with our usual settings, but I can't be sure that I did. If that was true, it suggests that you have to print before running CCleaner before the problem occurs, maybe? I would have got CCleaner and basic print (test page across the network) ready for my son to start using for schoolwork, then he had several weeks without a problem until I reran CCleaner... Don't know if that gives any clues... For now, my son managed to print without a problem using the 'run as administrator' option for IE to get his homework off the laptop last night, but I'm not keen on setting that as a security default as there are reasons for using that level of protection. That said, if I'd realised how much of a pain UAC was going to be doing the migration from XP, I'd have switched the damn thing off As for CCleaner, its at 2.06.567 level. As for settings on the Cleaner page, I have everything ticked under IE and System, everything ticked except 'Recent' under Explorer, and I've also got 'old prefetch' ticked under Advance. The only other option that I think I've set is that is does a 'Secure Delete' using an NSA 7-pass algorithm. Can't think what else to tell you, but happy to answer any further questions...

Well, I've only just got Vista and I've just got this bug... CCleaner doesn't remove the Low folder for me, so I suppose I ought to try that... Just running icacls didn't sort it... unlike a previous responder, I did mange to get a print when I ran IE as administrator my one helpful hint re the last comment above "so CCleaner doesn't remove the folder". Can't you exclude it from the Options section in CCleaner? I've just added the Low folder to the exclusions to see whether that would make it leave the folder alone... Still doesn't work though, but if I can get it working it might stop a future occurrence... maybe... Has anyone got any other thoughts on this mess... Thanks

If it helps, I noticed a significant increase in time between 2.02.x and 2.03.x versions. The analysis has lengthened by about a factor of 4 or 5, and the clean up (using secure delete) around twice that. Not sure about going backwards in levels, still hoping for a 2.04 that sorts it...

Andy, I've made a start on this but not produced any logs yet to put on the other forum section. I just wanted to report back on this bit. The reg delete worked and I moved the file to my desktop and rebooted, hey presto, no desktop as before. I used Taskmgr 'Run' to get command working and to shift the txt file back to system32 and I got my desktop back after another reboot. The interesting thing is that the registry is still clean, the debugger value hasn't been reinstated... Not sure what that means, will go play with the rest of the utilities (which will probably mean moving the stupid file again because it doesn't like HijackThis at least...) Hopefully, next entry will be in HijackThis section... Thanks Steve

okey-dokey, will do, when I get a chance later today hopefully...

that makes sense... now that's an impressive title - 'appointed malware expert'... coo, wish I had that on my c.v. actually, no I don't, this stuff makes my head hurt

over my head - could be... this definitely isn't an area where I have a great deal of expertise, but I'll have a crack at this after I've had a go at Andy's suggestions... should keep me out of mischief for a while

Thanks for the suggestion, but is there anything special about renaming hijackthis to family.exe? Way back in the discussion, you will see, there were a few attempts with renamed files that still got bounced - I can only assume that this malware can see some internal naming or descriptor. Thanks again.

Andy, many thanks for all that and I'll work my way through this asap, although I'm afraid work will get in the way for most of the day... My one query at this point is whether this should go on the HijackThis forum rather than CCleaner, I'm not sure I see the advantage in that, the history is here. I admit my description 'CCleaner failing' isn't very descriptive, but that's all I knew at the time. This malware is certainly targeting specific applications, particularly CCleaner, as well as HijackThis and Comboscan at least, but ignoring others (don't like to write their names in case 'they' improve their malware... not that I'm getting paranoid or anything...) Thanks again, I'll get started on this later today...

yes , I agree with you, verclsid almost certainly isn't the problem. I had it completely removed yesterday evening and I still had the problem. Like yourself, I can't find any reference to wbjrwesa.txt anywhere. I suppose the wretched thing could have been generated on my machine by something else... another of those great unknowns at the moment... Thanks for the help.

I did try that, but explorer won't run, presumably because of the registry key that includes the wbjrwesa.txt reference I am unable to read the wbjrwesa.txt (access denied!) - I wish I could, I'd love to know what sneaky little code is in there... Thanks for the suggestions.