is computer infected ?

each time i turn on the computer, the system32/partizan.rri comes up and it takes 2 minutes to run until it reaches to the main screen. and it always run up to 50 processes, the cpu is high. there is something wrong but i dont know wat is it that cause my computer to be like this. is it a virus ? please helpp meee

 

Hello,

do u not know where this partizan.rri originates from?

I googled it and the results came up as having something to do with the app, UnHackMe....



snowbound

 

Correct Snowbound

The file along with 2 others are dropped into system32 folder when you install unhackme.They are also left behind after uninstalling unhackme

So merrygoround do you by any chance have unhackme installed with their test rootkit attached ?

 

no i didnt install unhackme. so strange : (

 

How about RegRun?

 

yea, i got it fixed, but the computer still takes at most 2 minutes to load to the windows. is there a way to stop most of the processes from running each time i turn on my computer? or is it caused by a virus or some sort

 

You can access the startup list of programs by clicking on the Start button, then click on Run and a box will open. Type MSCONFIG in the box, then click OK. Then another window which has a title of System Configuration Utility will show up. Click on the Services and Startup tabs to display what progams are loaded at the bootup process. Uncheck those programs that you don't want to load when you boot up. Be aware that you might be stopping a needed program when you do this, but if you are pretty sure that a particular program is not needed, then unchecking it will decrease the memory usage load on the PC. I also use two programs called AutoRuns and Process Explorer to monitor what is running on my PC.
http://www.microsoft.com/technet/sysinternals/Processesandthreadsutilities.mspx

 

By the way, what I mentioned previously may not work if you have a trojan that has infected certain system folders and would not show up in the System Configuration Utility display. In this case, I would recommend that you run a utility called Hijackthis (Merijn.org) and then post the log report in a help forum (NOT this one) such as spwareinfo.com or castlecops.com. Hijackthis might indicate a hidden trojan on your system, but it is not foolproof. But I would do what I previously posted first.

 

ill try it asap, before that can i ask if Isass.exe something bad?

 

Maybe you would check the file at an online malware checker such as VirusTotal to see if any of databases are making calls.
http://www.virustotal.com/en/indexf.html

 

That file may or may not be a keylogger program. It would be best to have the suspect file scanned. You can use the Kaspersky online file scanner or the one mentioned in the previous post to see if anything suspicious is in the file.

http://www.kaspersky.com/remoteviruschk.html

Some articles about that file:
http://www.2-spyware.com/file-isass-exe.html
http://www.superadblocker.com/definition/isass/
http://www.liutilities.com/products/wintaskspro/processlibrary/isass/

 

this is all the files that were running

igfxtray.exe
hkcmd.exe
tfswctrl.exe
apoint.exe
AGRSMMSG.exe
HWsetup.exe
SVPWUTIL.exe
fnkeyhook.exe
ceekey.exe
tpsmain.exe
padexe.exe
zoominghook.exe
cfsserv.exe
IMJPMIG.exe
imscinst.exe
TINTSETP.exe
TINTSETP.exe
qttask.exe
ctfmon.exe



i dont know which one is good or needed to run my computer and ones that are not needed

 

ProcessLibrary

 

i searched on all the files and they are not virus caused, but for some reason my computer continues to run with many processes and it runs reallllly slow on the startup each time

 

Download

MS Process Explorer

http://www.microsoft.com/technet/sysinternals/Utilities/ProcessExplorer.mspx

MS AutoRuns
http://www.microsoft.com/technet/sysinternals/utilities/autoruns.mspx

When you start it , choose to hide Microsoft stuff



MS Rootkit Revealer

http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx
Scan with it


Scanning with good antivirus/antispyware will help

 

Its no virus, it belongs to a rootkit revealer from this page

www.greatis.com/security/Partizan.htm

 

Correct.

Invited or not, you have - or had - UnHackMe installed on your system at one time or another. Its either still installed, or it left orphan files when it was uninstalled that cause the opening screen msg about "partizan.rri" running.

If you want that off your system:

1
Use start->control panel->add-remove programs to remove UnHackMe - if its still there.

2
Whether or not UnHackMe shows on the programs list, go to

c->windows->system32 where you should find three orphan files (see image)

partizan.log
partizan.pbk
partizan.rri

Delete all three orphan files

3
Reboot your system

The UnHackMe start-up issue should be gone.

Worked for me.

 

thanks daktari I appreciate the info
I have this issue also and forgive me for interjecting but my situation seems worse hopeless even

If I cant get past the start screen which says
\??\C:\WINDOWS\system32\partizan.rri effectively I cannot boot into my system then how do I get rid of those 3 'unhack me' generated files
does any one know how to get past the start screen (also cant boot or get past a list of drivers when I tried safe mode)
does it mean I have corrupted these files and probably the entire system too?
if so next step reinstall windows
Redmeansdead