keenval.e - system damaged now

[Kitt]

I brought my PC into safe mode yesterday, deleted infected files, brought back up and now window pops up telling me that I'm not running in the proper configuration and that I should go back and undo all changes? I ran AVG and Norton yesterday and neither one picked up anything. Today I get message that keenval.e is is a restore file. Attached is hijackthis log. Please help if you can......

[LowWaterMark]

Hi Kitt,

Please be aware that we do not do HijackThis Log analysis here any more per this announcement:

http://www.wilderssecurity.com/showthread.php?t=42148

However, the main problem you seem to be having now is not a spyware infection, but rather damage caused to your system when you delete those files...

So, let's see if people can advise you regarding that problem, hopefully including ways to get your system restored back to a usable state. Then you can follow-up with a Hijack cleaning request at a forum that provides those services. (After all, if your system is not usable then spyware is the least of your problems.)

[Kitt]

I don't quite understand how my system could have been damaged when I deleted those files, I followed the directions step by step I had been given from this forum?
When you say my system is unusable, what exactly does that mean? It seems to be functioning fine, other than the message window.
Please advise.
Thank you in advance for all your help

[snapdragin]

Hi Kitt,

I believe what LowWaterMark was referring to with regard to your system being damaged, is because you said you received a window that popped up telling you that your system was not running in the proper configuration and that you should go back and undo the changes.

I'm a bit confused though since you said you followed the steps yesterday given to you from this forum. The only fix instructions I've been able to find is from back in June when you posted your Hijackthis log and Pieter gave you the instructions of what needed to be fixed.

That thread can be found here: http://www.wilderssecurity.com/showthread.php?t=35478

The Hijackthis log you posted in that forum has the scan time of 6/7/2004.
The Hijackthis log you attached to this thread has the same scan time. In other words, you've attached the same HijackThis log as in the other thread.

Can you explain what kind of pop-up you received that told you to undo the changes you made?

Regards,

snap

[LowWaterMark]

Originally Posted by snapdragin

I believe what LowWaterMark was referring to with regard to your system being damaged, is because you said you received a window that popped up telling you that your system was not running in the proper configuration and that you should go back and undo the changes.

Yes, exactly. Kitt, I thought you meant that your system was unusable, as if Windows was telling you that you had deleted key files...

Originally Posted by Kitt

... and now window pops up telling me that I'm not running in the proper configuration and that I should go back and undo all changes?

But, obviously that is not what you meant since now you say it's functioning fine.

Snap - good catch on the old date from the HijackThis Log, I didn't notice how out of date it was.

Kitt, I think Snap's question is important. Can you describe in more detail the popup window you got and tell us if you are still getting it, or did it appear only one time?

[LowWaterMark]

Wondering...

Is this the popup you are seeing? (below)

If so, then that is a normal reminder that you previously changed the way your XP system boots up. I think Pieter had you go into a Safe Mode reboot, so that might account for it.

You can click the "Don't show this message..." checkbox and hit OK to stop that from being displayed again.

If that isn't it, can you show us an image of it?