What is this?!?!?! What is going on with my computer?!?

Question

Every time i start up windows i get these errors

C:\WINDOWS\SYSTEM32\jkhff.exe
windows cannot access the specified device path, or file. You may not have the appropriate permissions to access them.

and here's another one

Important-Potential Errors found in the system
During a scan of files at system starup, potential errors in the system registry were found p-07-0700 irql: If SYSVER 0xff00024 NT_ Kernel error 1256 KMODE_EXCEPTION_NOT_HANDLED

What is going on here? Is my computer under attack? I ran an antispyware scan and deleted all of them and im still getting these messages! Should i contact microsoft? What do i do?

Answer 1

JKHFF.EXE

The filename JKHFF.EXE was first seen on Sep 19 2007 in The UNITED STATES. It has also been seen in the following geographical regions of the Prevx community:



* The EUROPEAN UNION on Jan 2 2008

* SPAIN on Jan 14 2008

The filename is associated with the malware group Trojan.Vundo.Some files using the name JKHFF.EXE are also associated with the malware group:



* Dropper.Agent.GIT

http://www.prevx.com/filenames/X127602212864320052-0/JKHFF.EXE.html



How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo.

http://www.bleepingcomputer.com/forums/topic18610.html



Trojan.Vundo Removal Tool

http://www.symantec.com/security_response/writeup.jsp?docid=2004-112210-3747-99



Antivirus: BitDefender Online scanner - will scan and remove threats.

Anti adware/spyware: Ewido Online Scanner - will scan and remove threats.

http://www.bitdefender.com/scan8/ie.html

http://www.ewido.net/en/onlinescan/

Answer 2

it's a virus/spyware. You said you ran the antispyware scan and deleted all of them. Deleting them does not repair any damage that they do before you delete them.



From what you have listed here...It looks like it needs to be deleted from the registry. The program may have been deleted but the registry is still looking for it on start up.



I would not recommend that you try to fix this yourself even if someone trys to walk you through it. You can do alot of damage inside the registry with the slightest of typo's...:)



Calling microsoft will not help you and will cost you alot of money just to speak to someone. If you do not know anyone personally who is tech savvy then look in your local phone book for computer repair. Do you have a Circuit City near where you live?

Answer 3

The "jkhff.exe" is described at Prevx.Com (popular)



http://www.prevx.com/filenames/X127602212864320052-0/JKHFF.EXE.html



Run this

a-squared trojan remover (Free Working Version for life and Proactive Premium Version)

http://www.emsisoft.com/en/software/free/

a-squared (a-squared) is a complementary product to antivirus software and desktop firewalls on MS Windows computers. Antivirus software specializes in detecting classic viruses. Many available products have weaknesses in detecting other malicious software (Malware) like Trojans, Dialers, Worms and Spyware (Adware). a-squared fills the gap that malware writers exploit. Automatic updates: In a-squared Free the updater must be run manually. The auto-update feature of a-squared Personal checks hourly for new available updates and installs them automatically. a-squared Free is freeware! You can download and use it completely for free. You are also allowed to distribute it to third parties. To be able to use it, you only must set up a free a-squared Account, to get access to the update server.



A-Squared has over 300,000 defintions (largest) which has approached server side or industrial strength. Prevx.Com is kind of like a server side pooling as opposed to client side security software (personal computer antispyware). They also have a free version to use.



Webmaster http://www.BlueCollarPC.Net

Over 2 million hits since 2005 !



PS.... DON'T get duped into some DLL Fix IT program software. This would occur as disaster recovery if you deleted valid dll files which you have not. Sometimes Windows will give error messages as the closest thing realted to what a problem is. Disregard for now and remove the infection/infestation. This will clear up error messages. Since this threat is identified - it does not count that otherwise if you got error messages about corrupted dll files you would first go to Microsoft.Com for any help/repair and then move on to the disaster recovery software programs or utilities to fix the corrupted or deleted valid dll file which being from system32 in Windows may have corrupted Windows from proper operation or other software.

Answer 4

I would try deleting my history and cookies from my internet tools, then open all programs and see if there is something that doesn't belong and remove it. As a last resort I would try a system restore to a time when I didn't have the problem.

Answer 5

Google is your friend:

http://www.prevx.com/filenames/X127602212864320052-0/JKHFF.EXE.html

Answer 6

it could be a virus....