[RESOLVED] Disable proquota.exe

I just got beat up pretty bad by a trojan that came in an email, which it took me a week to hopefully clean all of it out. I did however have to repair windows with my repair option on setup. My only problem left is for some reason I have this proquota.exe popup that loads when xp does. I can end process and it goes away until I reboot again. It has to be ended before I can shut down or reset. Basically when it pops up it says that I have used too much memory in my profile, which I had no problem before with it. I want to disable it! I found nothing in any other threads here and would appreciate some ideas.

thanks

popman--Proquota.exe is a Windows file, so should be legitimate.
Perhaps these references will be of help to zero in on the problem
http://articles.techrepublic.com.com...1-5754321.html
http://support.microsoft.com/kb/911589
If not, look into msconfig (Start|Run|type msconfig|OK|Startup tab). Is proquota one of the programs starting at boot? If so uncheck the box to the left|Apply|OK.

Check here: http://discussions.virtualdr.com/sho...70#post1270770

Broni--Your link is to this thread.

Hahahahaha....never happened to me.....LOOOOOOOOOOOOOOOOOOL

It doesn't appear that poledit.exe exists in my computer it looks like an NT version. I did however already see the MS link earlier today where you have to email them for the hotfix(last resort). This thing turned on somehow by itself, cause I didn't do it. So there should be another way to turn it off.
btw, way to go broni:rolleyes:

See here: http://www.tiplib.com/171/disable-po...rofile-storage

Should be in C:\WINDOWS\system32 - 49.0 KB - ver. 5.1.2600.5512
C:\WINDOWS\ServicePackFiles\i386
C:\WINDOWS\$NtServicePackUninstall$

I saw the right click thing earlier today but there is no securities command in that menu. Train I have the location but I am unsure of what you want me to do with the other 2 C:\ directories

Those are the three directories that I find it.

And i posted the version number just one time as each is the same.

More of a info post and a just in case if the one is bad as to where you can find a replacement.

What would happen if I deleted all instances of it? Would I just end up with a buch of errors? I found the prefetch and the dll files too.

Before you do anything...

Download HijackThis:
http://www.trendsecure.com/portal/en...kthis/download
by clicking on Download HijackThis Installer
Install, and run it.
Post HijackTHis log.

I'd like to see, what's loading there.

I go along with the HJT log.

I have never posted HJT log. I would guess it goes in that forum and can I just copy paste it. And it is ready to go...

Yes, copy, and paste.

HJT log posted here is a quick link to it
http://discussions.virtualdr.com/sho...69#post1271069

I'm copying it here, since, most likely, we're not dealing with any infection.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:19:15 PM, on 3/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\proquota.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\casc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Desktop Calendar\Desktop Calendar.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: OToolbarHelper Class - {EAD3A971-6A23-4246-8691-C9244E858967} - C:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll
O2 - BHO: Lincmediaplayer - {fbaa6932-b59b-4854-8041-27a233394ba3} - C:\Program Files\screensaver\screensaver\adxloader.dll (file missing)
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - C:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll
O3 - Toolbar: (no name) - {b6bb2c0a-8d74-4664-a1cd-103bd9a69de9} - C:\Program Files\screensaver\screensaver\adxloader.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VetStart] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe" -r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\casc.exe
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [CAPPActiveProtection] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe"
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Desktop Calendar.lnk = C:\Program Files\Desktop Calendar\Desktop Calendar.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Program Files\CA\SharedComponents\CA_LIC\\lic98rmt.exe
O23 - Service: CA Common Scheduler Service (ccSchedulerSVC) - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

Open HJT, and checkmark:
- O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
- O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
Click "Fix checked" button.
Restart computer.

I deleted the files from the last post recommendation and no change

Quote:

---

I have this proquota.exe popup that loads when xp does

---

What exactly does it say?

First there is a little red circle with a white X in my tray. When I click on it a popup window comes up and scans everything in my personal files like pictures and download files, emails I save and all kinds of stuff like that. At the top the little red circle is there and next to it, it says: "You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage."
Then at the bottom is my currrent profile size and my allowed size and an ok button. I have to END TASK to be able to reboot or shut down. And every few minutes it rescans.
There has to be a way to shut this off!! Maybe delete every instance or something.

Go back to my link: http://www.tiplib.com/171/disable-po...rofile-storage
The instruction are not correct. This is how you do it:

1. Open windows explorer

2. Find file c:\windows\system32\proquota.exe

3. Right click on the file, click Properties, and go to Security tab. Click Advanced button.

3. Under Permissions tab click on every entry, and click Edit button. For every entry do what step 4 says. Do the same thing under Auditing tab

4. Uncheck "Inherit from parent the permission entries ...", make sure you've removed all
permissions from this file.

5. Restart computer.

Go to Start > Run and type in gpedit.msc
This will bring up the group policy editor.
Next go to User Configuration > administrative templates > System > User Profiles
On the right pane you find a policy 'limit profile size'
Doubleclick to edit the properties and set it to 'Not Configured'

You may have to run gpupdate /force from Start > Run

/edit
Broni's solution will work as well but if it is a policy, it's better to turn it off.

IT'S FINALLY GONE!!

Now, DeP, and me have to bet, which solution worked :D

There was some sorting for me to do in that mode as I don't go there, but I did figure out that you have to be in Admin mode which I don't keep my pc in that mode to keep bad guys from taking me over. So I switched to safe mode and logged in as Admin. When I unchecked the box that said Inherit from parent the permission entries, a dialog box poped up that asked me to choose copy permissions from a previous entry or remove this entry. At that point I took a break and thought about it. Remove was the key word in your instructions. I used the Broni :D method as that was the first one I tried. Thank you guys a bunch for all of your help. Now if everything went well there will be no long term problems...

This post has been worked well and sovled.

thanks again

Good job! :D

Hello Broni and DeP.
I am having the exact same issue that popman had. I tried DeP's solve but my "limit profile size" was already set to "not configured". I did the "gpupdate /force from Start > Run" anyway.

The reason I went to this solution instead of the one that worked for popman was because my tabs appear to be different than the ones you describe in your fix, Broni. I am using Windows XP Professional 2002, Service Pack 3.

When I go to proquota and right click and choose PROPERTIES, there IS no security tab. The tabs I have are General, Version, Compatibility, Summary and Icon.

Is it because I may not be in Admin mode as Popman said you must be? Do you have a fix for me??? I am a newbie when it comes to fixing my computer, so step by step is best for me. =)

Thanks,
Shama.

If you disable simple file sharing, the classic Security and Sharing tabs appear, and you can specify which users and groups have access to shared folders on your computer.

Okay! I had to google how to do that but I got it done. Then I went in and started Broni's fix. I was able to remove all but one, Administrators. Beside that listing it does say "inherited from > <not inheritied>" but I also get a popup window that says...

"The current Audit Policy for this computer does not have auditing turned on. If
this computer gets audit policy from the domain, please ask a domain administrator
to turn on auditing using Group Policy Editor. Otherwise, use the Local Computer
Policy Editor to configure the audit policy locally on this computer."

I am really not sure how to do that, or if I should.

Next step?

Thanks!
Shama.

Hello???? I am still dealing with this issue and it is causing me to force a shutdown each time I need to turn off the computer. Can someone please help me remove the final permission from proquota.exe??

Thanks.

I suggest, you start your own topic, instead of hijacking someone's topic.

My apologies. I felt that since it was the exact same issue, this would be the correct place for it, so folks that had the same outcome to the fix as I did, could progress through the next step.

I started my own thread here:
http://discussions.virtualdr.com/sho...78#post1315178

Hope to see you over there. You seem to be familiar with this issue.

Thanks,
Shama.

Yeah, two reasons:
- every computer is different
- starting your own topic gives you more attention
:)