Need Help to Disbale proquota.exe

[Shama.]

Hello.
I am having an issue with proquota.exe and need to disable its hold on my computer.

I had a nasty trojan which I was able to remove from my computer, but it left something activated on proquota, which I have learned is a legitimate Windows file, but it is hijacking my system. It presents as a popup that loads when xp does.

Another poster to this site had the exact same problem discussed on another thread… He described it:

(Here is the thread: http://discussions.virtualdr.com/sho...d.php?t=237477 )

“First there is a little red circle with a white X in my tray. When I click on it a popup window comes up and scans everything in my personal files like pictures and download files, emails I save and all kinds of stuff like that. At the top the little red circle is there and next to it, it says: "You have exceeded your profile storage space. Before you can log off, you need to move some items from your profile to network or local storage."

Then at the bottom is my currrent profile size and my allowed size and an ok button. I have to END TASK to be able to reboot or shut down. And every few minutes it rescans. I can end process and it goes away until I reboot again. It has to be ended before I can shut down or reset. Basically when it pops up it says that I have used too much memory in my profile, which I had no problem before with it. I want to disable it!”

I am having the EXACT same issue. It was suggested to this poster to do the fix mentioned at this link:
http://www.tiplib.com/171/disable-po...rofile-storage

The poster on the other thread followed that advice and said it totally cleared up the problem.

So, I went and followed the same advice. I was able to remove most permissions from the proquota.exe file, but was not able to remove permissions from the one called “Administrators”. Beside that listing it says "inherited from > <not inheritied>" but when I try to remove permissions I also get a popup window that says...

"The current Audit Policy for this computer does not have auditing turned on. If this computer gets audit policy from the domain, please ask a domain administrator to turn on auditing using Group Policy Editor. Otherwise, use the Local Computer Policy Editor to configure the audit policy locally on this computer."

I am really not sure how to do that, or if I should. And the little red circle with the white X remains in the system tray and I am still unable to shutoff my computer in the correct way because the scan and the warning keep coming up when I try to.

Please advise how to remove this final permission so I can be as happy as the man who successfully fixed this problem on the other thread.

Thanks!

[Broni]

proquota.exe file is prone to infections.

Please, read here: http://discussions.virtualdr.com/sho...d.php?t=167915, and start new topic here: http://discussions.virtualdr.com/forumdisplay.php?f=71

[Shama.]

Thank you. Will do.

[Hewit1314]

I am having the same problem, but cannot seem to find where you have redirected this thread to. Please Help!? and post the link if possible...

Thankyou,
Pete

[Broni]

Links are in my previous reply.
They lead "HijackThis Logfiles" forum.

[Shama.]

I haven't opened up a new thread on this yet because I am trying to run my scans and get logs for it (but am having trouble with even THAT!). I am putting together a post to put where Broni directed me to in his previous reply soon. Stay tuned...

[Markgc]

I had one of those malaware things on my pc at work. Try renaming HJT to something different...such as dave2.exe. A lot of these new malaware programs will stop disinfecting files from running if they recognise the name.

I would download malwarebytes and run that. It is free and will identify your problem and may well fix it. I had that red circle thing too. Don't run the pretend scanner that is launches.

One of the infected pc's at work wouldn't even download malwarebytes and I had to download it at home and bring in a cd for him to use. Don't use a thumb drive as they can easily get infected too. A cd cannot get infected. In th eend I wouldn't bring my work thumb drive back to my home. It stayed at work with the other infected pc's lol