[brussels]

Hi,

I think I may have inadvertently donwloaded something which has caused the following problems:

I cannot access the control panel feature and all Microsoft office applications only open in word pad. Also, I cannot access anti virus software or open any programs. A window opens telling me to find a suitable program from the web - For some reason I can still access the web.

I am thinking about saving all of my data on an external hard drie and reloading windows complete, but does anyone know any other way the computer can be restored to its previous working condition?

Any responses will be much appreciated.

[evilfantasy]

This is most likely a rootkit. We can try to fix it if you want.

Click Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

* Scroll down to Non-plug and Play Drivers and click the plus icon to open those drivers.
* Search for any of the following:
* Important! The letters can appear in either upper case or lower case letters.

- UACd.sys <- Or anything beginning with UAC
- gaopdxserv.sys <- Or anything beginning with gaopd
- gxvxcserv.sys <- Or anything beginning with gxvx
- Seneka.sys <- Or anything beginning with Seneka
- clbdriver.sys <- Or anything beginning with clbdriver
- TDSSserv.sys <- Or anything beginning with TDSS
- ovfst.sys <- Or anything beginning with ovfst
- lowsec.sys <- Or anything beginning with lowsec

* If you do find it, right click on it, and select Disable. Do not try to uninstall them.
* Now restart the computer.
* Let me know if you found them or not.

If the files are not found then please let me know what is listed in Non-plug and Play Drivers.

----------

Now follow the directions in the Malware Removal Guide and post the logs when complete.

[brussels]

Thanks evilfantasy for your reply.

Unfortunatley, I cannot open anything from Control Panel. When Control Panel is clicked, a window opens:

Windows cannot open this file, it needs to know the program that created it:

File rundll32.exe

Windows can use the web to find an appropriate program
Select a program from a list

Do you hae any other ideas?

Cheers

[evilfantasy]

The below is based on original info from http://support.microsoft.com/kb/949377

Important: This task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

How to back up and restore the registry in Windows

* Download and then install SubInACL (SubInACL.exe) file from Microsoft.
* Click Start > Run and type notepad.exe and click OK to bring up Windows Notepad.
* Copy and then paste the following text into Notepad.

cd /d "%ProgramFiles%\Windows Resource Kits\Tools"
subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f /grant=system=f
subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f /grant=system=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f /grant=system=f
subinacl /subdirectories %windir%\*.* /grant=administrators=f /grant=system=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

* Save this Notepad file as Reset.cmd to your desktop. Be sure the Save as type is set to all files.
* Once you have save it properly, double-click the Reset.cmd file to run the script.
** Note: This script file may take a long time to run. Additionally, you have to run this script as an administrator.
* Now reboot your computer! You must do this before the above will take effect.

----------

Now see if you can run any programs.

[brussels]

Thanks evilfantasy.

I opened Run and inputted the code %SystemRoot%\system32\restore\rstrui.exe , but again I received a meassage reading that windows cannot find the code rstrui.exe and therefore I cannot proceed any further with the system restore.

Thanks for your help - do you have any other suggestions.

[evilfantasy]

Just continue on with the rest of the instructions.

[brussels]

I have tried, but i can't get any further with this one. I can't access the vital parts of Windows that would enable me to carry out a system restore - ho well.

[evilfantasy]

Can you burn a CD?

Avira AntiVir Rescue System

1. Download the Avira AntiVir Rescue System
- If you need a free burning application, CDBurnerXP works on all operating systems from Microsoft Windows 2000 SP4 onwards.
2. Place a blank CD in your burner and double-click on the downloaded file.
3. The program will automatically burn the CD for you.
4. Place the burned CD into the affected computer and start the computer with the CD in the CD tray.
5. On the bottom left side of the screen there are 2 flags. Using your mouse click on the British flag to use English.
6. Click on the Configuration button.

- Select Scan all files
- Select Try to repair infected files and Rename files, if they cannot be removed
- Select Scan for dialers
- Select Scan for joke programs (Jokes)
- Select Scan for games
- Select Scan for spyware (SPR)

7. Click on Virus scanner
8. Click on Start scanner at the bottom of the screen.

9. Let Avira finish it's scan and then remove any threats found and then exit out of the scanner.
10. Take the CD out of the CD/DVD tray and then restart the computer.

If needed see this Tutorial for the Avira Rescue CD