VERY Big Virus Problem - Can't Access Anything!

Vanchatron · 07-17-2006, 06:15 PM

I downloaded a file via a P2P program and when I accessed the file I got a message saying 'NO ADMIN RIGHTS' and then it just closed. I thought nothing of it and deleted the file but now whenever I try to access ANYTHING on my computer I get the following problem:

I tried going into control panel to see if I could sort it out from there and when clicking on any of the icons I get the following message:

This seems to be a really big problem because not only can I not access anything (firefox is the ONLY execption for some reason), I deleted the file but the effects still seem to be there.

I can't access Cmd, regedit or msconfig via 'Run' anymore either, I get the same problem. I can't even restore to a previous date because it just asks me which program I want to use to open it. I'm really stuck for what to do, I've never encountered this problem before.

I can't access any antivirus/adware/spyware programs either.

HK

chauffeur2 · 07-17-2006, 06:27 PM

Greetings Vanchatron...and Welcome to TSF,

P2P websites are notorious for sending viruses etc. with files, and it looks as though you might have been infected with one of these.
To rectify your problem, have a look at this....

http://www.techsupportforum.com/showthread.php?t=15968

Read this Post; follow the steps; then, post your HJT log to the HJT Forum here....

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/

Good Luck with it.

Vanchatron · 07-17-2006, 06:46 PM

Will do, thank you!

HK

Vikesrock8411 · 07-17-2006, 07:45 PM

We'll need to fix the .exe association befor you can do much of anything with your computer so let's do that here.

Download the .EXE Association Fix from here. Unzip it to your desktop and double click on xp_exe_fix.reg and click Yes to merge it into your registry.

It is possible that these instrucitons may not work properly for you. If you cannot complete them let me know and we can attack it in a slightly different way.

Vanchatron · 07-17-2006, 08:25 PM

OK, Vikes, I've run that reg file and did as you said but what happens now exactly? What I mean is, what was the point of that?

HK

Vikesrock8411 · 07-17-2006, 08:30 PM

It should have fixed the issue occurring in the first graphic you posted. Judging by your question I'm guessing it didn't?

Vanchatron · 07-17-2006, 08:38 PM

You wont believe this, EVERYTHING is back to perfect working order again after doing that .exe thing. I'd thank you and say 'Glad we got that sorted' but I don't believe it can be over that easily... Surely there's a catch haha.

HK

Vikesrock8411 · 07-17-2006, 08:53 PM

Excellent, whatever that file was, the .exe association may not be all it changed, please follow the directions posted by chauffeur2 above.

We'll be able to check and make sure your system is completely clean once you post your Hijackthis log in the forum. I wanted to get the associations fixed now as whatever analyst ended up picking up your log would have to do that first anyway and this keeps your system far more usable in the meantime.

Edit: I see you have already posted a log in the proper forum. Either me or another analyst will be around to analyze it when we get a chance, for now I am just going to edit your post to explain that the file associations are fixed.

07-17-2006, 06:15 PM	#1 (permalink)
Vanchatron Registered User Join Date: Jul 2006 Location: UK Posts: 429 OS: XP Home	VERY Big Virus Problem - Can't Access Anything! I downloaded a file via a P2P program and when I accessed the file I got a message saying 'NO ADMIN RIGHTS' and then it just closed. I thought nothing of it and deleted the file but now whenever I try to access ANYTHING on my computer I get the following problem: I tried going into control panel to see if I could sort it out from there and when clicking on any of the icons I get the following message: This seems to be a really big problem because not only can I not access anything (firefox is the ONLY execption for some reason), I deleted the file but the effects still seem to be there. I can't access Cmd, regedit or msconfig via 'Run' anymore either, I get the same problem. I can't even restore to a previous date because it just asks me which program I want to use to open it. I'm really stuck for what to do, I've never encountered this problem before. I can't access any antivirus/adware/spyware programs either. HK

07-17-2006, 06:27 PM	#2 (permalink)
chauffeur2 Manager Emeritus Join Date: Feb 2006 Location: Adelaide, South Australia Posts: 10,180 OS: Xp Sp3 with all updates + Vista™ Ultimate SP1. My System	Greetings Vanchatron...and Welcome to TSF, P2P websites are notorious for sending viruses etc. with files, and it looks as though you might have been infected with one of these. To rectify your problem, have a look at this.... http://www.techsupportforum.com/showthread.php?t=15968 Read this Post; follow the steps; then, post your HJT log to the HJT Forum here.... http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/ Good Luck with it. __________________ Dave T. Submit New Articles If it works, Don't fix it! Especially if Bill Gates had anything to do with it!!

07-17-2006, 07:45 PM	#4 (permalink)
Vikesrock8411 Analyst, Security Team Join Date: Jun 2005 Posts: 3,065 OS: Windows XP	We'll need to fix the .exe association befor you can do much of anything with your computer so let's do that here. Download the .EXE Association Fix from here. Unzip it to your desktop and double click on xp_exe_fix.reg and click Yes to merge it into your registry. It is possible that these instrucitons may not work properly for you. If you cannot complete them let me know and we can attack it in a slightly different way. __________________

07-17-2006, 08:30 PM	#6 (permalink)
Vikesrock8411 Analyst, Security Team Join Date: Jun 2005 Posts: 3,065 OS: Windows XP	It should have fixed the issue occurring in the first graphic you posted. Judging by your question I'm guessing it didn't? __________________

07-17-2006, 08:53 PM	#8 (permalink)
Vikesrock8411 Analyst, Security Team Join Date: Jun 2005 Posts: 3,065 OS: Windows XP	Excellent, whatever that file was, the .exe association may not be all it changed, please follow the directions posted by chauffeur2 above. We'll be able to check and make sure your system is completely clean once you post your Hijackthis log in the forum. I wanted to get the associations fixed now as whatever analyst ended up picking up your log would have to do that first anyway and this keeps your system far more usable in the meantime. Edit: I see you have already posted a log in the proper forum. Either me or another analyst will be around to analyze it when we get a chance, for now I am just going to edit your post to explain that the file associations are fixed. __________________

07-17-2006, 06:46 PM	#3 (permalink)
Vanchatron Registered User Join Date: Jul 2006 Location: UK Posts: 429 OS: XP Home	Will do, thank you! HK

07-17-2006, 08:25 PM	#5 (permalink)
Vanchatron Registered User Join Date: Jul 2006 Location: UK Posts: 429 OS: XP Home	OK, Vikes, I've run that reg file and did as you said but what happens now exactly? What I mean is, what was the point of that? HK

07-17-2006, 08:38 PM	#7 (permalink)
Vanchatron Registered User Join Date: Jul 2006 Location: UK Posts: 429 OS: XP Home	You wont believe this, EVERYTHING is back to perfect working order again after doing that .exe thing. I'd thank you and say 'Glad we got that sorted' but I don't believe it can be over that easily... Surely there's a catch haha. HK