pbmitchell

Hi, I'm brand new to this forum and I hope someone can help me.

Yesterday, Internet Explorer 7 began throwing up frequent error messages saying it had encountered a problem and had to close. Luckily for me, I immediately decided to download Firefox.

I say 'luckily' because five minutes later, my IE7 icon disappeared from my desktop. I reinstalled IE7 from the Microsoft site but when I clicked the IE7 icon, it said it could not access the file.

Then my Norton Antivirus 2006 and System Works (which I've been using for months) started throwing up windows saying I had to validate them before use. I clicked the Validate button and a message appeared saying the software was already validated and the program would then open as normal. This happened 3 or 4 times as I tried to use the progs to sort my problems.

A few minutes later, I started getting messages saying (wrongly) that my subscription to Norton had expired - and neither prog would open.

In some despair, I downloaded VirginMedia PC Guard and it detected 7 instances of W32.NewMalware-LSU-Based Virus which I believe Symantec call W32.SillyFDC virus.

In trying to remove it, I found the following instructions:

1. Click Start > Run.
2. Type regedit
3. Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

4. Navigate to the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\"load"

5. In the right pane, delete any values associated with the worm.

The snag is that when I enter 'Regedit' in the Run command window, it won't open. I get a message saying Windows can't find the file.

Undaunted, I've downloaded RegCopa and that will get me into the registry.

My problem is I don't know what 'delete any values associated with the worm' means in Step 5 above. How can I tell which values are associated with the worm and which aren't?

Any advice would be very much appreciated.

Glaswegian

Hi and welcome to TSF

Mucking about in the Registry can leave you with a mangled system, unless you really know exactly what you are doing.

I think you may have other problems here - malware rarely travels alone. I would suggest you start here and follow the instructions.

http://www.techsupportforum.com/secu...sting-log.html

Please note that the HJT Forum is always busy, so I would ask that you be patient and we will get to you.