[Soad342]

Hey guys. I was told to make a post in here. Please refer to the http://www.geekstogo...51#entry1139851 thread to see what we did. I'm pretty sure we removed the virus, but it edited some registry keys

I had the VBS/Ritart.worm virus, but thankfully the Malware guys (Rorschach112) helped me get rid of most if not all of it Please read http://vil.mcafeesec...nt/v_143930.htm to see some specific stuff on what registry the virus edited

Basically, my problems are:
I can't open Regedit, CMD, MSConfig, a few other important EXE programs (above link lists more if you read the edited registry).....but espeically can't run and "Setup.exe" or "Install.exe" (which is a real pain) programs.
The Virus had originally created tons (about 13,000) .VBS files that were disguised as MSWORD Docs. Through Virusscans, I got most of those out. In my Start Menu, "Run" and "Search" were missing, and "Folder Options" in the CP was missing. By using a registry cleaner, I was able to restore the Run and Folder Options icons.
My boot.ini file is blank, and during the reboot process A black screen appears that reads "Invalid boot.ini file, Booting from c:/ or something along those lines.
When I log on, I get two Notepad popups that reads [.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787
Now, MSWORD seems to be gone from my computer (but I think this has something to do with a registry cleaner I had run "RRT.exe"

Sorry for the long list of problems. I've run tons of different malware tests, but I'll run anything you guys would need in order to help me. I'm no tech or anything, but I just imagine that I'd have fix those registrys and somehow fix my boot.ini.


Thanks guys

[Advertisements]

Try this fix from the Doug Knox web site: EXE FIle Association Fix

[Ztruker]

Try this fix from the Doug Knox web site: EXE FIle Association Fix

[Soad342]

Which fix would I download? I imagine the Regedit, but I'm pretty sure I was having trouble opening some BAT files. Thanks

[Ztruker]

Ummmm, how about EXE File Association fix, you know, the one I posted the link to

If you are having problems with batch files, give the Batch file association fix a try also.

Edited by Ztruker, 24 January 2008 - 04:35 PM.

[Soad342]

Thanks, but I can't open either. Since its a registry thing, windows says "windows cannot find the regedit.exe" I see what he said about pressing CTRL, ALT, DELETE to work around this, but the virus disabled this as well.

[Ztruker]

Okay, do you have a XP CD? If yes, put the XP CD in the CD drive then click on Start then Run, type sfc /scannow and press Enter.

This can take awhile to run. It will check all critical system files to see if they are missing or damaged and replace as needed.

If that doesn't fix your problem then I would suggest doing a Repair Install. This won't mess with your data but you will have to reinstall some software, especially AV and firewall.

[Soad342]

thanks for the reply man. I ran sfc /scannow, and that little pop up box came up for a minute or so, then randomly closed. Now when I re-tried, CMD flashed for a split second, but that little box doesn't come up anymore. Also, what I got with my computer was a "Windows XP Service Pack 1 Recovery" but I now have SP2 installed..so I'm wondering if a repair install would work.

[Ztruker]

You need to create a new XP CD slipstreamed with SP2. Not hard to do, just takes a little time. Directions follow:

The simplest way to create a Bootable Windows XP Pro or Home Installation CD Slipstreamed with SP2 is to use Autostreamer. You point to your XP Pro/Home CD, the SP2 Service Pack .exe file, give it a path to write the .iso file to and off it goes. In 5 or 10 minutes you have a .iso file that you can burn to CD with almost any CD burner program you want to use. I used Roxio 7. There is a good freeware burner called DeepBurner which will do this also.

Here is the link to Autostreamer:
http://www.softpedia...ostreamer.shtml

You can download the SP2 .exe here:
http://www.microsoft...;displaylang=en

An excellent alternative is nLite. It allows you to merge SP1/SP2/Windows Updates into a new XP CD image that you can install from. Takes a bit of fiddling with but worth the effort since it also allows you to pre-answer all the questions asked during install so all you have to do is boot the new CD, select where you want to install, format or not and go to lunch. When you come back the install is finished and your are at the latest Service Pack and Update level. See here:
http://www.nliteos.com/

Use this site to get the MS updates:
http://www.softwarepatch.com/windows/

You can also get updates from an MS site but it takes more work:
http://windowsxp.mvp...saveupdates.htm

[The Skeptic]

If the original installation was with sp1 then you shouldn't have any problem repairing with your sp1 disk. In the process you will lose sp2 and all other windows updates, meaning that you will have to re-update.

[Ztruker]

Checked with Skeptic and he was referring to doing a Repair install and SP2 does not matter there.

It won't work with SFC though so you do need to do the slipstream if you want to run it.

[Soad342]

Hey guys thanks for the help so far, sorry.........but I'm confused at the part where it says "give it a path to write the .iso file to and off it goes" sorry. I understand the rest though.

[Ztruker]

One of the things you need to do when using Autostreamer is fill in the path (like d:\temp or c:\documents and settings\youruserid\isowork, etc.), where you want Autostreamer to create the iso file on your hard drive.

It will be obvious when you start Autostreamer.

Edit: Or maybe not so obvious. Autostreamer will not create a bootable CD directly. It creates a .iso file that can then be used to make the bootable CD.

Edited by Ztruker, 26 January 2008 - 09:05 PM.