need help with trojans

I'm sorry I can get regedit through the regedit.exe. I'm afraid to dance just yet. Read up on some info about gedzac worm and it scared me. LOL when we finally say goodbye I plan to dance right over to your donations page.

I'm sorry I can get regedit through the regedit.exe

That works, but if you do it the other way (Start–> Run), you get the error?

yes the error says…………………… top of the box says 16 bit MS-DOS Subsystem then inside…………….. C:\WINDOWS\system32\regedit.com The NTVDM CPU has encountered an illegal instruction. CS:054e IP:05ee OP: f0 05 00 00 f4 Choose 'Close' to terminate the application. Then it gives me the option to close or ignore and clicking either option closes it.

Go to this link:

http://www.visualtour.com/downloads/

Download/run

07/29/2004
XP_FIX.EXE <– This one
(140 Kb)

Reboot, and try start –> run, regedit once more.

The error you get isn't a "regedit" problem.


Assuming it will work, let me know of any other problems your machine is experiencing at the moment.

This might be a silly question but do you want me to let you know now or after I do the previous about other problems?

Better wait until AFTER trying my previous instructions.

ok here goes regedit is doing the same thing as before these are the new problems since the infection started 1. my firewall in windows security keeps turning off 2. when I try to run my test center in AVG I get this message….. @MainFrm_NotStartUIB and my e-mail scanner keeps turning off. 3. everytime I click a link or start IE the installer pops up trying to install microsoft money. this program is 2002 so has been installed for awhile, however I never really use it anymore. 4. When I rebooted this time after running the XP fix I froze up and when I tried it again it was extremely slow and when I put my mouse over the task bar it has the hour glass like it is busy trying to do something? this last problem is new. Gosh sorry to be so troublesome

Go to:

Start –> Run

Type in: regedit.exe then hit enter.

Does that work, or give you the error?

Close all Internet Explorer windows and fix this with HijackThis!:

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll

Close HijackThis!

Reboot.

Hopefully your "Money" problem is gone.

Copy the text in the following quote box into Notepad:

dir c:\WINDOWS\system32\regedit.* /ah > files.txt
dir c:\WINDOWS\system32\regedit.* >> files.txt

Save it to your desktop as findme.bat

Now, the findme.bat file on the desktop.

Then open files.txt on the desktop with Notepad, and post it's contents into your next post.

everything is the same as noted before. yes I can open the registory editor from regedit.exe. Volume in drive C is PRESARIO Volume Serial Number is B08E-8A4B Directory of c:\WINDOWS\system32 07/22/2006 07:10 PM 2 regedit.com 1 File(s) 2 bytes 0 Dir(s) 27,694,342,144 bytes free Volume in drive C is PRESARIO Volume Serial Number is B08E-8A4B Directory of c:\WINDOWS\system32

Copy the text in the following quote box into Notepad:

attrib -r -s -h c:\WINDOWS\system32\regedit.com
del c:\WINDOWS\system32\regedit.com

Save it to your desktop as killme.bat

Now, the killme.bat file on the desktop.

That should fix your regedit problem.

That was a bogus file.

Personally, I think the best way to solve the AVG problem would be to uninstall it, reboot, and re-install it.

I'll have to do some research into your "Money" problem, if you want to save it.

If you don't use it, and don't plan on using it, you could consider uninstalling it.

I'll do some checking around.

And the firewall that comes with windows is insufficient.

It can block some things from getting in, but does nothing about things on the inside getting out.

There are links to free firewalls here:

Securing Your PC After An Attack

WOOOOOOOHOOOOOOOOOO!!!!! uninstalled money care nothing about the program and fixed that problem. Regedit is fixed as well, opens from both ways. I will download another firewall so all will be well there. Now on the AVG I will do what you said but before I uninstall it I need to know what to do with the 284 files in the vault. I would think delete them but want to be sure. Just one more question and hopefully I can move aside to allow you to help someone else. Is AVG, Ad-Aware, Spy-Bot, and a new firewall sufficient protection for my computer? Thanks so much for your help. All of you at Tom Coyote are great for doing what you do. It is unfortunate that people choose to make money in such a dirty way as malware, spyware and viruses. There was a couple of times my frustration made me want to hunt them down in person, can't imagine yours.

Some of the files in "prison":

"","","Virus identified VBS/Gedza.A","C:\Program Files\Real\RealOne Player\DataCache\Login\js\buttons.js","7/24/2006 12:24:48 PM","buttons.js","266.37 KB"

"","","Virus identified VBS/Gedza.A","C:\Program Files\Quicken\inet\common\pnf\quicken\21b1.htm","7/24/2006 12:24:54 PM","21b1.htm","278.85 KB"

12:10:09 PM","searchRowStart.htm","266.77 KB"
"","","Virus identified VBS/Gedza.A","C:\Program Files\Shareaza\Remote\searchTab.htm","7/24/2006 12:10:16 PM","searchTab.htm","266.28 KB"

"","","Virus identified VBS/Gedza.A","C:\Program Files\RecordNow\Explain\MyCD_BufferUnderrun.html","7/24/2006 12:10:35 PM","MyCD_BufferUnderrun.html","270.86 KB"

The one's from the RealOne and Shareaza don't bother me. That's easily enough removed/re-installed.

How about Quicken and RecordNow… Do those software packages still function?


If AVG can't just "clean" the file and leave it in place, I don't think you have any option but to remove them.

Am I suppose to choose wipe or delete? I uninstalled shareaza couple of days ago. Real one not important have media player. Record now and quicken seem to work fine. All the files cannot be healed.

Am I suppose to choose wipe or delete?

My turn for "silly questions"….

What's the difference?


I've not had anyone ask me this, and I've never used AVG.

About your "protection" software.

You could consider installing "SpywareGuard" and "SpywareBlaster", links to them are in the same place the links to the firewalls are.