Critical Issue!!! Need Help!

[cc]z@nd! · Post by **[cc]z@nd!** » Wed May 21, 2008 6:27 pm

sounds like a virus/annoyware atm, so do a virus scan and tell us what comes up. some good free virus/spyware programs I use are AVG (free edition) and spybot, but tell us what's on the laptop. oh, and one last thing, no matter how good an antivirus is, there's still ways to get past it. they typically work on signature databases that they use to see if certain files match certain signatures for viruses. the downsides are the file has to constantly be updated with new signatures for news viruses/worms, and there's ways to make a virus/worm with polymorphic code, to avoid detection. I'd say be more careful from now on. don't just download things for the hell of it, and be wary of things.

Eaton · Post by **Eaton** » Wed May 21, 2008 6:30 pm

There was some trojan in the Windows folder of my system. I'm about to restart the computer now and I hope it will work.

Edit: Ok, I still have to do the Task Manager trick to get the Desktop to appear. And I noticed that no program can be Run as Administrator anymore... I right-click, say Run as Administrator, and the program acts like it is in administrative mode, but I never see the prompt box...

Edit 2: I fixed the Windows Explorer problem, but not the Run as Administrator problem...

Twinreaper · Post by **Twinreaper** » Wed May 21, 2008 8:46 pm

I think I may be able to shed some light on this. If your brother downloaded Warcraft or any other game via a link by Xfire, that is the culprit. I dld a copy of Last Chaos and it is loaded with win32trojans. You will most likely have found added .dll files in your system32 folder. This batch of trojans are NASTY! It even went as far to change my registry and break my Vista activation. Do a registry edit under the HKEY_Local_machine directory and keep digging till you find the boot keys. Make sure everything is pointing to a valid or correct value. Also the the added .dll files will be wacky like (example: rxwydtsgf.dll) It took me two days to clean out the files and 2 spyware programs. It also most likely infected your boot.ini and your startup memory. Good luck with cleaning it out. My advice, stay away from games by ARIA!!!

-DeToX- · Post by **-DeToX-** » Thu May 22, 2008 6:00 am

Easiest way in my opinion... Pop in your Windows CD and do a Repair Installation.

It won't get rid of your settings, programs, desktops, etc... It'll just rid of updates to windows, but those are easy to get again from Microsoft's Windows update page on their site.

I just did it before and it feels great... so if you can't figure it out, I recommend this over formatting or reinstalling.

Eaton · Post by **Eaton** » Thu May 22, 2008 11:10 am

Well, I did some things last night and the PC is back to normal. It boots with Windows Explorer and all my programs run as administrator again. Deep thank to Ibot Peaches to telling me what really happened. Thank you all for the quick replies! I really appreciate it!

Tural · Post by **Tural** » Fri May 23, 2008 8:17 pm

Recently a fake file was posted here. Looking at the hex, I see the paths C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rawr.bat and C:\rawr.exe. Were these files present on your computer?

Eaton · Post by **Eaton** » Fri May 23, 2008 8:20 pm

Tural wrote:Recently a fake file was posted here. Looking at the hex, I see the paths C:\Documents and Settings\All Users\Start Menu\Programs\Startup\rawr.bat and C:\rawr.exe. Were these files present on your computer?

I don't have most of those folders on my Vista computer, but I checked the Start Menu in Windows Explorer and I see no files of that name.