Can't start "Read and RUn me First" because of Virus

I'll start with my current problem and then give you a history.

As of right now I can't run any programs. Every time I try to open something (i.e. Spybot and even System Restore) A window pops up that ask me to “Choose a program to open it with.” I'm stuck. I ran on SAFE MODE and was able to do a System Restore from 3 days prior but after I rebooted in SAFE MODE again I still can't open anything. And the same "Open with" window pops up when I try to open programs as if the restore didn't work at all. I'm at a total loss and have been searching forums for an answer. I also tried this in SAFE MODE WITH NETWORKING and still nothing. Since I basically can’t do anything with my computer I can’t even start to contemplate the next process of complying with the “Read and Run me first” thread. Help. Is there a way to do something with “Run” or on start up?

THe History-
Basically 3 days ago I got infected with some Virus. I'm not sure which one it was at first but it seems to morph into a new one every time I restarted the computer. Everything from Trojans, Worms, SmitFraud, Virtumonde.dll, Rootkit…..the list goes on and on. The most persistent one that Spybot had trouble removing was SMITFRAUD-C.GP In the beginning I discovered I had to disconnect the internet and was not able to download any Antivirus programs etc. since the virus would control that also. Even in Safe Mode. Luckily my brother (Big Apple fan) had made me a CD of programs for Windows XP which had a few Antivirus programs on it. This was the only way I could Download anything! was from a CD (Currently I can’t even do that now) So back then I was able to get Avast and Spybot downloaded. I tried in every way, shape and form to get rid of the Virus and Malware. I tried in Safe Mode, in Safe Mode with Networking, in regular mode to run the AntiVirus programs. I kid you not, I have been none stop running them to try to clean the computer for the last 2 days. Today, after 3 runs of Spybot and Avast I finally got both to say the system was clean and nothing was detected. (I quietly worried that the virus was now controlling these programs some how to trick me) Sure enough (since I thought I was clean) I tried to connect to the internet for the first time in 2 days to try to come to this website to continue the process to make sure my computer was really clean……And that’s when all hell broke lose again. The virus was in hiding and seems to gain more and more control over simple operations every time I restart. So basically I haven’t a clue which viruses I have since none of my programs work. I’m not extremely computer literate but am trying to learn as I go. Hopefully this is a simple solution that I can move on from and then get back to trying to remove the viruses.

Also I have a simple question. If you are able to get me past this problem and I can then return to downloading programs to clean my computer, I will have to do it by CD since the Internet connection wreaks havoc and only helps the Virus. My brother’s CD with XP programs has a few of the ones mentioned in the “Read and Run me First” thread. But not all of the ones I’ll probably need. The question is How do I download the programs to the CD so that they will contain the SETUP wizard for each program? I’m sorry if that is about the most basic computer question you have ever received…but I always seem to do it wrong. When I go to the website to download, say…Spybot, When the window pops up I hit “SAVE” instead of RUN and then save it to my desktop. Then I try to copy that file from my desktop to the CD. But it loses Data and never works when I try to open it on another computer.

Thank You in advance for helping me

 

No.. When I'm in any of the Safe Modes my keyboard doesn't work. So I've been trying to work around that by cutting and copying the letters of words together. But it won't let me cut and paste in "RUN". I can browse but anything I click on to open in RUN either says "Can't find location" or "Open With..." box.
I tried to search for "regedit.exe" on RUN using the normal mode but again it pops up with "Open With..." box

I also tried to restart in Safe Mode and do the System Restore but it still doesn't seem to restore anything.

 

No I still got the "Open with..." Box

But YES!!!! I was able to get the Registry Editor open!!! After you told me what I was looking for to begin with (regedit.exe) I looked it up on Microsoft and followed their instructions to exe. file to work. So "RUN" works now!!! Should I post the link to their website for other people?

Thank you! Thank you! Thank You!!!! OK now what should I do?

 

I was so excited I posted a little to quickly since I later found out that not only does RUN work but ALL my programs can be opened now!!!

Here's the link with instructions for getting DOS to open and to change the value in my registry http://support.microsoft.com/kb/555067/en-us

I'm going to pick up a thumbdrive so I don't have to worry about the hassle of working with a CD to get programs on my computer to start the Read & Run me first instructions and then I'll post my logs!! Again, Thank you! Thank You!!!!!

 

my logs

 

.....and the last log.

I did have a few issues doing the whole process.... I don't know if it matters so I'll just write a quick note on each and if you want more info just let me know.

1.) WHen I was removing programs in Add/Remove there was one for "Avira AntiVir Personal Edition" It wouldn't remove itself. A window popped up and said "Cannot load master resource file" I think this was one of the programs I tried orginally to download from my brother's CD but it must have been corrupted

2.) I couldn't use the CCleaner on one of the 3 accounts. I tried twice in Safe and Normal modes and the account had Administrator privileges so I don't Know?

3.) WHen I installed Spybot it said it had found a copy already on my computer. But I know I had deleted it in the beginning in the Add/Remove step. I told it to just install anyway. Again I don't know if that matters.

4.) Internet WORKS!! but no images....you probably already know that though

5.) WHen I changed settings to allow hidden files to be showen...I got two files on my desktop now. "Thumbs.db" and "Zbthumbnail.info. Do they have to stay there? ....or am I getting ahead of you

6.) I thought I saw somewhere in the process something about Limewire. But that's not in my Add/Remove programs either?

Ok that's it

 

I'm stuck on the first task. :confused I run the Norton Removal Tool and then click Set Up and that's when a window pops up that says "THE VERSION OF NORTON REMOVAL TOOL THAT YOU ARE USING IS EXPIRED. PLEASE CLICK THE WEB LINK FOR HELP" so I go to the link and the first step says "RUN A TOOL THAT DELETES WINDOWS TEMPORARY FILES" so i searched the web a bit and tried this.... Start, Run, typed in %temp% and then deleted the files (not everything in the folder would delete) but the ones that looked like files for Norton DID delete. So I tried to downloand the program again but it gave the same window with the same link to take steps to delete windows temp files. ????

 

Ok. I got a Success message after running the fixme.reg Everthing else ran fine as described.

Problems:

1.) still no images in my internet browser

2.) I still can't run the CCleaner in the third account. I tried to change his account to limited and then back to administrator and then restarted but that didn't work. When I'm logged into his account and I click on C drive, It shows a blue screen and message that the files are hidden. So I click on Show Files and then again I get the Blue Hidden Files screen when I click on Program Files. When I click on the actual CCleaner I get a pop up message labled "C:\WINDOWS\system32\rundll32.exe" and the message says "CANNOT ACCESS APPROPRIATE DEVICE,PATH,FILE. YOU MAY NOT HAVE THE APPROPRIATE PERMISSION TO ACCESS THE ITEM"

and incase this is helpful info, My account was the first place to get infected under my login. I switched to his login becaue mine was all kinds of screwed up I couldn't access anything (kind of how his is acting now). So in his account I download Avast and Spybot and worked from his account up until I started this thread and you helped me fix the registry. After that I switched back to my account and have been doing everything from "Read & Run Me" up until now.

Also I forgot to say that in his account I get the same CANNOT ACCESS message when I click on anything. FOr example the Control Panel items. He can't access anything

 

I'm using Firefox now so I can get images.

After the Hijack scan I didn't find "Symantec Network Drivers Update" in Add/Remove.

I did download the AntiVirus. Something must have not worked though. It was in my Add/Remove programs but not in my Start Menu. So I did it again now and it's still not right. WHen I restart an icon is at the bottom right and it pops up a window that I need to Update. But when I say OK it says I can't until I fix the scheduler. And it's still not in my Start Menu. Is there a different one I can use or should I use this one?

 

OK WT... the "Symantec Network Drivers Update" is now in my Add/Remove programs but there's no remove button. It just says used rarely when I click on it

I got the success message from the "fixSYM.reg"

all the AntiVirus components are removed now for that program.

Where'd you learn all this?? I always thought notepad was uselessrolleyes

 

Actually it's still there...... That's why I wrote about it......

Other then that I downloaded Avast and it's working great. I did a check on start up and it found 5 problems all named "Win32:Rootkit-gen" 1 was in the other account and 4 were in C:\System volume information\_restore.

But my account seems fine. I'm not having any problems at all that I can tell. In fact it's running better then it has before.

 

sigh.... nothing comes easy with this computer does it? :cry

I did the toggling of the System Restore - Check!

The "Symantec Network Drivers Update" is in my Add/Remove Programs, But the weird part is that it doesn't have a size and it has no Remove button. All it says when I click on it is "Used Rarely" That's it. It's like it's not there but it is.... I mean it has no file size so it just hanging around as a title in my Programs.

Theeeennnn there was the other account. I can't do anything in it. When I click on any program (except Run) a window pops up and says "Windows cannot access the specified device, path or file. You may not have the appropriate permission to access the item" The account has "Administrator Privileges" though. And files are hidden still. When I click on C drive it opens with the blue screen and message that files are hidden.

You didn't think it'd be that easy? Did you? Just click and get the logs from the other account? Not a chance! My computers out to break someones will to live! It just won't die

 

logs

 

one more

 

Nope. No problems. I made him a new account like you suggested and deleted the old one. That should be it for this computer. However there are 3 more in the house with problems so you'll probably hear from me again in another post.

Thanks so much for all you've done! I never could have figured this out on my own. Thanks again

 

Alright I deleted and then installed a bunch of stuff.
I almost feel over protected

 

Here's what I have.

Avast
A-Squared
CCleaner
Malwarebytes
Online Armor

I'm not sure about the last one....since I downloaded it, the internet and just booting up is kinda of slow. It's definitely better then AVG and Mcfee....but still slow.

 

Ok....I installed COMODO BOClean......and it feels like I have a dial up connectionrolleyes

 

That does seem to help. It doesn't take 3 minutes for a page to load now.

here's a copy of my System Information. Does that tell you what you asked?

OS Name Microsoft Windows XP Professional
Version 5.1.2600 Service Pack 2 Build 2600
OS Manufacturer Microsoft Corporation
System Manufacturer Dell Computer Corporation
System Model Dimension XPS
System Type X86-based PC
Processor x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2992 Mhz
Processor x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2992 Mhz
BIOS Version/Date Dell Computer Corporation A01, 2003-04-28
SMBIOS Version 2.3
Boot Device \Device\HarddiskVolume2
Locale Zimbabwe
Hardware Abstraction Layer Version = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"
Time Zone Central Daylight Time
Total Physical Memory 1,024.00 MB
Available Physical Memory 548.19 MB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.93 GB
Page File Space 2.41 GB
Page File C:\pagefile.sys


It's not the latest computer on the block. And we really don't over load it with information either. It's relatively clean with a lot of memory or space still available.

 

Yes This is definitely Malware protection I can live with. Software "Protection" that would bog the computer down for no reason, was why he had removed and then never used them. It always seemed like a virus in itself. But I learned a lot. Things like removing the old java updates was pretty interesting to finally understand all those little things you wonder about. Do I need it? Can I remove it? Should I not remove it? etc...