system
1
I just installed Avast! Home, it did the initial scan in DOS mode at bootup. After rebooting, I can’t launch ANYTHING! When I try to start any program, XP gives me the following message: “Windows cannot access the specific device, path or file. You may not have the appropriate permissions to access the item”.
Please Help!!
Tim
Eddy
2
Where there infections detected?
If so, what files where delete/moved?
system
3
It found lots of Win32 Trojans in system directories. I told Avast to move, not delete.
When I look at the text logs I see:
…sign of “Win32-Trojan:gen {other}” found in “C:\WINDOWS\System\Rundll.exe” file.
Thanks for the fast response!
Eddy
4
That is indeed malware.
Are you using XP Home or Pro?
If Pro:
Do you also get this message when logged in as administrator (not as user with admin rights)?
If Home:
Does your user account have admin rights?
system
5
XP Home, and I do have admin rights.
As a test, I created another ID and put it in the Admin group. It has the same problems.
I checked and the Rundll.exe is still in the Windows\System32 directory.
???
DavidR
6
Switch off system restore, reboot and scan again (or run a boot time scan after reboot).
Windows in its wisdom is trying to protect itself (or so it thinks), by protecting/restoring files deleted from its system folders.
When you are in the clear again, then you can enable system restore again.
Eddy
7
Try this:
start > run > sfc /scannow
system
8
Hmm. It says it needs to copy some files from my original XP CD which I don’t have. Not good. Do you think I could just find a replacement for rundll.exe?
system
9
David,
Just noticed your post. Can you explain more of what you are suggesting that I do?
“Switch off system restore, reboot and scan again (or run a boot time scan after reboot).”
Not sure how / where to “Switch off system restore”
Eddy
10
As I said before. That rundll.exe is MALWARE, you don’t want that back.
How to disable system restore.
Get a Windows XP cd and run the sfc is I suggested, place all original Windows files it asks for back from the cd.
Also check this key in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
If you see c:\windows\system\rundll.exe there, remove it.
system
11
The original XP disk didn’t solve my problem, so I bit the bullet and rebuilt the whole from scratch. This time, I loaded Avast! right away before I installed any of my other tools. So far all is well.
Eddy
12
Not exactly how I would have approaced it, but at least the problem is solved. I hope you didn’t forget a firewall 