Expert: Brian Benosky - 6/24/2008

Question
ok so a few days ago i was doing a routine update and scan of my compy, i updated Spybot (the newest version) and AVG 9version 8) and then ran a scan, it came back with no hits in spybot but several (i think like 30 some) hits in avg, no threats but a bunch of warnings. I did not read all of them but several seemed to be cookies. i told avg to repair them. after that my compy sorta froze up so i restarted it, and now it is not working. every time i try to open something it doesn't know the file extension and can't, even if i go to the root directory i still can't. if i try to get into a core function like add/remover programs or system restore it says that it can't open "rundll32.exe" and asks me to find the program to open it. I really can't afford to just wipe my computer and would be very great full for any help you could give me, if you need more info let me know.

Answer
Hi Patrick

It does sound like a worm has messed up your registry.  Let's first try to see what we're dealing with.  Reboot your computer in Safe Mode by doing the following :

 * Restart your computer
 * After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
 * Instead of Windows loading as normal, the Advanced Options Menu should appear;
 * Select the option to run Windows in Safe Mode with networking, then press Enter.
 * Log in to your regular account.
 
Next, please download TrendMicro HijackThis! from the following link:
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
* Save HJTInstall.exe to your desktop.
* Doubleclick on the HJTInstall.exe icon on your desktop.
* By default it will install to C:\Program Files\Trend Micro\HijackThis.
* Click on Install.
* It will create a HijackThis icon on the desktop.
* Once installed, it will launch Hijackthis.
* Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
* Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into a follow-up here.

Brian