Windows XP help, concerns trojan, rundll32.exe.

Well to start off, I was trying to get my sister a serial for photoshop then I downloaded a .exe I put my mouse over it, when I saw that it was .exe I had sense to not click it on purpose, but my computer froze so I was clicking everywhere, and I'm guessing I clicked on it....So it installed stuff I couldn't even cancel it, it was so fast. Then an error message saying that I may have spyware pops up, and when I click on it, it goes to malware-alert.com. Didn't download it or anything. I thought to myself, SHIT, I'm screwed. So I tried finding the .exe's that was installed. I searched for ".exe" in search. And also I looked in task manager for things not usually there.

I still can use firefox and all executables then, so I used google to look at the processes, and quickly found which ones to delete. I also searched ways to delete them, most talked of HiJAck and booting into safemode and using Autoruns to take them off, and others talking of using regedit. I deleted most of it, but there's 2 that I'm having problems with:

HTML:

csrssc.exe
There is one that WINDOWS uses, but there's 2 instances of this. One is in the "...\Local Settings\Temp" folder. While the other is in the "C:\WINDOWS\Temp" folder. Which do I delete? And how? Because I've tried deleting the first one with cmd.exe (problems with .exe, but that'll be later) and it says access denied, now I tried to use this command or whatever you call it, "attrib -r -s -h -a csrssc.exe" and it still says access denied.

cftmon.exe
This one is just in the C:\documents and settings\owner folder. But it keeps coming back. I don't know what it does or has done to my computer.

I've gone far without restarting, I deleted most of the entries except like I said those two, and a spools.exe(which isn't the windows spoolsv.exe). And again I still could use .exe files like firefox...Then I restarted, and I couldn't use it! It asks me which program I want to open it with! But I found a way around it by right-clicking and clicking on "Run as..." but firefox.exe wouldn't work with that, so I thought, I'll use Elitebrowse, oh was I thankful that it worked albeit slow. So, this time I restarted again, just to see what would happen, nada.

After restarting, I finally found and deleted the spools.exe. But again, I couldn't use firefox and all that. And so, I decided to check the registry, remembering that is something I read; to my surprise it said admin has disabled it! But I am, or am working on the admin account. Again, I tried regedit, and again, but with no satisfactory result. I try now to make a new user account, using cmd.exe but found I couldn't.

Then tried it on the Control Panel, and it says, cannot find rundll32.exe. So, I went to the laptop and searched it, found it, and when I searched using windows search it's there. But when I was on the folder, it wasn't really there, more like it says it's a dll that needs to be run as an application. Which I'm guessing is not right.

Before you guys suggest using SSD, already tried, all that came up are registry changes for Mcaffee Alert for Virusscan and Firewall. And tired to get Ad Aware installed, sadly it says again that I'm not admin, which I am. So, to make something that is long enough but I can make longer short....The problems I have are:

1. Rundll32.exe suposivelly not there.
2. Admin rights have been changed, even tho I'm admin
3. Regedit.exe is disabled by admin.
4. Double clicking .exe doesn't work, it asks which program to use.
5. Trojan or virus whichever does this.
6. Firefox starts process and just disappears.
7. Regedit.com wouldn't work
8. Msconfig doesn't work

What I need help :

• Getting Admin on an admin account.
• Regedit to be enabled
• A rundll32.exe
• Way to open .exe
• Delete the remaining programs.
• Install ad ad aware

.

 

http://www.sythe.org/showthread.php?t=411105

if nothing works then reformat

 

Thank you, that solves one. Doesn't solve the rest:'(

Plus I can't install because of that damned thing that says I'm not an Admin, even tho I'm on the Admin account(>.<)

 

I had something similar last year except my virus multiplied itself every mili second making it virtually impossible to fix.
However, you can go in to Safe Mode on windows Pc's. Try that and fix what needs to be fixed.

I also now use McAfee OAS for my anti-virus.

 

Well, I the folder options out, and I can now use regedit. But problem is it ain't there. I've tried to use regedt32.exe but the damned thing won't open. And I still can't open .exe, like Firefox. I've tried going into "Folder Options" and go "File Types", and typing exe and associating with Application. It shows up but when I close that window, it's still not there. And it is not doing anything, it's making me mad.


And I just did that right now in safemode, I used a program that's RRT to get folder options and regediting back. But still damned thing ain't there. And Rundll32.exe still isn't there....Anyone know an answer? And also by the way I have deleted the csrssc.exe it was hidden, when I got the Folder Options back, I found it...lol.