Syswin.exe, No Programs Work

[ScotchGuy]

So I downloaded Norton to help protect my computer. I thought I would go all out after getting a firewall. It said it found 3 trojans which were parts of my programs. It found one which is a known trojan (syswin.exe) the other was something called "Temp2" and the last was "Winampw.exe" which is just the execution file for Winamp, which is obviously not a trojan. It automatically deleted them all. So I rebooted my computer and a warning came up when I which read "This folder (program)(which didn't exist)must be changed to Program 1 or some programs may not work", so of course I clicked ignore.

I didn't know that by some they meant all. Now none of my programs work they're all looking for .exe files, even when I'm clicking directly on the .exe files it also does not have the option to look for the files it just has a warning and nothing else. My browser is the only program that actually works. Should I just reinstall Windows? Would that help? Does anyone know how to fix this in anyway with out reinstalling all of the programs, that's my very last resort.

Example of warning

---------------------------------------------------------------------------------------------------------------------
| C:\Program Files\Audacity\audacity.exe
---------------------------------------------------------------------------------------------------------------------
Windows cannot find 'C:\Program Files\Audacity\audacity.exe'. Make
sure you typed the name correctly, and then try again. To search
for a file, click the start button and then click search.
---------------------------------------------------------------------------------------------------------------------

[TheFiend]

Wow, you sure ****ed that up huh? Ok, did you download Warez? if you did than more than likely your pretty well screwed because...well you shouldnt use warez. alot of it has virii in it already. I think your best option at this point is to actually BUY an anti virus kit and a firewall. THEN, BEFORE you install the software, reformat your HD and reinstall the OS. Then install the firewall and then the Anti Virus, then do a full system scan....shit may want to boot with a floppy and disk/mbr to be safe. then update the software and then.. well, scan your system.

[cheyenne1212]

All I can say on this one is

Good Luck :)

[Jewish]

So you werent infected before you downloaded Norton or what?

[thehorse13]

Well like Fiend has pointed out, when you grab stuff from Edonkey, Kazaa and the like you are more than likely going to end up with a FuX0r3d copy of the program. As all of us know, a good install of Norton does not run around deleting WinAmp.

As for formatting, go for a low level format of the hard drive. Go to the Gateway2000 site and grab a copy of GWSCAN. Thow it on a boot floppy and then run it from the command prompt. Choose the option to "write zeroes to disk". This will do the trick. Once you do that, use FDISK to create your partitions, etc. Once that's done, throw your OS back on and you are good to go.

[Maestr0]

"which is just the execution file for Winamp, which is obviously not a trojan" Hmmmm.

Hint:

Trojan horse: 1. An *apparently harmless* program containing malicious logic that allows the unauthorized collection, falsification, or destruction of data. [2382-pt.8] 2. [A] program containing *hidden* code allowing the unauthorized collection, falsification, or destruction of information. [INFOSEC-99]

So, that bring us to here.
If you're using win2k or XP boot from the CD and repair the system files. That should get you up again although I would also HIGHLY recommend a clean install to avoid leaving any backdoors open.

PS. Winampw.exe is a Trojan called Optix Pro 10 alters registry here:

HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command
"winampw.exe %1" %*

[Tedob1]

change "winampw.exe %1" %*

to

"%1" %*

for future referance the cleaner from moosoft is a shareware trojan remover. after the trial period is up the registry monitor stays active and will stop any reg changes from happening without your approval....real nice feature.

[ScotchGuy]

Maestr0: Question, how exactly do I repair the system files? Do you mean reinstall to replace the system files, if so when I install Windows XP from boot up will it retain my settings and files and programs? I would back up my files, but of course my cd burning program will not run.

Tedob1: I would love to edit the registry, but not even then registry edit will run.

[Maestr0]

When you boot from the CD the setup program will detect your previous install. It will then ask if you want to repair it or continue installing new OS. Choose repair, when it asks if you have a emergency repair disk say no(I'm assuming you dont have one) then let it use the repair process. Leave all the options checked ( [X] Check blah-blah) This will copy the original XP system files over any changed ones but leave the registry intact(leaving your apps) Then clean all the trojans out then do this AGAIN (Insure system files are original) and check m$ for service packs etc. Although its possible to clean your system, its always a safer bet to go with a fresh install. Hope this helps.

-Maestr0

[ScotchGuy]

Argh, I wish I would have read that beforehand, I guess I need to work on my patience. So now I have two versions of Windows XP installed on my system and I can choose which one to but up in at start up. When I select boot from CD it gives me an option to delete my current partition which also happens to be my only partition. Would this be ok to do, I want to delete everything from my computer and start clean with a new install, would this do that without hurting my computer? Sorry for being so ignorant about this type of thing, I basically just want a way to delete everything and install XP all over again. Thanks in advance for your time.