pop up at log on

[Guest]

My system, Windows XP, v. 5.1 was just infected by the Trogan-Gema virus. It had created three files in my system: "nvid32.exe"," dx8compat.exe", and "pwroff.exe". I and Norton AV seem to have eliminated the virus but when I log onto my desktop I get a pop-up that says "Windows cannot find 'c:\windows\system32\nvid32.exe'. Make sure you typed the name correctly..." When I click "ok" I get another box that says "Could not load or run 'c:\windows\system32\nvid32.exe'. Make sure the file exists in your computer or remove the reference to it in the registry." When I click" ok" my desktop continues to load and everything runs just fine. When my wife logs onto her desktop she gets the same thing for the "dx8compat.exe" file. I, in my limited knowledge of computer systems, have concluded that the files are indeed gone operationally but there is a reference to them in the registry that needs to be deleted. I've searched the registry and carefully deleted the references to these files that I could find but I'm obviously missing something that pertains to log on. Any ideas out there?

 

[Bruce Chambers]

Greetings --

The removal of the Trojan apparently left some "souvenirs" in your
PC's start-up configuration.

Look in the C:\Documents and Settings\All Users\Start
Menu\Programs\Start Up and C:\Documents and Settings\username\Start
Menu\Programs\Start Up folders, and in the system registry, primarily
in the HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run keys.

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;310560


Bruce Chambers

--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

My system, Windows XP, v. 5.1 was just infected by the Trogan-Gema

virus. It had created three files in my system: "nvid32.exe","
dx8compat.exe", and "pwroff.exe". I and Norton AV seem to have
eliminated the virus but when I log onto my desktop I get a pop-up
that says "Windows cannot find 'c:\windows\system32\nvid32.exe'.
Make sure you typed the name correctly..." When I click "ok" I get
another box that says "Could not load or run
'c:\windows\system32\nvid32.exe'. Make sure the file exists in your
computer or remove the reference to it in the registry." When I
click" ok" my desktop continues to load and everything runs just fine.
When my wife logs onto her desktop she gets the same thing for the
"dx8compat.exe" file. I, in my limited knowledge of computer systems,
have concluded that the files are indeed gone operationally but there
is a reference to them in the registry that needs to be deleted. I've
searched the registry and carefully deleted the references to these
files that I could find but I'm obviously missing something that
pertains to log on. Any ideas out there?

 

[Guest]

Tried Bruce's suggestions...found and deleted 1 more file in registry but nothing in the documents and settings....and the problem persists.

 

[Sharon F]

Tried Bruce's suggestions...found and deleted 1 more file in registry but
nothing in the documents and settings....and the problem persists.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.gema.html