Cannot access registry, msconfig, task manager

[Justin Jeffries]

I was able to hit CTRL+Print Screen... to capture a view of the registry
editor while it was on the screen for about .5 seconds. Luckily, the last
place I was navigating in the registry was the start-up programs... I found
that "AOL Instent Messenger" is starting up in the registry, and under data
it says "SAFZAYMG.EXE." I cannot find this file. Also notice that Instant..
is spelled InstEnt with an E... and it is spelled like that in the registry.
I attached a paint file of the screen shot so you can see what is starting.
Also, AIM keeps launching on its own and putting up this away message. OMFG
http://www.fals.net/UNREAL !!!! ... THAT IS THE LINK I CLICKED... Do not
click it.

 

[Guest]

Please see the following instructions.

Spyware/Virus Removal:
http://www.fixyourwindows.com/windowsxpsolutions.htm

Startup and Temporary Files Cleanup:
http://www.fixyourwindows.com/optimizewindows.htm

 

[Wesley Vogel]

bestfriends.scr is what you must've downloaded.

How to remove the "bestfriends.scr" AIM virus:
http://www.homis.org/removal.php

"Best Friends" AIM VIRUS REMOVAL
http://elon.edu/student/jaleman/BestFriends.htm

New Aim Profile Virus, link to virus in away messages
http://www.lavasoftsupport.com/index.php?showtopic=32998

Scroll way down to the bottom.
=============

Free online virus scans:

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php

Get Your AVG for free!
http://www.grisoft.com/us/us_dwnl_free.php

 

[Justin Jeffries]

Yes, you are exactly right. I remember it being called bestfriends.scr. I
will try what you have suggested. If it is ok, I will get back to you and
let you know if this fixed it. Thank you so much for your help!
Justin Jeffries

 

[Justin Jeffries]

Hello Again, I used the link http://www.homis.org/removal.php and it worked
perfectly. The only thing was that the infected file on my computer was not
YAHOOMSG.EXE. I used the same steps in the command prompt, but I typed in "
SAFZAYMG.EXE " because I found that that was the infected file for
bestfriends.scr. It seems that there are many different file names for this
virus. Thanks for your help!!

 

[Wesley Vogel]

Justin,

Glad you got it fixed. Be careful what you click on!

Also...............

Make sure of these settings and nothing will install without you
answering YES. (Except what may install as part of some other software.)
Don't click YES if you don't know/trust the source.

Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]

 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK

 Enable Install On Demand (Other)
Is part of the driveby downloading of unwanted programs. i.e. scumware.