Cannot find system32.exe?

[Kenny]

"Windows cannot find 'system32.exe...'"
Get this message box on booting. I believe it was caused by software from a
dodgy source.
Have looked here:
http://support.microsoft.com/kb/833767
but none of those registry keys exist on this PC.
Have totally removed the suspect program together with any registry entries
referring to it.
Ran virus scan, both local and online, together with running AdAware &
Spybot. Also thorough disk cleanup with Window Washer, Clean Cache &
CCleaner.
Google points to being infected with W32.KWBot.C.Worm, saying it has only
been partially removed.
Also points to Kazaa and/or Imesh, neither of which have ever been on this
PC.
PC appears to be working normally apart from this and I don't think it's
infected. I have both software and hardware firewalls and up to date AV.
Using XP Pro/SP2 and all recent MS updates.
Any advice on how to stop this message appreciated.

 

[Frank Saunders, MS-MVP OE/WM]

"Windows cannot find 'system32.exe...'"
Get this message box on booting. I believe it was caused by software from
a dodgy source.
Have looked here:
http://support.microsoft.com/kb/833767
but none of those registry keys exist on this PC.
Have totally removed the suspect program together with any registry
entries referring to it.
Ran virus scan, both local and online, together with running AdAware &
Spybot. Also thorough disk cleanup with Window Washer, Clean Cache &
CCleaner.
Google points to being infected with W32.KWBot.C.Worm, saying it has only
been partially removed.
Also points to Kazaa and/or Imesh, neither of which have ever been on this
PC.
PC appears to be working normally apart from this and I don't think it's
infected. I have both software and hardware firewalls and up to date AV.
Using XP Pro/SP2 and all recent MS updates.
Any advice on how to stop this message appreciated.

run HijackThis; http://aumha.org/downloads/hijackthis.zip
HijackThis - Tutorial & FAQ;
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42

Register here: http://aumha.net/profile.php?mode=register
Once you have received your registration confirmation, post your HJT
log here: *(for expert analysis)*
http://aumha.net/viewforum.php?f=30
****NOT in this newsgroup!*****

Please see http://aumha.net/viewtopic.php?t=4075 and
http://aumha.org/a/quickfix.htm before posting to the forum.

HijackThis tutorial:
http://aumha.org/a/hjttutor.htm

 

[Carey Frisch [MVP]]

Remove remnants of KWBot.Worm from the Registry and File System
http://www.dougknox.com/xp/scripts_desc/xp_clean_kwbot.htm


Note: You'll have to disable your antivirus program before running the repair.


[Courtesy of MS-MVP Doug Knox]



--
Carey Frisch
Microsoft MVP
Windows Client

--------------------------------------------------------------------------------------------------

:

| "Windows cannot find 'system32.exe...'"
| Get this message box on booting. I believe it was caused by software from a
| dodgy source.
| Have looked here:
| http://support.microsoft.com/kb/833767
| but none of those registry keys exist on this PC.
| Have totally removed the suspect program together with any registry entries
| referring to it.
| Ran virus scan, both local and online, together with running AdAware &
| Spybot. Also thorough disk cleanup with Window Washer, Clean Cache &
| CCleaner.
| Google points to being infected with W32.KWBot.C.Worm, saying it has only
| been partially removed.
| Also points to Kazaa and/or Imesh, neither of which have ever been on this
| PC.
| PC appears to be working normally apart from this and I don't think it's
| infected. I have both software and hardware firewalls and up to date AV.
| Using XP Pro/SP2 and all recent MS updates.
| Any advice on how to stop this message appreciated.
|
| --
|
| Kenny
|
|

 

[Kenny]

Thanks Frank and Carey for the replies. Followed the advice here:
http://aumha.org/a/quickfix.htm
running AV, malware & general cleanup, this time in Safe Mode.
Also ran the VB Script here:
http://www.dougknox.com/xp/scripts_desc/xp_clean_kwbot.htm
System now appears to be clean, the message no longer appears at bootup.
Thanks again.