What does "Error 42125" mean?

[TB303]

Oh god!

I've tried following the suggestions in your recent post,
and as I was about to install the software - I booted into safe mode and to my horror discovered that I can't RUN anything!

When I right click on icons I don't have the option of runing them...

I click on a file and it asks me what service opens .exe files! I try to run msconfig or Regedit and it won't let me... the Av also doesn't run...

please help, I won't be able to back up all the files like that!...

[FreewheelinFrank]

Hi TB303,

Have you been following Polonus's advice about explorer.exe?

http://www.thetechguide.com/forum/index.php?showtopic=17838&mode=linear

I guess you might have been editing the HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINOWS NT\CURRENTVERSION\WINLOGON\SHELL key and changed the name from Explorer green.exe back to explorer.exe?

You may have misspelled the name explorer.exe and it may not be starting.

Try manually starting explorer.exe this way:

http://blogs.msdn.com/jeffdav/archive/2004/07/22/191636.aspx

[TB303]

Frank,
many thanks for your help.

Eventually I tried and succeeded in installing windows to a different partition. #
the computer works like a charm now.

The first thing I did was windows update, enabled teh Windows Firewall and Avast and updated them all.

I wish to thank you very much mate,
you've been very helpful and knowledgable.

The only question I have now is about my old documents, both mine and my wife's (wife's more important ;-)) - are on C, also the rootkit was there and was always discovered in "C:\documents and settings" - so I want to import all those word and excel files, but make shure I don't "import" the trojan too...

Thanks!

[FreewheelinFrank]

TB303,

You're welcome!

These rootkit worm/Trojans are very nasty, I'm glad you found a solution.

I don't know anything about partitions. Can you scan the infected partition from the partition you are booting from?

There will be an .exe file in one of the folders, possibly /system32. This will be the nasty which was spawning the rootkit which avast! detected. avast! is not detecting the worm itself yet, but it will probably be added to the virus definitions within a few days. Unfortunately, as the rootkit was disguising the worm we can't learn the name of the worm without finding the malware file.

If you can read files on the partition, you could look for suspicious files: submit any to Jotti's scanner and delete if they are infected.

You should be safe copying documents, but my advice would be to quarantine them for a week or so if possible. By that time the avast!'s virus database should include this worm and protect you.

If you can scan the infected partition from the clean one and find and delete the worm, so much the better.

If you post a new topic, maybe somebody could help you with that question. I think this would be a good idea anyway: as I say, I don't know anything about partitions, but you're sure to get some good advice.

FF