Registry is messed up

[HawkAgent]

When I started my computer, it was slower than usual, and after a few secs I noticed I had no start-button, no items in the taskbar when I run a program, also when I press the windows key, the menu appeared in the left upper corner, with no items except All programs.

screenshot:

I immedialty suspect I have a virus, so I downloaded Autoruns of sysinternals.com. Results:

Some vital dll paths has been changed to 3ds max file... I think that's why Windows is doing strange.

I tried to look on the internet how to solve this, but failed. Could someone help me please?

Edit: If I try the Jump to function of Autoruns I get the error: Autoruns was unable to launch Regedit

Edited October 23, 2005 by HawkAgent

[suryad]

Question: Is this a legal copy of 3ds max? Or is this pirated and thus possibly have some kind of virus in it that is using the name of 3ds max to hide itself from the user?

[ColdFusion200]

Question: Is this a legal copy of 3ds max? Or is this pirated and thus possibly have some kind of virus in it that is using the name of 3ds max to hide itself from the user?

does he even have 3dstudio max at all? it possible that its just a virus, and its also possible that he does have studio max legit and it has been infected, which would explain why all the commands are the same thing

Edited October 23, 2005 by ColdFusion200

[gdogg]

yeh, seems like a virus to me, 3dmax doesn't run winace last time I checked

[HawkAgent]

Question: Is this a legal copy of 3ds max? Or is this pirated and thus possibly have some kind of virus in it that is using the name of 3ds max to hide itself from the user?

Does that really matter where the virus came from?

Yes I have 3dsmax, but I haven't touched that program for months, so I'm pretty sure it's not 3dsmax, but as I said, it doesn't matter where the virus came from, but how to fix it

Any ideas?

[ColdFusion200]

http://housecall.trendmicro.com/

[rjz]

He night nopt be able to use that. He might need to scan fromo a boot cd or something.

[suryad]

Does that really matter where the virus came from?

ROFL

Try checking in the registry for the name of the "wrong" process that is running and see if you can delete it manually from there if for some reason trendmicron online virus scan is not running. Also there is a free antivirus scan which is even better I think from panda av. It detected a virus a while back that the other engines missed on my comp Good luck

[HawkAgent]

I tried the AV, still scanning atm...

Try checking in the registry for the name of the "wrong" process that is running and see if you can delete it manually from there

Could you explain what you mean with that?

I tried looking the in registry (with another registry editor) in the "registryfolder" (HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved) where the paths were changed.

But when I came there I saw this:

What are those numbers (ex.: {07798131-AF23-11d1-9111-00A0C98BA67D})? Are those paths encrypted in 'computer language'?

If I just knew how I could change the paths of the DLL's which paths were changed by the virus I think the problem would be solved...

Edited October 24, 2005 by HawkAgent

[Takeshi]

Those numbers are CLSIDs and they should be there. When you install programs and add-ons they often have CLSIDs to register in the registry. If you actually look up individual CLSIDs in HKCR you will find out what they are.

So seeing them is neither here or there, it doesn't mean much to most people.

I don't think just looking at these will get you much further.

I would:

1. scan your PC with a virus scanner, whatever you have or online, if you haven't done so.

2. The Start button and taskbar is part of explorer.exe and this can be prone to errors, whether virus infected or not. So go to Safe Mode and see if the same happens.

3. Try creating another account and see.

4. Try the Taskbar Repair Tool (search Google).

5. If the above measures don't help then you do have some damage to the system whatever the cause.

Try fixing individual files and registry keys is a non-starter. You best bet is to salvage your data and format/reinstall.

Edited October 25, 2005 by Takeshi