System32.exe Virus

[Ryan]

I had a virus in System32.exe. I couldn't fix,
quarantine, or delete it. So I was reading some
information, and I Ctrl + Alt + Deleted and ended the
System32.exe process. Then I ran Norton, and it either
fixed it or quarantined it, I don't remember. But now
when I log on, it says "Windows cannot
find 'C:\WINNT\System32\System32.exe'. Try searching for
the file." or something like that. Any ideas on how to
make that stop or what to do?

Help very much appreciated.
Thanks in advance,
Ryan

[Bruce Chambers]

Greetings --

You don't want that file. System.exe _is_ the worm; it's certainly
not a valid WinXP system file. Pay particular attention to _all_ of
the removal instructions:

W32.Kwbot.C.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.kwbot.c.worm.html


Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
----
You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH


"Ryan" > wrote in message
...
> I had a virus in System32.exe. I couldn't fix,
> quarantine, or delete it. So I was reading some
> information, and I Ctrl + Alt + Deleted and ended the
> System32.exe process. Then I ran Norton, and it either
> fixed it or quarantined it, I don't remember. But now
> when I log on, it says "Windows cannot
> find 'C:\WINNT\System32\System32.exe'. Try searching for
> the file." or something like that. Any ideas on how to
> make that stop or what to do?
>
> Help very much appreciated.
> Thanks in advance,
> Ryan

[Sir_George]

Ryan,

Visit the following site and read all of the information;
http://www.viruslibrary.com/virusinfo/I-Worm.Mari.htm

--
Sir_George


"Ryan" > wrote in message
...
> I had a virus in System32.exe. I couldn't fix,
> quarantine, or delete it. So I was reading some
> information, and I Ctrl + Alt + Deleted and ended the
> System32.exe process. Then I ran Norton, and it either
> fixed it or quarantined it, I don't remember. But now
> when I log on, it says "Windows cannot
> find 'C:\WINNT\System32\System32.exe'. Try searching for
> the file." or something like that. Any ideas on how to
> make that stop or what to do?
>
> Help very much appreciated.
> Thanks in advance,
> Ryan

[Alex Nichol]

Ryan wrote:

>I had a virus in System32.exe. I couldn't fix,
>quarantine, or delete it. So I was reading some
>information, and I Ctrl + Alt + Deleted and ended the
>System32.exe process. Then I ran Norton, and it either
>fixed it or quarantined it, I don't remember. But now
>when I log on, it says "Windows cannot
>find 'C:\WINNT\System32\System32.exe'.

System32.exe is not a legitimate Windows component - it *is* the virus.

So you do not want to replace it but to find the source of that message.
See Doug Knox's site, where he has advice on tidying up these things, I
don't remember precisely which one this is though.
www.dougknox.com


--
Alex Nichol MS MVP (Windows - File Systems)
Bournemouth, U.K.