Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion GroupsWindows VistaWindows XPWindows MeWindows 98Windows 95Virtual PCInternet ExplorerOutlook ExpressWindows MediaSecurity
Related Topics
MS Server ProductsMS OfficePC HardwareMore Topics ...

Windows Forum / Windows 95 / February 2004

Tip: Looking for answers? Try searching our database.

Nuked files

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Russ - 07 Feb 2004 01:22 GMT
Had to eliminate some system files to get rid of a worm.
Now I'm unable to run the machine. Can someone get me
copies of files32.vxd, cwbmidi.drv, and atikey32.exe?
Russ - 07 Feb 2004 02:38 GMT
>-----Original Message-----
>Had to eliminate some system files to get rid of a worm.
>Now I'm unable to run the machine. Can someone get me
>copies of files32.vxd, cwbmidi.drv, and atikey32.exe?
>.

Oops. No e-mail address.     rbell16@yahoo.com
Alan Edwards - 07 Feb 2004 02:44 GMT
They are not system files. I suggest you read the details on the worm
on your AV's web site and see what you have to do.

Files32.vxd is supplied by the rather old PrettyPark worm

...Alan

Signature

Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.win95.general.discussion, "Russ"
<anonymous@discussions.microsoft.com> wrote:

>Had to eliminate some system files to get rid of a worm.
>Now I'm unable to run the machine. Can someone get me
>copies of files32.vxd, cwbmidi.drv, and atikey32.exe?
anonymous@discussions.microsoft.com - 07 Feb 2004 03:04 GMT
It was indeed Pretty Park. Had apparently been in the
machine for more than a year when my mother asked me to
load her AV. It immediately deleted those files and now
the machine will not function. How about atikey 32.exe? Is
that possibly the necessary file?
Russ

>-----Original Message-----
>They are not system files. I suggest you read the details on the worm
[quoted text clipped - 9 lines]
>
>.
Alan Edwards - 07 Feb 2004 05:21 GMT
Here are some old notes on PrettyPark

I think it more likely you have not removed PrettyPark Worm correctly
as
this is not a Win9x file.

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=10175
An extract:
-------
Indications Of Infection
This program, when run, will display a "3D Pipe" screen saver and then
will copy itself to FILES32.VXD in WINDOWS\SYSTEM folder. It then
modifies the registry key value "command" located in the location:

HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open

from "%1" %* to FILES32.VXD "%1" %*. This in essence will cause the
FILES32.VXD to run during the execution of any exe file.
--------

If you cannot follow it all, here is the part in the Registry to be
changed back:

Make up a file from the lines below. Copy into a file called
exefix.reg
which should be created in Notepad. Do not retype, copy in case of
errors. The 1st line in the file is  the line REGEDIT4
The last line must be blank.
Make sure your mail or news reader does not add any spaces to the end
of a line.
Doubleclick to restore the association.

-----copy below this line exefix.reg------------
REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

---- end file above here

More information:
http://www.symantec.com/avcenter/venc/data/prettypark.worm.html

http://vil.nai.com/vil/virusRemovalInstructions.asp?virus_k=10175

Terminal Server Programs Do Not Run, System Cannot Find Files32.vxd
http://support.microsoft.com/support/kb/articles/q249/9/21.asp

"atikey 32.exe" or atikey32.exe"?
Atikey32.exe is valid for an ATI video card.
If it is a valid file, then reinstall, though I cannot see why that
would make the system inoperable and I suggest you look up
Please supply more details of what error messages you get and exactly
what you mean by "can't run the machine"

I strongly suggest you read your AV site or supply more details here.

...Alan
Signature

Alan Edwards, MS MVP W95/98 Systems

In microsoft.public.win95.general.discussion,


>It was indeed Pretty Park. Had apparently been in the
>machine for more than a year when my mother asked me to
[quoted text clipped - 17 lines]
>>
>>.
anonymous@discussions.microsoft.com - 07 Feb 2004 14:26 GMT
I'll give it a try. Thanks, Russ

>-----Original Message-----
>Here are some old notes on PrettyPark
[quoted text clipped - 79 lines]
>
>.
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.