All Programs act as if missing but are not

[motoxxx1389]

Ok this is really strange and I don't know where to start, so here goes. Last night I started downloading a mod for my battlefield game. It is 187 megabytes so i let it go over night. When I got home from work today I came to install it and noticed that my Norton scanned my harddrives like it does every week automatically. There were a couple "viruses" found but they aren't really viruses they are programs I have and know about. Anyways after I exited Norton I went to open the Mod installation and windows popped up an error saying that the program was missing. However it is sitting right in the directory I downloaded it to. Come to find out the same thing happens to my norton system works, my zonealarm, and even internet explorer, cmd from the run menu, and regedit from the run menu. I restarted my computer, nothing changed. I did find out however that I could type "command" and it would load up the command promp and from there I could launch any program I want including my firewall and iexplorer. That is how I am on this website right now. So does anyone have any idea what could have caused this? I have a reg backup from yesterday and I am thinking about importing it into the registry to see if anything happens. But I don't want to unless I have to. I am going to also try the System File Checker (sfc /scannow) and reverting anything that Norton did when it scanned my drives. I have looked through my logs for the firewall and in the event viewer and still nothing strange. Any help is greatly appreciated. Thank you. Oh yeah this does not only happen with the programs I mentioned but with lots of various applications, but all of my zipped files with winzip seem to work fine. Very strange....


My specs:
Windows Xp Pro Service Pack 1
Verizon Dsl directly to dsl modem (no network involved)
all latest drivers and updates

 

[linney]

311446 - You Cannot Start Programs (.exe Files) When Your Computer Is Infected with the SirCam Virus

http://support.microsoft.com/default.aspx?scid=kb;en-us;311446&FR=1&PA=1&SD=HSCH

 

[idanraz]

Linney got it right!! you have the sircam!!
I had this one a few monthes ago.
You can get the removal tool at:

http://www.symantec.com

Good Luck


Nick Mualim

 

[motoxxx1389]

Thank you for your help guys. It turns out that I did have a virus on my computer. I don't know if it was the sircam though, but it was probably just a variant with a different name. The file was called winampw.exe. I have never had winamp on my computer before and it was located in my windows directory. And sure enough according to the Article it had me browse to Hkey_classes\.exe in my reg and it said if there was anything besides "%#%" (something like that) I had a virus and before that line There was winampw.exe as soon as I edited that entry to just be the symbols all of my programs opened up just fine. As I looked into the situation further I found out that someone actually gained access to my computer. I do not know how because the managed to bypass my firewall (however I had about 50 pings from this particular computer before the event log was mysteriously shut off) and another wierd thing was I went into MMC to view the Event Viewer and at about 3:30 in the morning (around the same time the firewall quit logging) The event viewer service was stopped, then started again around 4 the following afternoon when I got home from work. Thanks for the help my problem is now solved.

 

[Bobg1]

You probably don't have your firewall setup properly. If its a default setting, it is definatly not set right.
There are sites ( don't have the url handy) where you can actually probe yourself to find where the holes are.

 

[shmoes]

http://www.grc.com

is a nice site for that

shields up

~Shmoes

I lay claim to nothing and everything. My words may be wisdom or disaster. In the end you make a choice. Noone is perfect.

 

[linney]

Plenty of hits at Google on WinampW.exe -

http://www.google.com/search?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=winampw.exe

http://groups.google.com/groups?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=winampw.exe

 

[motoxxx1389]

Thank you very much guys. I will look into the links on google and I will also probe my computer to see sif any ports are open. I have Zone Alarm Pro and I have it set on stealth mode. And according to Zone Alarm all ports are monitored and nothing is let in or out without my permission. I will look into it though and post my findings. Thank you.