Can not open the hard drives after removing Infostealer.Wowcraft

[besanushi]

Hello everybody!

I got a malware called Infostealer.wowcraft. I ran my Symantec antivirus and it seems that the virus has been removed. But... not totally removed. I can not open my hard drives(local discs) C: or D:. There are all the options on the right-click menu such as open or Explore but they do not function properly. The drive can not be opened. Instead of the content of the drives it appears an "Open with..." window. I can open the drive if i choose explorer.exe but it is not comfortable.

Does anybody know how can I resolve this problem?

Thank U

 

[linney]

See if there is anything here.

Easy File Associations for Windows XP

http://www.dougknox.com/xp/tips/xp_easy_file.htm

http://www.dougknox.com/xp/scripts/xp_folder_open.vbs

file association of shell folders
thread779-230572

 

[SirBlack]

Download the latest Symantec virus definitions using their Intelligent Updater (if necessary, boot in Safe Mode with Networking):

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007082811095848

Disable Sytem Restore so you don't re-introduce the virus to your system using this utility (disabling Sys. Restore wipes out all previous restore points).

Make sure Norton AV is set to scan all files & run a full system scan (preferably while in Safe Mode). Delete any files detected & reboot in Normal Mode; click OK on any warning messages.

Run regedit & back up your Registry Editor.

http://support.microsoft.com/kb/322756

Scroll to the following subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"load" = "[PATH TO DROPPED FILE]"

& exit Registry Editor. You may be prompted to reboot. If all is well, Enable System Restore & title it Post Virus Removal or something like that. The date of this restore point will automatically be appended to the file name.

If that doesn't work try booting in Safe Mode again to see if you have normal access to your HD's.

Bob B-)