Fiance's computer is down (Virus/Trojan)

[Meresgi]

Fiance just told me her computer went down, it got something from deviantart or Wowwiki that pretends to be an Antivirus software. She's gotten it before and a simple system restore + Malwarebytes run seemed to fix it. Now after I did a system restore I can't run ANY programs at all, I can't even run stuff from control panel due to an error telling me it's missing a .dll file.

Anytime I click on a program to run it the computer asks me what program I want to use to open it with. I.e I click on Malwarebytes to run it, I get a window asking if I want to use utorrent or MSpaint to run Malwarebytes.exe >.>

I tried booting up in safemode but I can't seem to figure it out. I hit F8, get a boot menu asking which device to boot from (Floopy/CD/HD) if once I select HD Windows XP just boots up w/o allowing me to select safe mode or anything.

windows system32 rundll32.exe application not found is the error I get if I try to run anything from control panel

[Crowort]

Try copying this into notepad and save as all files regfix.reg, then copy it onto her system right click and choose merge (or just double clicking should work)

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command]

[-HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command]

[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[-HKEY_CLASSES_ROOT\secfile]

It just returns some reg settings for .exe files back to default.

The next best option is to backup her stuff and reinstall (or run a repair install)

[Meresgi]

After a lot of googling I found a link to someone who had the same issue. They put up a link to http://www.dougknox.com/xp/file_assoc.htm so luckily we had a thumb drive to transfer it from my computer to hers and it worked. Hopefully it's all good for the time being, still no idea how she's getting there trojans from deviantart and WoWwiki.

[Crowort]

Yeah same thing I suggested.

It is fairly common for the malware to change it so when you open any exe file for it to run itself. When you remove it it can't run of course but windows still has the lines telling it too open it when a exe is run. I normally run this before I even remove the malware, so I can run removal tools.

BTW if you can't connect to the Internet on it now, it is because it changes the proxy settings. Just restore them to default and things will work fine.