BleepingComputer.com: Ran DOS Program in XP until I hit some Malware

Greetings! Just cleaned up from the Windows restore virus. One of your techs helped me clean up the machine (1.7GHz running XP)and it's running great, with one exception: Since I bought this computer 8 or more years ago, I have used a quick launch icon that runs a nice little dos program called ACT! (which has served me very well for twenty years.) I'd click on it, it would open a window, and when I was done it closed the window.

MANUALLY, I can duplicate what USED TO happen when I hit that icon, as follows:

Start-> (I type) cmd

c:\Documents and Settings\My User Name> (I type) c.bat


c.bat is a batch file: that has always worked perfectly and it is still intact:
commands in it are simple:

cd\cat (this is an act directory)
actmouse (this is the command to run act)
exit (this is the command that closes the window when I'm done)


Only now, after the cleanup, I get an error message. I hit "ignore" and everything then procedes to run perfectly.


The error message is this:

c:\windows\system32\cmd.exe - c.bat
c:\Progra~1\symantec\S32EVNT1.DLL. An installable Virtual Device Driver failed Dll initialization. Choose 'Close' to terminate the application

Choices: Close / Ignore


But that was running it manually. I want that icon to work again...


However, something we ran in cleaning up the computer really changed the properties of the quick launch button. They look like this now


target: C:\Qoobox\Quarantine\C\WINDOWS\c.bat.vir

start in: %HOMEDRIVE%%HOMEPATH% ( think this is the same)


Here's the question: does anyone know how to make that quick launch button take me to the cmd prompt and and then run c.bat? I don't mind hitting 'ignore' each time it runs, although I'd prefer not to. Or can anyone suggest where to go to learn to create a new quick launch button? BTW, I noticed during the cleanup that the tech who helped me ran a text file from the desktop by naming it ".bat". I am wondering if this might be a solution.

Thanks.

From what I can tell, your antivirus program moved the batch file to the quarantine and changed the shortcut to point to it. You can either recreate the batch file, or go to the antivirus UI and restore the file (and set it to ignore the file during virus scans). Also, you'll want to set the shortcut's target to the location of the batch file.

Just an FYI: %HOMEDRIVE%%HOMEPATH% is by default C:\Documents and Settings\[insert username here]. (source)

This post has been edited by MadDawg: 23 June 2011 - 02:13 PM

Qoobox is created by combofix.
Did one of our malware folks ask you to run it?

The easies thing to do might be to just recreate the batch file & shortcut.

Thanks for the suggestions. I ran all the fixes, but the machine is purring like a kitten. Hasn't run this fast since it was new. It used to have a lot of trouble playing 720p AVIs, even with a new video card. Now it's even running some 1080s.

Back to the problem.It's too late tonight to work on it. Hopefully tomorrow.

Your other thread you did not get the instructions to remove all the tools to remove. I would send a PM to ask it to be reopened so you can do that.

Problem Solved!

Instead of trying to recreate the quickstart link, I just made a new bat file on the desktop using textpad. Save as "ALL FILES" and titled it c.bat. Dragged it into the quick start section.

Then I googled the error message. A suggestion here was to recreate the directory specified in the error message, download the dll, and insert it in the directory. Here's the link for the solution

http://forums.cnet.com/7723-6142_102-64327.html


Thanks for all the suggestions. (I'll double ck with someone on removing those tools I used after the virus.)

This post has been edited by Quadrillion: 01 July 2011 - 03:10 PM