Member Avatar for jaishankar

Hi frnds iam here after a loooooooooong time :jump: how ru guys:salute:

My problem is related with Autocad 2005, i will explain in detail

My internet cafe has 7 systems 6 clients and 1 server all of the has 2k professional loaded with almost same application. everything was fine but one day i noticed is when i opened a word document and closed it, it's icon automatically changed to some unknown the file format showed autocad script file. When i try to open it there is some type of codes in it no text. This happens in the server and when i opened the word files from client computers they too changed and also got deleted automatically. When i open them the icon changes and the file gets deleted.

I formated the server and loaded everything fresh but after installin autocad 2005 the same problem appeared icon changes no text in the file only codes and file gets deleted, But when i uninstall autocad the file gets to its actual format i.e. word and opens but still gets deleted. I know the icon changing is due to autocad 2005 but why it is getting deleted :confused: i also tried with autocad 2007 but icon still changes

Any solution for this plz help me guys

waiting for u replie

thanx in adv

  • 5 Contributors
  • 7 Replies
  • 133 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

This thread moved quickly from an icon/association mystery to a malware cleanup; useful observations were posted by , , , and . Below is a compact, practical checklist that fills gaps left by the replies: how to safely expose hidden originals, remove leftover startup references that produce "cannot find" errors, repair file associations and restore system integrity, and harden machines against reinfection.

First actions and safe triage: isolate affected PCs from the network and make a disk image before changes. Boot to Safe Mode (or use a clean rescue environment) and run a trusted scanner. To reveal files that malware often marks hidden/system, open an elevated command prompt at the root of the drive and run:

attrib -s -h -r *.* /s /d

This clears system/hidden/read-only attributes recursively so originals become visible again.

Remove persistent startup references and leftover errors: use a startup/autorun tool (Autoruns is recommended) to search for any entries pointing to removed or odd paths. Autoruns can remove entries safely; alternately inspect the Run keys directly:

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

Repair associations and system files: list associations with assoc and ftype and reset any that point to incorrect hosts. Run system checks:

sfc /scannow
chkdsk /f

If important files are missing, check Volume Shadow Copies / Previous Versions or restore from backups; if machines remain unstable, a full re-image is safer than chasing persistent rootkit behavior. For prevention, disable autorun for removable media, keep OS and AV definitions current, restrict user rights, and scan with a second engine or a rescue ISO before reconnecting machines. For startup cleanup, see Autoruns: Autoruns (Microsoft Sysinternals).

Recommended Answers

All 7 Replies

Member Avatar for jaishankar

not a single reply wat happen to this forum no body cares to reply

Member Avatar for jaishankar

.......................

Member Avatar for jbennet

sounds like autocad is associating itself with the wrong file extensions.

Member Avatar for MidiMagic

There is also the possibility that both pieces of software want the same file extension. I have had this problem before.

It happens because Microsoft keeps appropriating new extensions for itself without first checking to see if other software is already using those extensions.

Note: I hope you aren't making up your own file extensions, as DOS users used to do? You can't do that anymore. Microsoft Word files are limited to the .doc extension.

Member Avatar for jaishankar

i didnt get the required help:sad: were have the experts gone. But i figured out the problem:jump: the systems were infected with win32/vb.nhv trojan which hides the original file and creates a duplicate file with an extension scr and when we open the file and close it the duplicate file is being deleted were the original file is still in the system somewere hidden.

I changed my antivirus to Nod32 which found this virus hidden in c:/recycled with a duplicate files of system Ex. svchost.exe. smss.exe ctfmon.exe, spoolsv.exe

I scanned my system with nod32 antivirus in safe mode and deleted all the infected files now the system are working fine:jump:

Member Avatar for dream21

i had encountered a problem almost similar to yours when dealing with my word documents. thanks very much it's now fixed. the problem now is that after start up i find the following error "cannot find the file 'C:\recycled\SVCHOST.exe' (or one of its components). Make sure the path and file name are correct and that all the required libraries are available".

my machine is still slow as well as my internet access. it freezes after barely 20 minutes of working and i constantly restarts it after it freezes. could this be the cause. i am working on widows 2000 server. i also need urgent help pliz.


i didnt get the required help:sad: were have the experts gone. But i figured out the problem:jump: the systems were infected with win32/vb.nhv trojan which hides the original file and creates a duplicate file with an extension scr and when we open the file and close it the duplicate file is being deleted were the original file is still in the system somewere hidden.

I changed my antivirus to Nod32 which found this virus hidden in c:/recycled with a duplicate files of system Ex. svchost.exe. smss.exe ctfmon.exe, spoolsv.exe

I scanned my system with nod32 antivirus in safe mode and deleted all the infected files now the system are working fine:jump:

Member Avatar for gerbil

run HiJackThis
===download hijackthis:
-install it to a new folder alongside your program files and then rename the Hijackthis.exe to imabunny.exe.
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Then take a copy of your problem from your post above and start a new thread in Viruses n Nasties forum. Post the log there.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.