Hi there,
I am having quite a major problem with Win2000 machine and can't seem to find a way to
troubleshoot it. long-short of it is that a user was tricked into installing what they thought was updates from Microsoft
which turned out to be a worm in disguise. Their system started acting funny, saying that It didn't have enough virtual,memory and that it needed to be increased. I did a virus scan using Norton Antivirus 2000 and it found a Worm, (Worm.Automat.AHB) on the system.
I attempted to repair the file with Norton under normal run mode but it could not clean or quaratine it so I
rebooted into safe mode, rescanned and got it. It showed up as "nggh.exe" so I deleted it.
Well from that point on I have not been able to run any application or basically do much with the system. Win 2000
boots up fine except it can't load systray and other TSR programs.
I get the following message every time I try to run any
application, "The program you are trying to run is not a valid 32-bit application". When I right click on My computer, Network Neighborhood, any desktop folders or try to run OS related functions like regedit or CMD or even notepad to check properties or use the control, I get "Access denied, you are not an administrator or have proper rights"; something to that effect. The odd thing is that programs like notepad won't run if I
click on its icon but if I click on a text\txt file it will load, same for
browser...will only load when I click on a link but not on its icon. I
can't run Norton to undo the damage. I searched the Win2000 database but found no
info on this. I tried repairing AND reinstalling WIN2000 over itself using the install cd's but
when I starttup the system I get the same error messages when I re-try to run\execute programs or access properties. Help!

Have you tried to log on as administrator?

Yes, it dosen't matter, I get the same results, simple user or admin, normal boot or safe mode.

Sounds like the swen worm thats been going around recently. I have had a LOT of customers bring in machines infected with this...

anyways, the big problem is that the worm associates it self with exe files (and reg, bat, com, pif.... etc) It also tries to disable the ability to edit registry settings.

If you go to:
http://vil.nai.com/vil/content/v_100662.htm

They have some details on the worm.

To fix the problems this worm created... you will need to download the fixswen.inf file from this page... right click, and choose install.

(Inf files are one of the few things uneffected by the worm, thank god)

Once that is done, you should be able to run executables again (cheer!)... But before you go to far... you need to download something to clean out the remaints of swen. Both Symantec and Network Associates Inc. have tools to do this... and I honestly can't tell you which is better. Synamtec releases individual tools for cleaning each worm, while NAI has a single tool (stinger) which gets updated to clean more and more worms.

Anyways, this should get you going again. =)