windows problem

[mindbullets]

my virus software recently found and deleted a worm that was on my pc but ever since ive had this message come up everytime i start it up. ' windows cannot find 'c:\windows\system32\cmd32.exe'.make sure you typed the name correctly,and then try again .to search for a file click the start button ,and then click search' it dissappears when i press ok and doesnt seem to be causing a problem.is there a way to fix this or am i stuck with it? thanks in advance

[lisaj]

Go to Start... Run... and type "regedit".
In the left hand pane, click on "My Computer" at the very top, and then do a search by hitting F3. Type in cmd32.exe and delete every reference to it in the right hand pane. Beware that editin your registry in this way is risky and if you're not sure about what you're doing you might want to just stick with the problem. However, it's not difficult to understand what the keys might do or mean, and therefore infer what the effect of deleting them might be. Good luck

[j2buttonsw]

Was the virus WORM_KWBOT.C? There is some info on how to fix the cmd32.exe on startup error here: http://www.trendmicro.com/vinfo/virusencyclo/defau
lt5.asp?VName=WORM_KWBOT.C but be warned it involves editing the registry. Alternatively, try running msconfig (start > run > type in msconfig then OK) and on startup unticking everything but registry scan and systray.

[mindbullets]

thanks for your replies ,yes it was the kwbot worm and ive done as lisaj suggests (regedit.etc..)and removed all reference to cmd32,exe and also removed the subkey "krypton"as it says on the page linked by j2. but still i get the same message on startup , the pc is still running ok.as for msconfig > startup .im not sure which ones are the systray and registry scan as it doesnt seem clear (to me),so im not sure which to untick/tick.

[lisaj]

If you've removed every reference that loads it up in the registry, there is only two other places: a hidden shortcut in your ctartup folder, and a RUN line within the system.ini file - the latter of these can be removed using msconfig.