I had a fake xp defender virus, so I hooked my xp hdd up to my other computer and deleted it. I plugged the hdd back into it's normal computer, and when I go to open any program, a box comes up that either says the file cannot be found or it asks what program I'd like to open this with. For example, I might click firefox, and the os will come up with a list of programs to open it with, including firefox. I tried using a system restore point, but I can't from the desktop because I can only get as far as the control panel without having to choose a program to open with. I tried booting with safe mode, but after selecting safe-mode, the screen says all the files/pathways it's loading and freezes. I tried using msconfig to set a boot to safemode, but i need to specify what program to open it with.
I'm also quite sure I got the virus off of the system. When hooked up to my other computer, I scanned the drive with AVG, malware bytes, avast, Microsoft security security essentials, and ad-aware. It came up clean. I tried doing a system repair with the rescue disk and it went through just fine, but when it was done and I went to the desktop, the problem remained. I would just reinstall windows xp, but this is an oem model form 5 years ago and I'm not sure what the product key is. Any word on how to find it, or on how to solve my problem?
This is definity a symptom of these WinAntiVirus variants that have been floating around. While scanning your drive in another computer to remove viruses is a sound method, the problem is that the system registry of your infected drive does not get cleaned of the viral entries.
I use a MiniPE boot disc to run a system restore utility to be able to access the restore points. If you don't have this type of utility disc, you can also connect your hard drive back up to your clean computer as a secondary or usb drive and look in the Documents and Settings\All Users folder of your infected drive for suspiously named folders, particularly folders with names that consist of a string of numbers only. Delete these folders if you find them there (This is where I have been finding them lately, especially with the virus variant that keeps you from running programs).
If you do find such a folder (and delete it) you should then be able to put the drive back in your computer and restart. You should now be able to run system restore and other programs properly. I would suggest that you do run system restore and select a restore point that you know predates your infection by a few days.
I hope this works for you. It has been the most common resolution in my shop, but with so many variants of this Identity Theft virus out there I can't guarantee it will work for your infection. Best of Luck!