Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Worms.exe


  • Please log in to reply
8 replies to this topic

#1 whaledude

whaledude

  • Members
  • 44 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 20 December 2005 - 08:11 AM

Firstly if I am not in the proper forum I apologize as I did not see where else to post on this subject.

When I start my computer I get a Program not found error popup that is looking for the WORMS.exe with the following message, "This program is needed for opening files of the type 'Application' " The popup has 3 choices, OK, Cancel and Locate. After pressing cancel about 10 times the pop up finally closes only to reappear when trying to run applications and it does not matter which application Norton, Spybot, Adware, Hijackthis, it is on all applications. In fact it also appears when trying to open applications in Safe Mode. I tried Safe Mode to see if I could run Norton Anti Virus. The only thing I can do is start and shutdown the computer.

I am running Windows 98SE as an operating system.

Would very much appreciate any help you can offer on how to fix this problem.

Thanks,

Whaledude.

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,279 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:31 PM

Posted 20 December 2005 - 09:41 AM

Try running some online Virus scans:
[Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Insall ActiveX component]

Trend Micro Housecall Scan for Firefox
Trend Micro Housecall Scan for Internet Explorer
Panda ActiveScan

You can also try this:

Download the Sysclean Package from: http://www.trendmicro.com/download/dcs.asp
1. Create a new folder on drive "C:\" ("C:\New Folder") and rename it Sysclean.
2. Place the sysclean.com inside that folder.
3. Then download the latest Virus Pattern Files [lptXXX.zip] from:
http://www.trendmicro.com/download/pattern.asp
4. Extract the lptXXX.zip pattern file into the same folder you created for sysclean.com.
5. Close all open applications and DISABLE your current anti-virus software.
6. Open the Sysclean folder and double-click on sysclean.com to run.
7. It will take some time to complete. Be patient and let it clean whatever it finds.
8. Exit when done and re-enable your anti-virus program.

Note 1: You can run sysclean in Safe Mode.
Note 2: This tool generates a log file [SYSCLEAN.LOG] in the same folder when the scan is completed.

If that does not help then I suggest you read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log.

When you have done that, post a log in the HijackThis Logs and Analysis Forum, not here, for assistance by the HJT Team Experts.

Edited by quietman7, 20 December 2005 - 09:45 AM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 whaledude

whaledude
  • Topic Starter

  • Members
  • 44 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 20 December 2005 - 04:22 PM

As I mentioned in my original post I am not able to run any applications, including IE or Firefox or Hijackthis, in either Normal or Safe Mode. Whenever I try to open any application all I get is the popup error message file not found. Therefore I am unable to try anything you have suggested.

Based on the file the popup says is missing i.e. WORMS. exe, should I be looking to delete something in the registry that may allow me to run applications and try your suggestions.

If you are wondering how I have posted my problem, I am using another computer to connect to your site.

Also, I am not sure how to move this thread to the Hijackthis Logs and Analysis Forum, so would appreciate if you could do this.

Thanks,

Whaledude

#4 stidyup

stidyup

  • Members
  • 641 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:31 PM

Posted 21 December 2005 - 04:28 AM

I would suggest downloading the following files on your friends PC (put them on a CD/usb flash drive and then run/install them on yours, don't forget to download the Adaware and Spybot updates as well.

If you think you are infected submit a hijackthis log to the HJT Forum.

How to submit a hijackthis log

Download Hijackthis

Try running the following from safe mode (Getting to safe-mode) Sysclean you'll also need the virus template file from here lpt***.zip remember to extract the contents of the zip file into the same folder as Sysclean.com

or

DrWeb CureIT

or

KASFX which is powered by the Kaspersky AV engine, you will need internet access to update it. If you haven't got net access in safe mode, update it before you use it.

If your good with the command line also try Sophos Command Line scanner this command will scan all of your hdd's SAV32CLI.EXE -F -di -remove -dn -mbr -all -zip -p=avscanlog.txt and give you a log file to review afterwards.

Also try installing and running A2 Free and Ewido again run from safe mode.

I'd also run Spybot(Spybot Tutorial) and Adaware

If your using Win2K/XP run adaware/spybot from "safe mode with command prompt" If your using Win9x just run it from safe mode the command line options aren't needed..

At the C:\ prompt type the following:-

cd\
C:\progra~1\spybot~1\spybotsd.exe /autocheck /autofix
cd\
C:\progra~1\lavasoft\ad-awa~1\ad-aware.exe

#5 whaledude

whaledude
  • Topic Starter

  • Members
  • 44 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 23 December 2005 - 06:17 AM

I found that I have access to IE and was able to dowload Sysclean and run it in Safe mode. It found and deleted TROJ_PROCKILL.C, JAVA_BYTEVER.S and TRO_MIEWER.A from 581 different files.

After this I able to downloaded HIjackthis and RescueMe but I can not run the programs, I get the same popup File not found message looking for the WORMS.exe.

When I run "safe mode with command prompt" either Spybot or AdAware with the text you posted they do not run and on the next command line I get "operation has been cancelled"

Every time I try to run an 'exe' file I get this pop up message. Also it does not complete the start up when starting the computer. Programs like Zone Alarm, Norton for example to run at start up. I get the popup before the startup gets that far.

I can get to Windows Explorer by right clicking on Start and choosing Explore. I can not run regedit by choosing Start the Run.

What can I try next? Is ther any other info that you would need to help with this problem.

Thanks,

Whaledude

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,279 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:31 PM

Posted 23 December 2005 - 07:13 AM

Since you have Internet access did you perform any of the online scans? If not then I would perform them.

[Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Insall ActiveX component]

Trend Micro Housecall Scan for Internet Explorer
Panda ActiveScan
Ewido Online Scanner
Windows Live Safety Center Safety Center
BitDefender

If you can get Hijackthis to run afterwards, then post that log in the HJT forum as instructed previously.

Edited by quietman7, 23 December 2005 - 07:15 AM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 whaledude

whaledude
  • Topic Starter

  • Members
  • 44 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 06 January 2006 - 01:47 PM

Just got back from Xmas vacation and back to my problem.

I tried running, several times, Trend Micro Housecall Scan for Internet Explorer but once each scan started, about 5 minutes later the scan stopped because of an error encountered with IE.

I was able to successfully run BitDefender which found and deleted 6 files that were infected with a Trojan type virus.

After this I rebooted the computer only to find the same problem still exists so I started tooling around in Windows Explorer via right click Start / Explore and I believe I have found the problem but I do not know how to fix it.

In Windows Explorer when I go to View\Options\ and click the tab "File Types" I see that for the file type Application - Extension: EXE which normally opens with [EXECUTABLE]... on my system has been changed to opens with [WORMS.exe]. This must be the reason why I can not run any application. Also the Remove or Edit buttons are greyed out and not an option but I believe this is normal with this type of a file as it is a system file.

Will reloading Windows 98SE fix this or is there something else I can try.

If I can get to the point where I can run an application then I will be able run HiJackthis and submit a log.

Thanks again for any guidance.

Whaledude

#8 Mark_830

Mark_830

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:31 PM

Posted 08 January 2006 - 06:57 PM

Hey

Go to this website http://windowsxp.mvps.org/exefile.htm ...Download the program where it says "Alternately, you may download fixreg.com from Grisoft.com site and run it. This utility fixes the exefile association in the registry automatically.".....I had the same problem and this fixed it

Mark

#9 whaledude

whaledude
  • Topic Starter

  • Members
  • 44 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 10 January 2006 - 05:23 AM

Mark,

My problem with the pop up looking for Worms.exe is now FIXED thanks to your tip and link to http://windowsxp.mvps.org/exefile.htm

My computer seems to be running normally and I have now been able to run HiJackthis and I have posted a log in the HJT forum.

Thanks again to all for the help with this virus.

Whaledude




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users