Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't run any programs at all


  • Please log in to reply
8 replies to this topic

#1 lorenmcc

lorenmcc

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:38 PM

Posted 22 December 2011 - 05:13 PM

I am trying to help a friend get his computer back in service. He claims that the other day he had just clicked on a video of something to do with a car that had the heading "Wait until you see this" or something like that. He said the video started then the screen went blank and the computer rebooted. After the reboot nothing will run, except a few basic games. I assume he has gotten some form of malware, but I have no identifying characteristics.

This is a Windows 7 system.

Here are the symptoms:

- no program will start, we can try to start any program by any method (double click on the desktop icon, from start menu, from the physical location on the drive, etc.) and it seems like it is about to start, but nothing happens.
- by no program, I mean absolutely no program except some of the windows system programs. I cannot run IE, Firefox, Ad Aware, Malwarebytes, AVG, Spybot, CCleaner, etc. so I can't get to the internet or run any scanners
- Task Manager, regedit and all of the windows system programs that I tried will run.
- I can't run anything from any drive, including flash drives, although the I have not really tried to run anything from the CD drive.
- there is no error message, the programs just terminate
- I tried rebooting into safe mode with the same results
- In safe mode, with task manager up, I can see the programs actually start and show in the processes list, then they go away after 5 or 10 seconds (I do not see this behaviour in normal mode).

Any Help with this one appreciated

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,907 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:38 PM

Posted 22 December 2011 - 10:37 PM

Some malware infections will alter file associations and registry keys corresponding to them so programs will not work properly. In order to get them working again this modification needs to be repaired. This is a small tool that restores the default exe association.

Please download ExeFix.reg by Farbar for all versions of Windows and save it to a USB flash drive or to the root of the system drive (usually C:).
  • Important! Boot your computer into the user account that is having trouble running exe files.
  • Either right-click on ExeFix.reg and click "Merge" or double-click on it and choose "Yes" to add it into the registry when prompted.

After that you should be able to run your programs.

CAUTION: This step involves making changes in the Windows registry. Always Create a New Restore Point and back up your registry before making any changes.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 lorenmcc

lorenmcc
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:38 PM

Posted 23 December 2011 - 05:13 PM

I did not have confidence that this would work and I was correct. The ExeFix.reg file did run and it did prompt me to merge the contents. Same behavior afterward.

I do not believe this is a file association problem. I can see the programs actually starting under processes in Task Manager, then they stop and then disappear. There are no error messages.

I believe there is a program running that is killing these processes.

I have screen prints of the processes in Task Manager (paint works) available if needed.

Thanks,
lorenmcc

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,907 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:38 PM

Posted 23 December 2011 - 05:26 PM

Please download RKill by Grinler and save it to your desktop.
There will be a list of RKill download links using different file extensions and renamed versions. Read the comments which explains why they are offered. The iExplore.exe version is generally more effective but you may want to download more than one version before proceeding.

  • Double-click on the Rkill desktop icon to run the tool.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, and try another version.
  • If it still does not work, repeat the process and attempt to use one of the remaining version until the tool runs.
  • Note: You may have to make repeated attempts to use RKill several times before it will run as some malware variants try to block it.
  • A log file will be created and saved to the root directory, C:\RKill.log
-- If you get an alert that RKill is infected, ignore it. The alert is a fake warning given by the rogue software which attempts to terminate tools that try to remove it. If you see such a warning, leave the warning on the screen and then run RKill again. By not closing the warning, this sometimes allows you to bypass the malware's attempt to protect itself so that RKill can perform its routine.

-- Some security tools may flag RKill as malware, especially when renamed to iexplore.exe, explorer.exe, winlogon.exe, etc because they have definitions in place that flag certain file names used outside their normal path. If you encounter such an alert when running Rkill, you can safely ignore it and continue to allow the program to run.

Important: Do not reboot your computer until you complete the next step.

Now try performing a Quick Scan in normal mode with Malwarebytes' Anti-Malware and check all items found for removal. Don't forgot to check for database definition updates through the program's interface (preferable method) before scanning and to reboot afterwards. Failure to reboot normally will prevent Malwarebytes' from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 lorenmcc

lorenmcc
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:38 PM

Posted 24 December 2011 - 12:36 AM

I have tried every version of rkill that I can find (including the ones at the provided link). They also exhibit the same behavior. I can see them start in the process listing and then terminate and no DOS box flashes.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,907 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:38 PM

Posted 24 December 2011 - 08:32 AM

Have you tried using Windows 7 System Restore to return to a previous state before the problems began? <- Check the Show other restore points box to see any restore older points that may not be listed.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 lorenmcc

lorenmcc
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:38 PM

Posted 24 December 2011 - 11:33 AM

yes. Tried System Restore and it did not help.

#8 lorenmcc

lorenmcc
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:38 PM

Posted 27 December 2011 - 04:34 PM

Any more ideas on correcting this, or am I just going to have to byte the bullet and wipe the drive and reinstall?

#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,907 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:38 PM

Posted 27 December 2011 - 06:32 PM

Please follow the instructions in the Preparation Guide For Requesting Help starting at Step 6.
  • If you cannot complete a step, then skip it and continue with the next.
  • In Step 7 there are instructions for downloading and running DDS which will create two logs.

When you have done that, post your logs in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the Malware Response Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. After doing this, it would be helpful if you replied back in this thread with a link to the new topic so we can closed this one.

If HelpBot replies to your topic, please follow Step One so it will report your topic to the team members.

Note: If you can produce at least some of the logs, create a new topic and explain what happened with those logs you tried to create but could not. If you cannot create any of the logs, then still post the topic and explain that you followed the Prep. Guide but were unable to create the required logs. Again, describe what happened when you tried to create them.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users