Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

all exe. files turned to LNK


  • This topic is locked This topic is locked
7 replies to this topic

#1 gerry13

gerry13

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 04 May 2012 - 01:46 PM

First of all, i don't know if my problem was caused by a virus but i think so..

Yesterday,i tried opening an image file that didn't open with windows photo viewer.However once,i chose another program,ALL exe files were somehow set to open with this program!!after searching at google,i applied a couple of registry fixes i found at windows7 forum in a topic with exactly the same problem.this only turned all the exe files to .lnk .i tried using other fixes but nothing worked.
I run a full scan with malware antimalware and found nothing and then another full scan with super antispyware which found 300 adware cookies and a trojan dropper/cvshost-fake.the programm removed all of the infections and another scan showed nothing,but the problem persists and now i can't even access control panel or any other programm...

I'm using windows 7 ultimate.
Any help is greatly appreciated!!

As boopme suggested,i created another topic and followed prep guide but i couldn't download DDS and get GMER to work so i used OTL by OldTimer!! here are the 2 files created by this programm:

Attached Files



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,764 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:09 PM

Posted 08 May 2012 - 08:49 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps.
===

Navigate to this page.
http://www.winhelponline.com/blog/file-asso-fixes-for-windows-7/

Download the .exe file in the list of extensions.

Run the file as suggested on the page.

Let me know if the problem persists.

#3 gerry13

gerry13
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 08 May 2012 - 09:42 AM

i followed the steps but the problem persists :(

#4 nasdaq

nasdaq

  • Malware Response Team
  • 38,764 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:09 PM

Posted 08 May 2012 - 01:00 PM

Are all of the .exe files now showing/having a .lnk extension?

Or are the files showing .exe.lnk as their extensions?

Looking at your OTL log I do see files with the .exe extension.

===

Please download and run this DDS Scanning Tool. Nothing will be deleted. It will just give me some additional information about your system.

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
Please note: You may have to disable any script protection running if the scan fails to run.

Please just paste the contents of the DDS.txt log in your next post. DO NOT attach the log.

If needed.
The scan will also create this Attach.txt log I would also like to see the content.
Please post it in a other post for my review, do not attach the file.

Posted Image

#5 gerry13

gerry13
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 08 May 2012 - 02:09 PM

the first link doesn't open,only create a new tab
on the 2nd i press the download button but it won't begin and on the final one i download the programm but it appears as an lnk file and i have to choose a programm t run it...

#6 gerry13

gerry13
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:09 PM

Posted 08 May 2012 - 02:35 PM

disregard me last reply!

i just downloaded and installed it however i can't run it since it's ana .exe file and computer takes it as an .lnk

#7 nasdaq

nasdaq

  • Malware Response Team
  • 38,764 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:09 PM

Posted 09 May 2012 - 08:49 AM

; Instructions: Copy and paste this text IN BOLD into a text editor such as Notepad.
;
; Save this text as Fix.reg. Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.

Windows Registry Editor Version 5.00

;File association fix for [.EXE] - Windows 7
;http://www.winhelponline.com/blog

[HKEY_CLASSES_ROOT\.EXE]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.EXE\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,\
00,2c,00,2d,00,31,00,30,00,31,00,35,00,36,00,00,00

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]
"HasLUAShield"=""

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runasuser]
@="@shell32.dll,-50944"
"Extended"=""
"SuppressionPolicyEx"="{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"

[HKEY_CLASSES_ROOT\exefile\shell\runasuser\command]
"DelegateExecute"="{ea72d00e-4960-42fa-ba92-7792a7944c1d}"

[HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers]
@="Compatibility"

[HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers\Compatibility]
@="{1d27f844-3a1f-4410-85ac-14651078412d}"

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.EXE\UserChoice]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.EXE\OpenWithProgids]
"exefile"=hex(0):



; Double-click on Fix.reg. When it asks you to merge the information to the registry click Yes.

On a Vista or Windows 7 operating system, right click the Fix.reg and run as Administrator. <---- important.

Delete the Fix.reg file when done.

How is it now?

#8 nasdaq

nasdaq

  • Malware Response Team
  • 38,764 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:03:09 PM

Posted 15 May 2012 - 10:33 AM

Are you still with me?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users