Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

exe files open in notepad


  • Please log in to reply
14 replies to this topic

#1 roshe

roshe

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 10:11 AM

Hi all. I'm in a bit of trouble. For some reason, all the .exe files I click on, open in notepad. Can't even run regedit. If someone can help, I sure would appreciate it. I'm not sure if I caused the problem or not. I had downloaded a couple programs to edit .pdf files, but uninstalled both using Revo Uninstaller. Thanks for any help and let me know if you need more information. Roshe



BC AdBot (Login to Remove)

 


#2 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,558 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:10 AM

Posted 08 February 2016 - 10:18 AM

Most likely something is goofy with file associations.

 

Save this as "fixEXE.reg" using Notepad, and double-click on it. Make sure it only has .reg, not ".txt.reg".

REGEDIT4

[-HKEY_CLASSES_ROOT\.EXE]

[HKEY_CLASSES_ROOT\.EXE]
@="exefile"
"CachedFilterIID"="{c3278e90-bea7-11cd-b579-08002b30bfeb}"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.EXE\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[-HKEY_CLASSES_ROOT\EXEFILE]

[HKEY_CLASSES_ROOT\EXEFILE]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\EXEFILE\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\EXEFILE\shell]

[HKEY_CLASSES_ROOT\EXEFILE\shell\/?]

[HKEY_CLASSES_ROOT\EXEFILE\shell\/?\command]
@="CMD /K \"%1\" %* /?"

[HKEY_CLASSES_ROOT\EXEFILE\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\EXEFILE\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\EXEFILE\shell\runas]

[HKEY_CLASSES_ROOT\EXEFILE\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\EXEFILE\shellex]

[HKEY_CLASSES_ROOT\EXEFILE\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\EXEFILE\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\EXEFILE\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\EXEFILE\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"

[HKEY_CLASSES_ROOT\EXEFILE\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}]
@=""

[-HKEY_CLASSES_ROOT\CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}]

[HKEY_CLASSES_ROOT\CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}]
@="Null persistent handler"

[HKEY_CLASSES_ROOT\CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\PersistentAddinsRegistered]

[HKEY_CLASSES_ROOT\CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{c3278e90-bea7-11cd-b579-08002b30bfeb}"

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#3 Kirbyofdeath

Kirbyofdeath

  • Members
  • 459 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Somewhere on Earth
  • Local time:09:10 AM

Posted 08 February 2016 - 10:26 AM

In case creating a .reg file is too confusing, I made the above code into a file for you.

Attached File  FixEXE.reg   1.88KB   3 downloads



#4 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 10:43 AM

Thanks for your post. I've tried the fix both ways and get this after running the reg file: "Cannot import C:\Users\Desktop\fixEXE.reg. Not all data was successfully written to the registry. Some keys are open by the system or some other processes." Any thoughts about that? Roshe



#5 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,558 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:10 AM

Posted 08 February 2016 - 10:48 AM

If you reboot, does the problem persist? Could be something else going on if nothing was fixed, I don't think I've had that registry import fail me before. You could try again in safe mode.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#6 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 10:48 AM

Can you tell me what should the exe files open with?



#7 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 10:55 AM

I just did a reboot and as it was starting up, several files opened in notepad, probably about 10 or so. Had to X them all out. Tried the reg file again and same results. I'll try it in safe mode now.



#8 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 11:14 AM

Same results in safe mode. As I was rebooting out of safe mode, 7 files opened in notepad, not 10. I guess there's no way to associate .exe files with a particular program.



#9 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,558 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:10 AM

Posted 08 February 2016 - 11:16 AM

Ya, it should just execute on its own through Windows, it isn't really associated with a particular program. I'll see if I can dig up my other tools for troubleshooting this issue. Usually the registry fix works. :\


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#10 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 11:25 AM

Thanks for your time  and effort. I've got rkill and combofix, but they are .exe files, so no go. Hope there's an answer somewhere. Thanks again for the help.



#11 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,558 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:10 AM

Posted 08 February 2016 - 11:32 AM

rkill should have other filetypes you can run it as, there is a .scr version for example.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#12 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 12:01 PM

I did some more surfing and found a file named exefix_vista.zip on another forum. A poster had the same problem I was having so I figured, what the hey. I ran the zip, which resulted in a exefix.reg file. Clicked it and seems like the problem is resolved. Got to do some more testing and rebooting before I'm convinced. I'll post the results, good or bad, after more testing. Thanks and I've got my fingers crossed.



#13 Demonslay335

Demonslay335

    Ransomware Hunter


  • Security Colleague
  • 3,558 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:09:10 AM

Posted 08 February 2016 - 12:14 PM

Ah, that could be a factor. I'm not sure the last time I've had to run this fix on Vista; maybe I never have. It is possible the registry changes I gave you might not apply to anything before Windows 7.

 

If you have luck with that one, mind posting a link? I'd like to see how it differs.


logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic]

ransomnotecleaner-25.png RansomNoteCleaner - Remove Ransom Notes Left Behind [Support Topic]

cryptosearch-25.pngCryptoSearch - Find Files Encrypted by Ransomware [Support Topic]

If I have helped you and you wish to support my ransomware fighting, you may support me here.


#14 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 08 February 2016 - 01:41 PM

Here's a link to the page with the fix: http://www.winhelponline.com/blog/file-association-fixes-for-windows-vista/  As you can see, there are several file types. I right clicked the exe square and saved the resulting zip file. Then extracted the exefix_vista.reg and clicked it and it worked. I also noticed from here, which is what lead me to the fix: https://www.reddit.com/r/techsupport/comments/1aekzf/i_accidentally_changed_all_exe_files_to_open_with/ the file you listed above as fixEXE.reg, was fixexec/ on this site. Don't know if they are supposed to be the same or not. So far I'm doing fine. Thanks and I'll check back here later to see if there's any updated information. Regards, Roshe



#15 roshe

roshe
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:10 AM

Posted 09 February 2016 - 12:21 PM

I've done enough to feel sure that I'm OK now. I'll consider my problem resolved. Thanks for being here to help. Roshe






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users