Registry Corrupt EXE

[karldenton]

OK.

Had a laptop that had XP Total Security 2011 spyware.

I read removal instructions and deleted the following reg keys

HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas\command

HKEY_CURRENT_USER\Software\Classes\exefile

HKEY_CURRENT_USER\Software\Classes\exefile\DefaultIcon

HKEY_CURRENT_USER\Software\Classes\exefile\shell

HKEY_CURRENT_USER\Software\Classes\exefile\shell\open

HKEY_CURRENT_USER\Software\Classes\.exe

HKEY_CURRENT_USER\Software\Classes\.exe\DefaultIcon

HKEY_CURRENT_USER\Software\Classes\.exe\shell

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open

HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command

HKEY_CURRENT_USER\Software\Classes\.exe\shell\runas

HKEY_CURRENT_USER\Software\Classes\exefile\shell\open\command

HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas

HKEY_CURRENT_USER\Software\Classes\exefile\shell\runas\command

 

 

I think I did it wrong though Got rid of the virus a different way but now no exe's will run. I can't even get into regedit to put the keys back.

 

Any ideas appreciated.. Will a repair windows work ? Don't really want to do a full re install as its a clients laptop

 

Thanks

 

Karl

[Arthur]

If you can get to Task Manager, the method described below should restore the EXE association.

 

http://www.raymond.cc/blog/archives/2008/01/06/fix-or-restore-broken-exe-lnk-com-association-caused-by-virus/

[tech_guy]

You haven't damaged your registry - it's the virus / malware that has done this. Yes, this and the carp like System Tool variants mess up your file associations to stop you running programs in attempt to remove them.

 

PITA

 

I've had three PCs this week where the file associations have been borked. Two I fixed using the site listed above and a batch file I found on another site. One had to be a Windows re-install as it was so jiggered.

 

I hate the people who are producing these nasties.

Edited March 6, 2011 by tech_guy

[Arthur]

You may also want to try the attached screensaver I made in AutoIt a few minutes ago.

 

Just run 'FixEXE.scr' on the affected machine and it will fix the default EXE file association by restoring the correct keys to the registry.

 

FixEXE.au3

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_outfile=FixEXE.scr
#AutoIt3Wrapper_icon=RegEdit.ico
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Res_Description=Restore default association for EXE files
#AutoIt3Wrapper_Res_Fileversion=1.0.0.0
#AutoIt3Wrapper_Res_SaveSource=y
#AutoIt3Wrapper_Run_After=upx.exe --best --compress-resources=0 "%out%"
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****

; http://www.autoitscript.com/forum/topic/68216-screensaver-udf/
#include <_SS_UDF.au3>

; Restore EXE file association
Select
Case @OSVersion = "WIN_XP"

	; Create screensaver GUI
	_SS_GUICreate()

	; http://www.dougknox.com/xp/file_assoc.htm
	RegWrite("HKLM\SOFTWARE\Classes\.exe", "", "REG_SZ", "exefile")
	RegWrite("HKLM\SOFTWARE\Classes\.exe", "Content Type", "REG_SZ", "application/x-msdownload")
	RegWrite("HKLM\SOFTWARE\Classes\.exe\PersistentHandler", "", "REG_SZ", "{098f2470-bae0-11cd-b579-08002b30bfeb}")
	RegWrite("HKLM\SOFTWARE\Classes\exefile", "", "REG_SZ", "Application")
	RegWrite("HKLM\SOFTWARE\Classes\exefile", "EditFlags", "REG_BINARY", Binary("0x38070000"))
	RegWrite("HKLM\SOFTWARE\Classes\exefile", "TileInfo", "REG_SZ", "prop:FileDescription;Company;FileVersion")
	RegWrite("HKLM\SOFTWARE\Classes\exefile", "InfoTip", "REG_SZ", "prop:FileDescription;Company;FileVersion;Create;Size")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\DefaultIcon", "", "REG_SZ", "%1")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shell\open", "EditFlags", "REG_BINARY", Binary("0x00000000"))
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shell\open\command", "", "REG_SZ", """%1"" %*")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shell\runas\command", "", "REG_SZ", """%1"" %*")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shellex\DropHandler", "", "REG_SZ", "{86C86720-42A0-1069-A2E8-08002B30309D}")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\PEAnalyser", "", "REG_SZ", "{09A63660-16F9-11d0-B1DF-004F56001CA7}")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\PifProps", "", "REG_SZ", "{86F19A00-42A0-1069-A2E9-08002B30309D}")
	RegWrite("HKLM\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page", "", "REG_SZ", "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}")

	; Screensaver text
	GUICtrlCreateLabel("Done!",5,5,100,20)
	GUICtrlSetColor(-1,0xFFFFFF)

	; Start screensaver
	_SS_Start()

Case Else
	MsgBox(48, "Unsupported OS", "This screensaver is not designed to run on this operating system.")
	Exit
EndSelect

FixEXE.zip

Edited March 6, 2011 by Arthur

[PiqueABoo]

I'll bite: Why a screen saver?

[localzuk]

I'll bite: Why a screen saver?

 

Because, if no exe's will run, a scr is executable and will still run.

[Arthur]

That's a very good question. There were a few reasons (localzuk mentioned the main one though)...

1. The EXE file association is broken so EXEs won't work. I'm going to assume that the malware doesn't touch the SCR file association. Perhaps it uses it itself so that it can still run?
   
2. RKill uses this trick so I thought I would do the same.
   
3. I learnt how to create a screensaver in AutoIt.
   

[Fraser-09]

Because, if no exe's will run, a scr is executable and will still run.

 

Wouldn't importing a reg file with the missing keys just work in the same way?

[Arthur]

.reg files are imported into the registry by regedit.exe.

[karldenton]

Thanks guys.

Got the reg file from Windows XP File Assocation Fixes in the end

Import of .reg worked ok

This virus's are really taking hold at the moment.

[alienbabe007]

Thank you Thank you!!! I just used Windows XP File Association Fixes and it worked so great, I am able to open everything and get rid of this virus. I tried the SCR file first but it didn't work. thanks everyone!

[zorvak]

Hi,

 

i have been a bit of a donut. My PC contracted the virus XP Security Update 2011 and so i did a bit of research on the net and having found something i thought would work I deleted a few registry files, only really HKEY_current_user Software Classes .exe .....i rebooted my PC, it seems to have done half the job in that this virus hasn't appeared, and if i try to load anything off desktop/start menu it loads. however all the software that usually loads when i boot up doesn't boot up any more, and i can't get on the net. Even weirder if i go into that same registry there is nothing under .exe

 

any ideas how to restore this? i am a real idiot for doing something i literally had no clue about...

[Fraser-09]

Hi,

 

i have been a bit of a donut. My PC contracted the virus XP Security Update 2011 and so i did a bit of research on the net and having found something i thought would work I deleted a few registry files, only really HKEY_current_user Software Classes .exe .....i rebooted my PC, it seems to have done half the job in that this virus hasn't appeared, and if i try to load anything off desktop/start menu it loads. however all the software that usually loads when i boot up doesn't boot up any more, and i can't get on the net. Even weirder if i go into that same registry there is nothing under .exe

 

any ideas how to restore this? i am a real idiot for doing something i literally had no clue about...

 

 

I'd start by taking the hard drive out the machine and connect it to a working computer (with updated antivirus!) using a caddy or dock. Then run a Malware Anti-Malwarebytes scan on the infected drive (remember to update malwarebytes after installing)

 

Once the scan has completed. Restart the computer. After the infections have been removed, plug the infected drive back into the original computer. Boot in safe mode, run another Malwarebytes (see HERE on how to install in safemode). You may need to change the mbam setup file from exe to com to install. Also, change the mbam.exe program file (located at C:\Program Files\Malwarebytes Anti-Malware\mbam.exe to mbam.com (as the virus has corrupted exe files.)

 

Now, run the EXE file association fix found HERE

 

 

And lastly, update and run a full system scan with your usual anti-virus.

 

 

 

Hope this helps.

 

Fraser

[zorvak]

I'd start by taking the hard drive out the machine and connect it to a working computer (with updated antivirus!) using a caddy or dock. Then run a Malware Anti-Malwarebytes scan on the infected drive (remember to update malwarebytes after installing)

 

Once the scan has completed. Restart the computer. After the infections have been removed, plug the infected drive back into the original computer. Boot in safe mode, run another Malwarebytes (see HERE on how to install in safemode). You may need to change the mbam setup file from exe to com to install. Also, change the mbam.exe program file (located at C:\Program Files\Malwarebytes Anti-Malware\mbam.exe to mbam.com (as the virus has corrupted exe files.)

 

Now, run the EXE file association fix found HERE

 

 

And lastly, update and run a full system scan with your usual anti-virus.

 

 

 

Hope this helps.

 

Fraser

 

Hi chaps,

 

Okay being a bit backwards technologically I didn't take my hard drive out as in your first step but I did download malware onto another pc and got it onto mine via a USB memory stick. So I think I have got rid of this bit of spyware. I ran that and then also ran my McAfee so I'm hoping everything a bit smoother now - and I can at least get onto the net now.

 

However a couple of things - first of all I haven't re-booted in safe mode and checked it. Second when I boot up now my PC says windows isn't checking for automatic updates - I can't change that either via control panel or the screen that pops up. And finally if I take all my data off this PC and onto a hard drive - music photos and a few docs - what chance is there that this virus comes with it?

 

Thanks