Cant Run .exe files on Vista (Malware Infection) [Solved]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

2 Pages

1 2 >

Cant Run .exe files on Vista (Malware Infection) [Solved]

Options

jhedrixz View Member Profile	Sep 16 2009, 06:50 PM Post #1
Member Posts: 11 OS: vista	My sister was just playing at facebook game Yoville and an adobe flash installer pop out to update it, she downloaded and opened it.. next thing i know my computer cannot run any .exe files, regedit even my avg antivirus/ and the icon of my programs has changed. I can only run firefox. when i run an exe file a pop up box shows (cannot load rom <fake nes./mcs>) that what i remember.. I tried scanning w/ kaspersky online scanner today and found 2 infections and deleted the files (sorry i forgot to save the log file) And yet the problem still persist. after i deleted i tried running any program,the pop out window changed to.( open with - IE )or opening the task manager says(application not found) I may have worsen the problem My suspicion that it is the koobface virus, In advance thank you!

jhedrixz View Member Profile	Sep 17 2009, 01:13 AM Post #2
Member Posts: 11 OS: vista	i just read a post with the same problem from torthing(here is the url http://www.geekstogo.com/forum/exe-files-w...un-t249418.html ) i followed Essexboy advice.. downloaded the Kill(AVZ Antiviral Toolkit) and it did run found some viruses or worms..after i restarted it didnt fix the problem. Ive attach here the log files virusinfo_syscure.zip ,virusinfo_syscheck.zip virusinfo_cure.zip virusinfo_syscure.zip ( 24.48K ) Number of downloads: 7 virusinfo_syscheck.zip ( 23.12K ) Number of downloads: 7 virusinfo_cure.zip ( 6.81K ) Number of downloads: 7 I hope this could add info.. i still cant run my .exe files, I do not know what to do next, THanks!

Transience View Member Profile	Sep 17 2009, 05:18 PM Post #3
Unofficial Music Guru Posts: 2,354 From: Massachusetts, USA OS: Vista	Hello and welcome to Geeks to Go! I'm Dave and I'll be helping you out. Let's get started: Please go to the GMER Rootkit Scanner Download Site. Click on the Download EXE button. The file you are downloading will have a random name in order to circumvent the attempts of malware to block it from running. Take note of the name of the file (please don't change it), and then save it directly to your desktop. Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan. Double-click on the file you downloaded (Vista users please right-click it and select Run as Administrator). The program will begin to run. Caution These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised! If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click NO In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure that the "Show all" box is un-checked. Now click the Scan button. Once the scan is complete, you may receive another notice about rootkit activity, don't worry. Click Ok. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt" Save it to a location where you can easily find it, such as your desktop. Post the contents of GMER.txt in your next reply. Then: Please visit this webpage for download links and instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofix Click on any of the links at that website to download ComboFix. At the window that appears, please change the name of the file from ComboFix to cf.com. This name is important and must be exactly as I have given it to you here, including the .com file extension. After changing the name, click on the drop down menu for the box labeled Save as type: and change it to All files. Once you made these changes, save the file directly to your desktop. Return to the above link and continue with the instructions provided there for running ComboFix. Be sure that you read ALL of the instructions on that page carefully and follow them exactly. It is particularly important to disable all your protection programs before running ComboFix. If you need further help figuring out how to disable a specific program look here for instructions. Installing the recovery console if you're running an XP machine is another critical step. Although these prelimiary steps may seem unnecessary, by following the directions in that guide closely you give ComboFix the best possible chance at a successful run and minimize the likelihood of having serious problems occur after an attempted removal of malware. Once the program has finished running its log should pop up automatically, or if for some reason you lose it it can found at C:\ComboFix.txt. Please post the log's contents in your next reply. Cheers, Dave

jhedrixz View Member Profile	Sep 17 2009, 06:47 PM Post #4
Member Posts: 11 OS: vista	Hello Dave!! Thank you for the response.. The first scan you want me to perform would not work. When i right click on the program icon, i can't find the "run as administrator " or double clicking it it will prompt me with "run with" and an (IE icon is in the box) /same problem with the other exe files. I read the instruction from ComboFix and there is an instruction to turn off the antivirus software. I have avg8.5 and it wont let me turn off the resident shield when i tried saving the settings. the prompt says "This file does not have a program associated with it for performing this action. Create an association in the Set Associations control panel" Is it Alright to run Combofix.. I haven't tried it yet Thanks

jhedrixz View Member Profile	Sep 17 2009, 10:08 PM Post #5
Member Posts: 11 OS: vista	i tried downloading ComboFix i can change the file name to cf.com but i cant change the save as type to all files.

Transience View Member Profile	Sep 18 2009, 01:10 PM Post #6
Unofficial Music Guru Posts: 2,354 From: Massachusetts, USA OS: Vista	QUOTE i cant change the save as type to all files. What do you mean by this? Is the box greyed out? What happens when you try? Download FixSwen to your desktop. Right-click on it and select Install, and it will make some changes to your registry, nothing will appear to happen, this is normal. Once you've done that try GMER and CF again, if you are still unable to disable AVG go ahead and run it with AVG active. Cheers, Dave

jhedrixz View Member Profile	Sep 18 2009, 09:08 PM Post #7
Member Posts: 11 OS: vista	QUOTE (Transience @ Sep 19 2009, 03:10 AM) QUOTE i cant change the save as type to all files. What do you mean by this? Is the box greyed out? What happens when you try? On your ComboFix guide,1st changing its file name to cf.com and on the save as type bar there is no drop down menu. its just an empty box and it wont drop down. the box is greyed out and when i click it turns blue.. after downloading, tried running the program but it wont work.. it still ask "open with" prompt with an IE icon on the box inside the prompt. Sorry i cant give you any pictures for the details. I still cant open any programs such as paint.. I installed FixSwen and tried running GMER and ComboFix but with no avail.. It wont allow me to run it.. Thanks

Transience View Member Profile	Sep 20 2009, 07:43 AM Post #8
Unofficial Music Guru Posts: 2,354 From: Massachusetts, USA OS: Vista	Delete any copies of ComboFix you have now as well as the folders C:\ComboFix and C:\Qoobox if they exist. Then try this: Please download and save vistaexefix.reg to your desktop. Once it's saved, doubleclick on this .reg file and answer yes when asked if you would like to merge with the registry. Once that's done, please download and save a fresh copy of ComboFix named cf.exe if you are still unable to change the file extension. Then try to run it as detailed above and let me know how that goes. Cheers, Dave This post has been edited by Transience: Sep 20 2009, 07:50 AM

jhedrixz View Member Profile	Sep 20 2009, 06:33 PM Post #9
Member Posts: 11 OS: vista	When i run the vistaexefix.reg an error message prompts when i choose yes "cannot import, Error opening the file. There maybe a disk or file system error" Thanks

Transience View Member Profile	Sep 21 2009, 02:32 PM Post #11
Unofficial Music Guru Posts: 2,354 From: Massachusetts, USA OS: Vista	Looking better glad that worked, let's run some final checks. First we'll clean out your unnecessary temp files to speed up the scans: 1. TFC Please download TFC to your desktop. Save any work, then close all open windows. Double-click TFC to run it, and allow the process to complete, which should not take more than a couple minutes. You may or may not be prompted to reboot, if you are click "Yes" and allow the computer to reboot. Close TFC when it has completed. 2. Malwarebytes' Anti-Malware Please download Malwarebytes' Anti-Malware from here. Doubleclick (Vista users please right-click Run as Administrator) on mbam-setup.exe to install the program. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware at the end of setup, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select Perform Full Scan, then click Scan. The scan is different from the quick scan and will take a fairly long time to finish (you can leave it to run and go do something else), please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to restart. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab. Copy & Paste the entire report in your next reply. 3. Kaspersky Online Scan Kaspersky online scanner uses Java technology to perform the scan. Because your Java is out of date, we need to update it first so that the scan will run without issues. Update Java Please download JavaRa to your desktop and unzip it to its own folder Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions. Accept any prompts. A log will appear (JavaRa.log), DO NOT post this log, I have no need for it. Open JavaRa.exe again and select Search For Updates. Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer. Scan Follow this link to the Kaspersky WebScanner Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure the following is checked. Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply. So post back with the logs from MBAM and Kaspersky when you have them and give me an update on how the PC is running, and we should have you on your way . - Dave

jhedrixz View Member Profile	Sep 23 2009, 07:13 AM Post #12
Member Posts: 11 OS: vista	Hi Dave! Sorry for the late reply. Ive been busy at work.. I downloaded Malwarebytes from CNET, when i tried running it(Run as administrator) an error prompt appears [b]"The setup files are corrupted. Please obtain a new copy of the program"[/b] I tried re downloading the file from CNET, but with no avail. Thanks

Transience View Member Profile	Sep 24 2009, 01:05 PM Post #13
Unofficial Music Guru Posts: 2,354 From: Massachusetts, USA OS: Vista	Quick heads-up for you before we continue: I see you're using or have in the past used p2p software such as LimeWire. Although p2p programs are not usually malware in their own right, oftentimes malware is installed alongside them. Even if the program is clean, people often upload infected files to be shared using these programs, and it is very easy to end up compromising your PC. It's your decision about whether or not you use p2p programs, you don't have to remove them to be deemed clean and I'll still give you help if you want to keep them. It's just important that you're aware of the risks. If you want to continue using p2p programs that's fine with me, all I ask is that you not download anything from them until you're clean so we aren't taking steps backwards here. To remove p2p programs if you wish to do so, uninstall them from the Add/Remove Programs (it's Programs and Features in Vista) menu of your Control Panel. Don't worry about MBAM for the moment go ahead with Kaspersky. Cheers, Dave

jhedrixz View Member Profile	Sep 27 2009, 08:01 AM Post #14
Member Posts: 11 OS: vista	Hi Dave! Here are the log results from kaspersky online scan, Thanks -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: scan report Sunday, September 27, 2009 Operating system: Microsoft Windows Vista Home Basic Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, September 27, 2009 10:11:16 Records in database: 2927598 -------------------------------------------------------------------------------- Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ E:\ Scan statistics: Objects scanned: 109660 Threats found: 2 Infected objects found: 4 Suspicious objects found: 0 Scan duration: 03:24:22 File name / Threat / Threats count C:\Users\Michael T. Jadie\Desktop\Infected\2009-09-17\avz00001.dta Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1 C:\Users\Michael T. Jadie\Documents\dar\ARISP II-MIke-HTC files\PROGS\mbeam41.zip Infected: Virus.DOS.VCL.Crapper 3 Selected area has been scanned.

jhedrixz View Member Profile	Sep 27 2009, 11:22 AM Post #15
Member Posts: 11 OS: vista	I finally got MBAM running, here are the scan log results. but It didn't find the infected files from kaspersky, Thanks Malwarebytes' Anti-Malware 1.41 Database version: 2865 Windows 6.0.6001 Service Pack 1 9/28/2009 12:45:34 AM mbam-log-2009-09-28 (00-45-34).txt Scan type: Full Scan (C:\\|) Objects scanned: 210557 Time elapsed: 1 hour(s), 30 minute(s), 51 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 17 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cf5c6a80-c938-478c-bc8b-8d7b00788154} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Tumblebugs 2\Uninstall.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Users\Michael T. Jadie\Desktop\Game Installer\ReflexivePatch2009\FFF-ReflexV2.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal PC infected with viruses and can't run exe files or system restore 12	26 / 879	11th September 2009 - 03:08 PM abcxyz94 started - last by JSntgRvr
Virus, Spyware and Trojan Removal Malware/Spyware Problem... Can't Run ,exe files, System Restore, C	0 / 590	7th September 2009 - 11:09 PM mrmeadowlark1984 started - last by mrmeadowlark1984
Virus, Spyware and Trojan Removal Malware infection [Solved] 12	20 / 456	29th September 2009 - 07:16 AM immac started - last by BHowett
Windows Vista� and Windows 7� vista - need to re-install but cant run .exe	5 / 109	7th October 2009 - 05:04 AM -AaronJ- started - last by -AaronJ-