[gerryf]

OK, using the one with the command line that works

type the following, EXACTLY at the prompt

tasklist >> "%userprofile%"\desktop\tasks.txt

this will create a text file on your desktop showing all running processes. I would like to see what's going on in there.


Copy and paste the contents here so I can see if you have any trojans running.

[Advertisements]

Here it is:


Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 16 K
System 4 Console 0 212 K
smss.exe 768 Console 0 372 K
csrss.exe 840 Console 0 4,152 K
winlogon.exe 864 Console 0 1,216 K
services.exe 908 Console 0 3,932 K
lsass.exe 920 Console 0 1,380 K
svchost.exe 1064 Console 0 4,504 K
svchost.exe 1144 Console 0 3,968 K
svchost.exe 1180 Console 0 26,104 K
svchost.exe 1248 Console 0 3,064 K
svchost.exe 1384 Console 0 4,268 K
spoolsv.exe 1772 Console 0 4,504 K
ccEvtMgr.exe 1992 Console 0 1,668 K
HPConfig.exe 2028 Console 0 2,800 K
KodakCCS.exe 156 Console 0 2,728 K
mdm.exe 212 Console 0 2,664 K
Navapsvc.exe 176 Console 0 7,012 K
ScsiAccess.EXE 356 Console 0 860 K
SymWSC.exe 508 Console 0 3,140 K
explorer.exe 652 Console 0 23,352 K
alg.exe 1084 Console 0 3,332 K
firefox.exe 2128 Console 0 21,060 K
taskmgr.exe 2344 Console 0 1,440 K
cmd.exe 1656 Console 0 1,320 K
cmd.exe 560 Console 0 2,476 K
tasklist.exe 2064 Console 0 4,172 K
wmiprvse.exe 2624 Console 0 5,404 K

[Tyson83]

Here it is:


Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 16 K
System 4 Console 0 212 K
smss.exe 768 Console 0 372 K
csrss.exe 840 Console 0 4,152 K
winlogon.exe 864 Console 0 1,216 K
services.exe 908 Console 0 3,932 K
lsass.exe 920 Console 0 1,380 K
svchost.exe 1064 Console 0 4,504 K
svchost.exe 1144 Console 0 3,968 K
svchost.exe 1180 Console 0 26,104 K
svchost.exe 1248 Console 0 3,064 K
svchost.exe 1384 Console 0 4,268 K
spoolsv.exe 1772 Console 0 4,504 K
ccEvtMgr.exe 1992 Console 0 1,668 K
HPConfig.exe 2028 Console 0 2,800 K
KodakCCS.exe 156 Console 0 2,728 K
mdm.exe 212 Console 0 2,664 K
Navapsvc.exe 176 Console 0 7,012 K
ScsiAccess.EXE 356 Console 0 860 K
SymWSC.exe 508 Console 0 3,140 K
explorer.exe 652 Console 0 23,352 K
alg.exe 1084 Console 0 3,332 K
firefox.exe 2128 Console 0 21,060 K
taskmgr.exe 2344 Console 0 1,440 K
cmd.exe 1656 Console 0 1,320 K
cmd.exe 560 Console 0 2,476 K
tasklist.exe 2064 Console 0 4,172 K
wmiprvse.exe 2624 Console 0 5,404 K

[gerryf]

ok, interesting...one more svchost than expected, but nothing ugly is in evidence.

Let's move on to EXE associations.

Go here, download the EXE FILE ASSOCIATION FIX

unzip it and double click the REG file...when Windows asks if you want to merge the information into the registry, say yes.

Reboot.

See if the problem is fixed.

[gerryf]

http://www.dougknox..../file_assoc.htm

whoa, getting very tired

[Tyson83]

I did that but when I try and open the file I get:

Windows cannot open this file xp_exe_fix.reg - which is exactly my problem.

[gerryf]

using the command line batch from earlier, (black box) type

regedit at the prompt.

Now when regedit opens, select FILE > IMPORT from the top menu, and select the reg file you download.

It should merge into the registry.

Reboot. Fixed?

[Tyson83]

Ok, some programs seem to be alright but the rest of the programs are WinDVD icons.
For example if I click on iTunes the WinDVD player comes up and if I right click iTunes - open with - and select iTunes it opens but the icon doesn't change.

[gerryf]

Hey that's progress!

are these icons, or shortcuts, to the programs, or are they icons to files that are opened by certain programs?

One is a shortcut problem, and the easiest course is to recreate your shortcuts by finding the program, and RIGHT BUTTON dragging it to your desktop and choosing CREATE SHORTCUT.

One is as association problem, and is best fixed by right clicking a file, choosing OPEN WITH, then choosing CHOOSE PROGRAM, then selecting your preferred program from the menu and selecting the ALWAYS USE THIS PROGRAM check box.

[mschiff]

I am having the same problem. I tried the registry key fix for exe files and it did not help, though the one for batch files seemed to help. I can run either of your batch files.

I ran Spybot search and destroy, Ad-aware 1.05 and CA Etrust antivirus scan just before this happened. None of them found anything, so I did not delete anything. I reactivated Adwatch at that time (before I noticed the problem).

Maybe I can provide some additional information. Almost all programs can be run indirectly (i.e. not from the desktop or start menu shortcut). For instance, I can run Irfanview by clicking on a jpg file, but not from its .lnk files, or directly from explorer. I cannot even run a Windows XP install to do a repair, because the .exe file setup.exe will not run.

I have checked task manager and there is nothing nefarious running there.

I can run Internet Explorer from the desktop icon. If I click on other icons, I get a "Windows cannot open this file" error message. If I then choose to "Select the program from a list" and browse for the program (i.e. microsoft word), the program runs, but with a couple of errors in finding files). Simpler programs do run with this method without problems.

All shortcuts are displayed without the icon that they are associated with, and they show the .lnk extension that normally is not shown. I did not notice a .lnk fix on your website, is there one?

Thanks a lot for your help. This is a real mystery.

-- Martin

[mschiff]

One more thing. I ran your batch file fix from your website, and now batch files won't work any longer. Instead of the default "no association" icon, they now have the correct icon, but they don't run. I created one to try and run a system restore, but I can't get that to run either.

-- Martin

[mschiff]

I solved the problem as follows:

Restart the computer, press F8, choose safe mode with command prompt
log in as administrator,
navigate to C:\winnt\system32\restore
type RSTRUI.EXE at the command prompt
when the system restore program runs, choose a restore point prior to the problem
Shazam, you're back in business.

Wish I knew what was the cause though.

BTW, even booting into regular safe mode would not work. EXE files would not execute even there.

-- Martin