[iisupreme11]

Hi Pieter

Here is the log:

************************************
**These are the hidden files found**
************************************

Volume in drive C has no label
Volume Serial Number is 17D6-137A
Directory of C:\Windows\Desktop\Downloads

955,322,368 bytes free
************************************
**These are the system files found**
************************************

Volume in drive C has no label
Volume Serial Number is 17D6-137A
Directory of C:\Windows\Desktop\Downloads

955,322,368 bytes free

Regards

[Advertisements]

I'd like you to consider this:
http://malektips.com/98tww0019.html

Download for the software is here:
http://www.microsoft...g/nttweakui.asp

Let me know,

[Metallica]

I'd like you to consider this:
http://malektips.com/98tww0019.html

Download for the software is here:
http://www.microsoft...g/nttweakui.asp

Let me know,

[iisupreme11]

Hi Pieter

I installed the Tweak software, applied it but nothing changed, the shortcuts still show up as html pages and try to download a file when you doubleclick.

Regards

[Metallica]

Can you please rightclick one of these shortcuts and post the properties?

Regards,

[iisupreme11]

Hi Pieter

I have copied the properties to a word document attached.

Regards

Attached Files

•  shortcut_properties.doc   32KB   17 downloads

[Metallica]

Can you show me the second tab as well?

It looks as if the normal exe is on the desktop. Not just a link to one.
We did reset the properties and associations for .exe in the beginning, so it may be the desktop has some special properties.

As an experiment can you move blocks.exe to another folder, for example C:\Program Files
Then rightclick your desktop and create a real shortcut to the file in that location.

Let me know what happens when you activate the file through that shortcut.

Regards,

[iisupreme11]

Hi Pieter

I placed both tabs on the document. I also tried to re-create the shortcut but it had the same result.

The .exe for that program is not on the desktop.

Regards

[iisupreme11]

Hi Pieter

Click on the second page, the second tab should appear

regards

[iisupreme11]

Hi Pieter

I tried opening the original attachment and it didn't work, I will send it again.

Regards

Attached Files

•  shortcut_properties.doc   32KB   9 downloads

[Metallica]

It looks as if the fileassociation for the shortcuts has been altered.

Method 1 (not sure if this works for windows 98)

Open a DOS window and type this command:
ASSOC .lnk

The answer should be .lnk=lnkfile
If it is not use this command:
ASSOC .lnk=lnkfile

Note that above l is an L and not a capital i

Method 2

Click Start > Run > copy&paste regedit.exe /e C:\assoclnk.txt "HKEY_CLASSES_ROOT\.lnk >OK

That will create the file C:\assoclnk.txt
Post the content of that file.

Regards,

[iisupreme11]

Hi Pieter

Here is the assoclnk file details

REGEDIT4

[HKEY_CLASSES_ROOT\.lnk]
@="lnkfile"

[HKEY_CLASSES_ROOT\.lnk\ShellNew]
"Command"="RunDLL32 AppWiz.Cpl,NewLinkHere %2"

[HKEY_CLASSES_ROOT\.lnk\ShellEx]

[HKEY_CLASSES_ROOT\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{500202A0-731E-11d0-B829-00C04FD706EC}"

Regards

[Metallica]

OK. That doesn't look good, but since you are running Windows 98 please keep that file as a backup, in case we want your old settings back.

Copy the part in bold below into notepad and save it as restorelnk.reg
Set Filetype to "all files"

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}]
@="Shortcut"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32]
@="shell32.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\ProgID]
@="lnkfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\shellex]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\shellex\MayChangeDefaultMenu]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.ThumbnailExtract.Lnk.1]
@="LNK file thumbnail interface delegator"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Shell.ThumbnailExtract.Lnk.1\CLSID]
@="{500202A0-731E-11D0-B829-00C04FD706EC}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}]
@="LNK file thumbnail interface delegator"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}\InprocServer32]
@="C:\\WINNT\\System32\\thumbvw.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}\ProgID]
@="Shell.ThumbnailExtract.Lnk.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}\VersionIndependentProgID]
@="Shell.ThumbnailExtract.Lnk.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile]
@="Shortcut"
"EditFlags"=hex:01,00,00,00
"IsShortcut"=""
"NeverShowExt"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk]
@="lnkfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{500202A0-731E-11d0-B829-00C04FD706EC}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellNew]
"Command"="RunDLL32 AppWiz.Cpl,NewLinkHere %1"

[HKEY_CLASSES_ROOT\Shell.ThumbnailExtract.Lnk.1]
@="LNK file thumbnail interface delegator"

[HKEY_CLASSES_ROOT\Shell.ThumbnailExtract.Lnk.1\CLSID]
@="{500202A0-731E-11D0-B829-00C04FD706EC}"

[HKEY_CLASSES_ROOT\lnkfile]
@="Shortcut"
"EditFlags"=hex:01,00,00,00
"IsShortcut"=""
"NeverShowExt"=""

[HKEY_CLASSES_ROOT\lnkfile\CLSID]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\lnkfile\shellex]

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers]

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}]

[HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}]
@="Shortcut"

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32]
@="shell32.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\ProgID]
@="lnkfile"

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\shellex]

[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\shellex\MayChangeDefaultMenu]

[HKEY_CLASSES_ROOT\.lnk]
@="lnkfile"

[HKEY_CLASSES_ROOT\.lnk\ShellEx]

[HKEY_CLASSES_ROOT\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{500202A0-731E-11d0-B829-00C04FD706EC}"

[HKEY_CLASSES_ROOT\.lnk\ShellNew]
"Command"="RunDLL32 AppWiz.Cpl,NewLinkHere %1"

[HKEY_CLASSES_ROOT\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}]
@="LNK file thumbnail interface delegator"

[HKEY_CLASSES_ROOT\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}\InprocServer32]
@="C:\\WINNT\\System32\\thumbvw.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}\ProgID]
@="Shell.ThumbnailExtract.Lnk.1"

[HKEY_CLASSES_ROOT\CLSID\{500202A0-731E-11D0-B829-00C04FD706EC}\VersionIndependentProgID]
@="Shell.ThumbnailExtract.Lnk.1"



Doubleclick that file and confirm you want to merge it with the registry.

It may take a rebooty for the changes to kick in.

Regards,

[iisupreme11]

Hi Pieter

Good News

All the shortcuts are working properly again.

The only error I have now is the explorer message that comes up.

see the document attached.

Regards

Attached Files

•  explorer_details.doc   32KB   11 downloads

[Metallica]

Ok. On to the next.

EXPLORER caused an invalid page fault in module <unknown> at 0000:61b85cf6

The module <unknown> is a bummer.

I have seen the exact same address however once in a computer fromerly infected with CWS.
Can you follow the instructions here:
http://www.bleepingc...files/pfind.php
and post the pfind log

Regards,

[iisupreme11]

Hi Pieter

I am unable to download pfind.zip, the link apears to be down.

Regards