[gdubau]

Norton detected adware but was unable to delete them. I went through their removal process for apropos and it went away. I renamed the others (cal3dmod.exe, carosoft.exe, eltupt.exe, nsvs.dll, nsvsvc.exe, picsvr.exe) and rebooted to see if things worked without them. I then noticed 3 things: 1) at srartup I had 21 WordPad windows opened instead of starting the programs, 2) any dbl-clich or right-click/open I did opened the appl with WordPad, and, 3) my browser was switched to Netscape.
I've reset all renamed programs but there's no change.

I typically run Mozilla Firefox, but now IE is all that will start. I noticed limeware on my desktop, which was probably loaded by another family user.

I can get Firefox going by getting an "open with" on an existing file and working past the error.

How do I get my apps to run? and remove whatever infection exists??

[Advertisements]

Follow the steps:

1) Click Start, Run and type Command (not same cmd, cmd won't run because it is an exe; Command is a com file)

Type the following and then press Enter after typing each one:
cd\windows
copy regedit.exe regedit.com (again as .exe wont work we are make a .com copy)
regedit.com

2) Navigate to and select the following key:
HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command
Double-click the (Default) value in the right pane
Delete the current value data, and then type:
"%1" %* [with quotes]
(ie., quote-percent-one-quote-space-percent-asterisk.)

3) Navigate to:
HKEY_CLASSES_ROOT\.exe
In the right-pane, set (default) to exefile.

4) Now .exe should be working. But, U might still have a trojan which caused the problem in the first place. Run a Virus Scan.
If U need help removing the trojan go to the Malware Removal Forum.

[darth_ash]

Follow the steps:

1) Click Start, Run and type Command (not same cmd, cmd won't run because it is an exe; Command is a com file)

Type the following and then press Enter after typing each one:
cd\windows
copy regedit.exe regedit.com (again as .exe wont work we are make a .com copy)
regedit.com

2) Navigate to and select the following key:
HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command
Double-click the (Default) value in the right pane
Delete the current value data, and then type:
"%1" %* [with quotes]
(ie., quote-percent-one-quote-space-percent-asterisk.)

3) Navigate to:
HKEY_CLASSES_ROOT\.exe
In the right-pane, set (default) to exefile.

4) Now .exe should be working. But, U might still have a trojan which caused the problem in the first place. Run a Virus Scan.
If U need help removing the trojan go to the Malware Removal Forum.

[gdubau]

Thanks, darth-ash. The default settings were already set at "%1" %* and at exefile...but under the .exe folder is a sub folder named "PersistentHandler". The data value for its default is {098f2470-bae0-11cd-b579-08002b30bfeb}.

This doesn't seem right to me and WordPad still opens my apps.

[darth_ash]

Download the the attached exe.zip file and unzip it.
Double-click on the exe.reg file to merge with registry.

Attached Files

•  exe.zip   790bytes   226 downloads

[gdubau]

The registry update has been unzipped and merged. I re-booted and still no change. Was there anything further to be done with that? What's my next step?

Thanks.

[gdubau]

Wondering if you have a next step? I can run Mozilla from my desktop by shift+rclick and using run as my basic account, but my applications still go to WordPad. I can't execute a backup or restore.

[gdubau]

darth_ash- When unzipped I only had the exe.reg file. Were there 4 other downloaded files included? I'm only able to start some applications by using the "run as" option of the right-click on some programs (mozilla) but mainly still directed to wordpad. What would you suggest as my next option? Thanks