Solved Removed malware, now I can't start a program

mitchellb · Jun 25, 2011

So I became infected with some malware (the vista anti-virus malware). I removed it with MalwareBytes'. But now whenever I go to use a program it asks me to choose which program to open with. It does it with all programs.

richc46 · Jun 25, 2011

Welcome give this a try
Try to reset the exe and lnk (LNK) associations.
Default File Type Associations - Restore

mitchellb · Jun 25, 2011

Okay, now I have to say. At this moment I'm in my admin account, the standard account is the one affected by this. So how do I merge the file to take affect on the standard account?

mitchellb · Jun 25, 2011

Nevermind it's called a flashdrive. lol.

richc46 · Jun 25, 2011

Just follow these instructions as given in the tutorial

Click on the file extension type link listed below for the one that you wish to restore to default to download it's .zip file.

2. Save the .zip file to your desktop.

3. Open the downloaded .zip file, then extract the .reg file to the desktop.

4. Right click on the extracted .reg file and click on Merge.

Do it for .exe and .lnk

tom982 · Jun 25, 2011

As well as following the excellent advice that Rich is giving you, can you do the following for me please? Let's make sure the virus is gone

OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Once OTL has completed its first scan it will save notepad copies of the scans in the folder that OTL was started from. Unless set to produce an Extras log it will only produce OTL.txt in subsequent scans.

A copy of an OTL fix log is saved in a text file at

:\_OTL\MovedFiles
in most cases this will be C:\_OTL\MovedFiles

Please attach both OTL.txt and Extras.txt with your next post for me to analyse

Tom

mitchellb · Jun 25, 2011

Did as you asked. Here are the text files.

tom982 · Jun 26, 2011

Okay, I'm fairly sure there's no malware left. Here's your problem:

Code:

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.

If Rich is happy with this, I'll leave the rest to him - he is far more experienced than me and you'll be in better hands

Tom

Brink · Jun 26, 2011

Hello Mitchell,

Oh my, you got a nasty one. :shock:

According to that log, you will need to do the TIP under step 4 in the tutorial below first to fix .reg files. Afterwards, you need to download and merge the .bat, .cmd, .com, .exe, .hlp, .pif, .scr, and .txt options in the tutorial below to restore the default associations for these file extensions.

http://www.vistax64.com/tutorials/233243-default-file-type-associations-restore.html

Hope this helps,
Shawn

mitchellb · Jun 26, 2011

Thanks everyone, appreciate all the feedback from this nasty malware.

Brink · Jun 26, 2011

You're welcome Mitchell. We're happy to help. Were you able to get it all sorted out?

mitchellb · Jun 27, 2011

I assume all is well now, I want to ask: should I do another OTL scan and post up results?

tom982 · Jun 27, 2011

Yes, it can't hurt. You can never be too careful with malware

Tom

mitchellb · Jun 27, 2011

Ok here's the texts.

tom982 · Jun 28, 2011

Follow this tutorial to show both hidden and system files: http://www.vistax64.com/tutorials/86163-hidden-files-folders.html

Then go to C:\ProgramData and you should see a file called 5ck18628083b8y8gi4y3dlivvx1u4n7pkvj5y1.

Go to VirusTotal - Free Online Virus, Malware and URL Scanner and upload this file. Send me the link that it takes you to (the report of the scan)

Tom

mitchellb · Jul 2, 2011

Ok, here's the link. Please notify me if the link is incorrect.

VirusTotal - Free Online Virus, Malware and URL Scanner

tom982 · Jul 2, 2011

Okay that's fine. One last thing just to be sure, can you scan your computer with the ESET Online Scanner please:

Free ESET Online Antivirus Scanner

Upload the log for us upon completion

Tom

mitchellb · Jul 2, 2011

On the scan settings, should I mark both "Remove found threats" & "Scan Archives"?

Brink · Jul 2, 2011

Yes, it will take a bit longer, but it would be a more thorough scan.

mitchellb · Jul 2, 2011

Ok, now I'm having problems. Or at least I think. It's been over 2 hours and it got stuck at 49%. Or am I being impatient?

Solved Removed malware, now I can't start a program

Removed by request

My Computer

My Computer

Removed by request

My Computer

Removed by request

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

Removed by request

Attachments

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computers

Removed by request

My Computer

My Computers

Removed by request

My Computer

٩(͡๏̯͡๏)۶

My Computer

Removed by request

Attachments

My Computer

٩(͡๏̯͡๏)۶

My Computer

Removed by request

My Computer

٩(͡๏̯͡๏)۶

My Computer

Removed by request

My Computer

My Computers

Removed by request

My Computer