Start a Conversation

Unsolved

This post is more than 5 years old

H

8118

February 23rd, 2006 02:00

I can't open .exe files

The computer is loaded with spyware and other malicious files but in order to start working on them, I need to run several programs (ewido, adware, etc...) but I can't open these files. I don't know why but my computer is not opening .exe files and all the desktop items have lost their icon. I'm now running on safe mode to see if I could get anything done but it doesn't work.

5.9K Posts

February 23rd, 2006 15:00

Boot into Safe Mode and select Safe Mode with Command Prompt.  I am assuming you have XP if you have Win2000 then substitute winnt for windows in all of the commands.

copy \windows\regedit.exe \windows\regedit.com

regedit.com

This should bring up the registry editor.

Navigate to:

HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open

Navigate means find the

+HKEY_LOCAL_MACHINE

and click on the + in front of it to open the subfolders.  Look for Software in the subfolders and click on its + to open its subfolders.

Continue until you get to "command" then click once on it.  In the right pane you should now see:

(Default)

doubleclick on (Default) and a small window will open up.  Change the value in the window to exactly the next line:

"%1" %*

and then OK.

In words it's

 doublequotationmark percent one doublequotationmark space percent asterisk

While in regedit see if you have any of these and delete the bold part if you do:

  1. Navigate to and delete the subkeys:

    HKEY_CLASSES_ROOT\CLSID\{60371670-81B9-4d06-9C42-4DEC1AABE62B}
    HKEY_CLASSES_ROOT\TypeLib\{4947DDCC-D549-4D0B-9685-AA58B20E9642}
    HKEY_CLASSES_ROOT\Interface\{0B6EF17E-18E5-4449-86EA-64C82D596EAE}

  2. Navigate to the subkey:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

  3. In the right pane, delete the values:

    "SMSSU" = "%System%\SMSSU.EXE"
    "Tmntsrv32" = "%System%\Tmntsrv32.EXE"

    "ALGU.exe" = "%System%\ALGU.exe"
    "SPOOLSV32.exe" = "%System%\SPOOLSV32.exe"


  4. Navigate to the subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe

  5. In the right pane, delete the value:

    "Debugger" = "%Windir%\explorer32dbg.exe"

  6. Navigate to the subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplorer.exe

  7. In the right pane, delete the value:

    "Debugger" = "%Windir%\iexplore_dbg.exe"

If you find any of these then when you finish with regedit, close regedit and type:

 

cd \windows

del /f iexplore_dbg.exe

del /f explorer32dbg.exe

cd system32

del /f SMSSU.EXE
del /f Tmntsrv32.EXE
del /f ALGU.exe
del /f SPOOLSV32.exe"

(If you have hijackthis.exe in the folder we recommend then)

cd \hjt

hijackthis.exe

(Do a scan and save log and then save the log to \hjt so you will know where it is.)

(if it won't run then)

copy \hjt\hijackthis.exe \hjt\hijackthis.com

hijackthis.com

(If hijackthis is on a floppy then)

mkdir \hjt

copy a:\hijackthis.exe \hjt\hijackthis.com

hijackthis.com

(best to save the log back to a:\ just in case you still can't use the computer)

Reboot into regular mode (ctrl + Alt + Delete and select Shutdown) and see if things look better now.  If you were able to run hijackthis then post the log as a reply.

 

Ron



 


 

 
 

2 Posts

February 27th, 2006 02:00

wow, I need to do that but none of what you type makes any sense to me.

5.9K Posts

February 27th, 2006 18:00

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the Safe Mode with Command Prompt option.  Login in as administrator or your usual login.  (Unless you have set it the administrator usually does not have a password)

 

Then see if you can type the stuff I told you to type.

If you don't understand what to do then ask but please ask specific questions.

 

Ron

No Events found!

Top