How to fix not being able to run any .exe files

[Mark]

I've seen this before so I thought I'd make a thread this time, a very common issue I get landed with on a daily basis are viruses.

The issue is that whenever you attempt to run a .exe file it prompts you to select a program to use.

I got a machine in today, it wasn't slow, no popups, no fake programs, nothing too out of the ordinary.
The first thing I do when a machine comes in with a virus is boot it up into normal mode so I can see the extent of the damage, as above it seemed fine. I'd then normally boot into safe mode with networking and install and update Malwarebytes. Not possible this time, so I performed a scan off an Antivirus disc, (removed 19 infections), rebooted, same issue, so this time I simply renamed the mbam.exe to mbam.bat and ran it, installed, updated and scanned, remvoed 24 infections, reboot, same issue (cannot run .exes).

At first I tried the below registry changes, this however didn't work for me.


Method 1

Fixing the association settings using Registry editor

1) Start > Run and type Command

2) Enter the following commands
cd\windows
regedit

3) Navigate to the following key:
HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command

4) Double-click the (Default) value in the right pane
Delete the current value data, and then type:

Code:

"%1" %*

5) Navigate to:
HKEY_CLASSES_ROOT\.exe

In the right-pane, set (default) to exefile

6) Exit the Registry Editor.



Method 2

Simply download, extract and run this file. It's called exefix_xp.com
http://markwood.co.cc/donotdelete/fixes/exefix_xp.zip

[Drumm]

I tried running exefix_xp.com on my computer, but I still can't open exe files??????????????????????????????????????!!!!!!!!!!!ONE!!!!!!!!!!!!!!!!
It tells me I need to install champagne or something like that???????????? HELP!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[Pack3t SynAck3r]

Heh, I don't think exefix_xp.com dot com is going to work well on a post xp Winblows machine. It really sucks though when there is a registry link there that points to a file that doesn't exist on the searchable file system. An invisible .exe(that can't be deleted because of Unicode chars in the key, and permission issues) that always pwns everything you open.....

What on earth are you to do then? Oh ya, learn how rootkits work. Then you fuck them up.

[Mark]

Should we prepare ourselves in the expectance of a thread? I used this again today. 9:20 and I'm already working! MADNESS.