repair exe file extension after virus removal

Check this:

http://www.dougknox.com/xp/file_assoc.htm

No luck. I get: cannot import...  'error accessing the registry'

try via safe mode!

Jamesey1-- "'error accessing the registry'"  Does that mean you can download the DougKnox fix, but get that message when you try to run the fix?  
Did you see the Note at the DougKnox site
"If your EXE file associations are corrupted, it can be difficult to open REGEDIT, or to even import REG files.  To work around this, press CTRL-ALT-DEL and open Task Manager.  Once there, click File, then hold down the CTRL key and click New Task (Run).  This will open a Command Prompt window.  Enter REGEDIT.EXE and press Enter"  ?
Another reason could be that Registry does not think you have the permission to access it.
http://support.microsoft.com/default.aspx?scid=kb;en-us;308421&Product=winxp
http://www.windowsecurity.com/articles/Understanding-Windows-NTFS-Permissions.html

Rppgirl, no luck, after I right click and say install it says it can't run grpconv.exe

No luck in safe mode, can't open regedit either as it is regedit.exe.

jc, I get that message when I try to run the fix. I have been downloading these fix tools on another computer and copying them over via usb thumb drive if that helps.

I have scanned with malwarebytes with the drive slaved to another computer. After malwarebytes removed infections this file association issue started. I was hoping to run combofix on the drive if I can get exe straightened out.

jc i'm going to take a look at your link and post back

And fixing the.exes file associations as others have suggested also didn't work?

Did you try renaming MBAM twice?(one before saving the file and second after installation)
Do any of these work?


1.  Try symantec's Unhookexec.inf (probably won't work either)
http://securityresponse.symantec.com/avcenter/UnHookExec.inf
To run the program right click on the file and select Install.


2. Go to Start > Run > type in:

command.com

In the command prompt, type:

ftype exefile="%1" %*




3. Download this Inherit.exe
Drag the exe files that you are unable to run into Inherit.exe.(For example you can drag Combofix.exe into it)

Then wait for it to say "OK"


Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix




4. Can you check in the system32 folder if you have this file --> logevent.dll
 

thanks rpg, clarification, do i create a batch file with the symantec link.

I am able to get malwarebytes running and am scanning now and it is finding things.

I have downloaded inherit.exe. should I rename it to a .com to run it?

the ftype command comes back with an 'error while processing: exefile'

Jamesey1--Whether you use the DougKnox fix from the hard drive or a USB drive, you should first follow the instructions in the Note on the DougKnox website just above the list of file associations.
Is your last post directed to me?

The Symantec one, if using Firefox, just rightclick on the link and "save link as"
and save UnHookExec.inf (with .inf extension.

Or into notepad and save with .inf extension, then rightclick "install"

You don't need to rename the Inherit exe, sorry I forgot to include the link.
http://download.bleepingcomputer.com/sUBs/MiniFixes/Inherit.exe

You have already tried redownloading MalwareBytes and renaming the installer to installer.com and then after the installation you went and locate the mbam.exe and renaming that one to mbam.com as well right? and it still didn't run?
http://www.malwarebytes.org/forums/index.php?showtopic=23983

I'm going to put my original backup back on and try again.

At this point. inherit.exe won't run for the exe issue, malwarebytes wants to update but the update downloads a new version of the program and that is another exe and i've having trouble getting to where ever it puts its temporary file to change it.

the symantec crashes with errors on grpconv.exe.

I'll try again after putting my back up back on which was created before I had slaved the drive for clean up.

Ok, I redid the scenario from the original backup. I was able to download the new version of mbam and install and do a quick scan. Pulled out all sorts of things. On reboot I had exe's working again.

A few more scans, thorough, and the machine appears clean.

Sometimes I do not get desktop icons though. I am going to run combofix and see if that continues straightening out the issue.

combofix pulled a few more things out. Still no desktop icons though. I'm scanning through an alternate profile.

Can you attacht the Combofix log please so we can check t make sure it's clean. combofix doesn't automatically remove all bad files.

She's clean. Took a few attempts but through combofix and hijack this as well as the recommendations here it is all set. Many thanks.

In the end getting malwarebytes onto a new copy of the image made all the difference.