Solved

Virus Detrius: how to reset EXE files so that they open without the virus file ?

Posted on 2003-11-29
6
376 Views
Last Modified: 2013-12-06
Hi,

I was cleaning up an old Win95 system for my Dad and he had a couple of virus' on it. Removed these, but one of them had (presumably) set File Type *.exe to open with another program (presumably the virus).

I can see the entry on the registered file types entry, but for this item only, both the remove and edit are greyed out.

How do I delete this entry so that programs open normally ?

 (I can't run regedit - as it calls on the non-existant virus file)

Thanks
0
Comment
Question by:angruth
  • 4
  • 2
6 Comments
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
Ok Copy the following into notepad and save the file with the REG extension. Then go to where you saved it and double click on it.

REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
You might be able to get by with just doing this

Copy the following into notepad and save the file with the REG extension. Then go to where you saved it and double click on it.

REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
0
 

Author Comment

by:angruth
Comment Utility
CrazyOne -

I have only one complaint, I would have at least expected that I'd be answered in 30 seconds or less - to take a full minute is a bit much :-)

Seriously, that's amazing - most appreciated!

However, they were a bit smarter than me...of course they also set the *.reg file type to only open with the (now non existant) virus...any thoughts ?
0
Want to promote your upcoming event?

Is your company attending an event or exhibiting at a trade show soon? Are you speaking at a conference? Spread the word by using a promotional banner in your email signature. This will ensure your organization’s most important contacts are in the know.

 
LVL 44

Accepted Solution

by:
CrazyOne earned 500 total points
Comment Utility
Go to Safe mode and try it there

If that doesn't work then open Explorer and find regedit.exe and change the file extension to .com so now you have regedit.com. Then Open regedit and then go to the menu File > Import and import the .reg file.
0
 

Author Comment

by:angruth
Comment Utility
CrazyOne - outstanding!

Had to mess around a bit (safe mode didn't do the trick) and of course, reg, com, bat & exe were all reset, but got there in the end - thanks again!
0
 
LVL 44

Expert Comment

by:CrazyOne
Comment Utility
You are welcome :)
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now