Solved

Virus Detrius: how to reset EXE files so that they open without the virus file ?

Posted on 2003-11-29
6
380 Views
Last Modified: 2013-12-06
Hi,

I was cleaning up an old Win95 system for my Dad and he had a couple of virus' on it. Removed these, but one of them had (presumably) set File Type *.exe to open with another program (presumably the virus).

I can see the entry on the registered file types entry, but for this item only, both the remove and edit are greyed out.

How do I delete this entry so that programs open normally ?

 (I can't run regedit - as it calls on the non-existant virus file)

Thanks
0
Comment
Question by:angruth
  • 4
  • 2
6 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9842668
Ok Copy the following into notepad and save the file with the REG extension. Then go to where you saved it and double click on it.

REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9842672
You might be able to get by with just doing this

Copy the following into notepad and save the file with the REG extension. Then go to where you saved it and double click on it.

REGEDIT4

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
0
 

Author Comment

by:angruth
ID: 9842717
CrazyOne -

I have only one complaint, I would have at least expected that I'd be answered in 30 seconds or less - to take a full minute is a bit much :-)

Seriously, that's amazing - most appreciated!

However, they were a bit smarter than me...of course they also set the *.reg file type to only open with the (now non existant) virus...any thoughts ?
0
Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

 
LVL 44

Accepted Solution

by:
CrazyOne earned 500 total points
ID: 9842735
Go to Safe mode and try it there

If that doesn't work then open Explorer and find regedit.exe and change the file extension to .com so now you have regedit.com. Then Open regedit and then go to the menu File > Import and import the .reg file.
0
 

Author Comment

by:angruth
ID: 9842777
CrazyOne - outstanding!

Had to mess around a bit (safe mode didn't do the trick) and of course, reg, com, bat & exe were all reset, but got there in the end - thanks again!
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9842797
You are welcome :)
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Recently Microsoft released a brand new function called CONCAT. It's supposed to replace its predecessor CONCATENATE. But how does it work? And what's new? In this article, we take a closer look at all of this - we even included an exercise file for…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now