Avatar of jsarinana
jsarinana
Flag for United States of America asked on

Removed a trojan off but now I'm getting "This file does not have a program associated with it for performing this action"

Looks like the registry is broken, This user got his laptop infected with the Rogue trojan, ran malwarebytes and reomved finfections. Now I have the "This file does not have a program associated with it for performing this action" issue.

Please advise
Thanks
Anti-Virus AppsAnti-SpywareWindows XP

Avatar of undefined
Last Comment
jsarinana

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
WalrusSoup

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
toroblanco2002

Please provide more details, What program or programs are you trying to open when you get that message? The more details you provide the better chances to get a solution. Thank you.
younghv

There are a lot of malware variants that could be called 'rogue trojans'.
Look through the list here and see if you recognize any of the names:
http://www.bleepingcomputer.com/virus-removal/

If you find it, follow the exact instructions as written by "Grinler".

You can also try the various menu options in "RogueKiller".
See my EE Articles at these links:

https://www.experts-exchange.com/A_4922.html (Rogue-Killer-What-a-great-name)
https://www.experts-exchange.com/A_5124.html (Stop-the-Bleeding-First-Aid-for-Malware)
https://www.experts-exchange.com/A_1940.html (Basic Malware Troubleshooting)

younghv

@WalrusSoup,
Probably best to post your Registry fix as a "Text" file and let the user view the instructions.
We've had some past problems with downloaded executables and .reg files.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
WalrusSoup

@younghv
Ok, thank you for letting me know. I assume that this is the proper registry fix since rogue trojans often replace the registry entry for opening .exe files so it, in fact, opens the virus once again. I will make sure to post the registry fixes in .TXT format from now on with instructions on how to save as a .reg.
younghv

:)
I'm a little paranoid about downloading anything, but if your file looks anything like what I attaching as "Code", it will be what I've been using for all of these variants.

BTW - Welcome to EE! We're always looking for a few good Experts.
Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.exe\shell]

[-HKEY_CLASSES_ROOT\.exe\DefaultIcon]

[HKEY_CLASSES_ROOT\.exe]
@="exefile"

[HKEY_CLASSES_ROOT\exefile]
"Content Type"=-

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
"IsolatedCommand"=-

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
"IsolatedCommand"=-

[HKEY_CLASSES_ROOT\.bat]
@="batfile"

[HKEY_CLASSES_ROOT\batfile\shell\open\command]
@="\"%1\" %*"

[-HKEY_CURRENT_USER\SOFTWARE\Classes\.exe]

[-HKEY_CURRENT_USER\Software\Classes\exefile]

[-HKEY_CLASSES_ROOT\secfile]

[-HKEY_CURRENT_USER\Software\Classes\secfile]

[-HKEY_CLASSES_ROOT\pezfile]

[-HKEY_CURRENT_USER\Software\Classes\pezfile]

[-HKEY_CLASSES_ROOT\sezfile]

[-HKEY_CURRENT_USER\Software\Classes\sezfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
@="firefox.exe"
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command]
@="firefox.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
@="iexplore.exe"

Open in new window

ocanada_techguy

I think this tool might do the same correction http://www.winhelponline.com/exefix_xp.com
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
jsarinana

ASKER
Thanks WalrusSoup
This is all I needed, worked like a charm