Annoying Issues after malware infection

Hey guys.

Link to help thread that got rid of my malware: http://forums.whatthetech.com/Bad_malware_…ion_t97550.html

Problem: After getting a nasty malware infection, my computer started acting weird. I'm not just talking about the typical problems like popups or my cpu under load. The first problem I had was my windows installer was messed up (now fixed). Now even after the malware is gone I cannot click any program in my start menu. Neither on my quicklist, or on my Programs list (excluding firefox and thunderbird in my quick list).

After I click a program, the start menu disappears but nothing happens. Not even a loading icon. Now when I install things, the program FOLDER is listed on the programs menu, but they're always empty.

Thanks in advance for the help, if you need anymore information please let me know.

You could try running the system file checker if you haven't done so already, you will need your installation disk handy.

To run SFC on a Windows 98 system:

* hit the Start button,
* hit Run
* in the Open panel type 'sfc' (without the quotes) and hit OK
* select 'Scan for altered files' when the SFC dialog box is displayed
* hit Start
* follow the instruction that SFC provides

If SFC determines that a Windows 98 system file is corrupt or missing you will be asked to insert your Windows 98 installation CD. If you are running Windows 98 SP1, use the SP1 installation CD.

Tutorial here
Before you do this I strongly recommend you use ERUNT to back up your files


I hope this works for you,
regards
CB

Sorry, I'm running Windows XP sp2. I don't know why my profile said 98.

same thing applies

here's the XP link for the tutorial

sfc

I used sfc /scannow, inserted the windows disc to fix. Had a no effect on the way the system is working. I still cannot run anything from the start menu or get newly installed programs to show up in the programs menu. on another note, i recently installed ObjectDock (AFTER the problems started). On my dock there are quick links to my computer, my music, my documents, my media drive, etc. Those do not work either. I still have to go start > run > c:\program files\program name\program.exe

OK, give this a try >Right click the Start button and click Properties, >Start Menu tab, >Customize button, >Advanced tab. >Scroll the 'Start menu items' list and make sure everything you want is checked >(choose display as link when you have the option) > Click OK, OK.

Start -> run -> cmd -> chkdsk /r

It's magical and fixes a lot of strange issues. And either way, it can't hurt to run it.

catbyte: everything looks how it is suppose to. Raktor: Ran chkdsk. Still having the issue.

Try this please

Bring up Task-manager (right click blue bar at bottom of screen > task manager)

Go to File > New Task

Type Explorer in the field that appears, click OK

See if a menu + Icons appear

If yes, then it is explorer.exe that there is a problem with

If that's the case I'll have to ask Abydos or Doug to help out

Hi brandonc

In order to acquire the information to repair this problem, we will need to have a couple of your windows tools available.
Of course, they may not be available either. But we will be able to complete the repair anyway.. it will just be a little harder.

Please answer the following questions:

You told JPShortStuff: "when I click something, the start bar goes away and nothing happens."
Question:
Do you mean when you go to Start - All Programs - (and then you click on a specific program from that List?) It then disappears and no program/application starts?

Question:
Does it also apply that Clicking on any Desktop Icon Short-cuts that you may have, does the same… meaning - nothing?

Question:
In the same "All Programs or Desktop Icon" — Are you able to use Right-Click - Open to get an application to run?

Question:
Are you able to open NotePad?
Start - All Programs - Accessories - Notepad - Right-Click - Open

Question:
Are you able to Open Registry Editor?
Start - Run - (type)regedit - Enter
***Do not make any changes using Regedit until you first receive specific instructions!!!
___________________

Please answer the above Questions, in the order that I asked them.
___________________
___________________

In your HJT Thread, JPShortStuff had you run a file using NotePad (it was the get.bat) Therefore we pretty much know that you have access to Notepad.

JPShortStuff is a darned good Malware Removal specialist, and he also knows quite a bit about the XP operating system.
He was checking to see if your machine's "Environmental Variables" appeared as they should… Specifically Path and PathEXT
They do, and that's a good thing.

What's left is that the File Association with (Program File.exe) are having a problem because of a corruption in the association of .exe type files.

After you answer the above Questions, we will follow some specific steps to investigate and then correct if necessary, your .exe file associations.

I look forward to hearing from you.

Best Regards

You told JPShortStuff: "when I click something, the start bar goes away and nothing happens."
Question:
Do you mean when you go to Start - All Programs - (and then you click on a specific program from that List?) It then disappears and no program/application starts?

Yes that is correct.

Question:
Does it also apply that Clicking on any Desktop Icon Short-cuts that you may have, does the same… meaning - nothing?

I'm not sure I have it so that I have no icons on my desktop (not even my computer, or the recycling bin).

Question:
In the same "All Programs or Desktop Icon" — Are you able to use Right-Click - Open to get an application to run?

Yes that will run my applications (I hadn't tried that before) doh!

Question:
Are you able to open NotePad?
Start - All Programs - Accessories - Notepad - Right-Click - Open

Yes I can open notepad with no issue

Question:
Are you able to Open Registry Editor?
Start - Run - (type)regedit - Enter
***Do not make any changes using Regedit until you first receive specific instructions!!!

Yes I can run RegEdit.

Thanks for your help!

OK, let's have a look at two items in your Registry.

We are not going to be making any changes during this "look". We are only investigating.
***Remember that it is always important to make a backup of the whole Registry or the specific part of the Registry that you intend to change, BEFORE making that change. That backup will help protect you if the changes that you eventually make cause any problems.

In fact, our "look" at these two areas of your registry will actually be accomplished by making those very backups that are recommended.
__________________

Please open your Registry Editor - Start - Run - Regedit - Enter

in the Registry Editor, navigate to: HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command

"Click once" to Highlight the Default Value in the right-hand panel corresponding to Command
Next:
Click File - Export
Name the file: HKEY_CLASSES_ROOT exefile shell open command (the Save function will add .reg to the end of the file name.
In the pull-down Menu at the top, Select to have this .reg file Saved to your DeskTop.
________________________-

Now Still in your Registry Editor:
Navigate to:
HKEY_CLASSES_ROOT\.exe
(This key is "up" closer to the beginning of this same branch of the Registry) (Use the scroll tab to move upward)
"Click" once on .exe
Then click once on Default in the right-hand panel corresponding to .exe
Next:
Click File - Export
Name the file: HKEY_CLASSES_ROOT exe The Save Function will add .reg to the end of this file name.
In the pull-down Menu at the top, Select to have this .reg file Saved to your DeskTop.
___________________________

Next:
Remember that you are not to make any changes to the Registry.
Close your Registry Editor now.
_________________________

On the Desktop you will now have two Icons
HKEY_CLASSES_ROOT exefile shell open command.reg
HKEY_CLASSES_ROOT exe.reg
***these are "hot" icons… meaning that if you "double-click" on them, the process to restore them to the Registry would begin.
Fortunately, Windows recognizes that this is a major step and will display a warning asking if you really want to restore(merge) the item.
***Therefore DO NOT double-click on these items!***
Instead:
Right Click on the Icon for HKEY_CLASSES_ROOT exefile shell open command.reg
Select - Edit or Open with - NotePad

This will open an instance of Notepad which will display a copy of the current default value of HKEY_CLASSES_ROOT \exefile \shell \open \command
Leave the NotePad with this information Open
________________________

Next:
Right-click on the Icon for HKEY_CLASSES_ROOT exe.reg
Select - Edit or Open with - NotePad

This will open an instance of Notepad which will display a copy of the current default value of HKEY_CLASSES_ROOT \.exe
Leave the NotePad with this information Open
_________________________

Next:

Copy the content of the first and second instances of NotePad into your next Reply in this Thread.

When we have a look at Both of these items, we will have a better understanding of what may be causing your problem, and how to fix it.

Move through these instructions carefully and be sure you understand, before acting.
You are not making any changes at this point in the process… only obtaining information for further investigation.

Ask any questions if necessary to follow the above instructions.

Best Regards

While we are investigating, I would be remiss to not ask if you had received any warning messages from Microsoft during the process of trying but failing to get various applications and programs to open by clicking on their (programname).exe file Here are two examples of such Warnings. The instance/examples represent a user attempting to open the Accessory Calculator calc.exe You may have experienced a similar Warning, with the name of the program you were attempting to open, instead of calc. 📎Calc_exefiles_small.JPG 📎Calc_exefiles2.JPG Either of those two warnings look familiar? I know you previously said that the All Programs list, simply disappeared. So you may not have seen these Warnings. If you did or did not, please let me know - yes or no? Thanks

HKEY_CLASSES_ROOT exe
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

HKEY_CLASSES_ROOT exefile shell open command
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"



Doug, I do not recieve ANY errors at all. Not even when the malware was still in the system. Thank you for your quick replies.

Hi Brandonc,

Again using Registry Editor, please revisit both of the locations listed in my previous instruction.

in the Registry Editor, navigate to: HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command
in the Registry Editor, navigate to: HKEY_CLASSES_ROOT \ .exe

This time, I would like you to "visually inspect" for the existence of an item in the string
: REG_SZ: "files32.vxd" "%1" %*
___________________

Next we need to look into another Registry Location, in a different Major Branch of the Registry: (HKEY_Local_Machine)
in the Registry Editor, navigate to: HKEY_LOCAL_MACHINE\Software\Classes\Exefile\Shell\Open\Command

again, "visually inspect" for the existence of an item in the string
: REG_SZ: "files32.vxd" "%1" %*
___________________

Please report back if you did or did not find: : REG_SZ: "files32.vxd" "%1" %*
And report which Registry locations where it appeared, if it did.
___________________

Unrelated comment/question:
It appears that at least one user of your computer is interested in Guitar? Is that correct?

It appears that at least one user of your computer has used tools related to Linux operating System? Is that correct?
Is your machine a dual-boot Windows and Linux?
—> MKVtoolnix <— This is the Linux related tool that I am curious about. Do you use it?

Please answer the above questions in order.

Thanks,
Doug

Note: I'll be going to work shortly, so my next reply is likely to be delayed somewhat. Sorry.