This is a read-only archive. No new posts or registrations. Privacy Page
Software

Annoying Issues after malware infection

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I did not find
: REG_SZ: "files32.vxd" "%1" %*

but rather found this in both locations
: REG_SZ: "%1" %*

In regards to the questions:
1. Yes I am very interested in guitar. I play guitar, bass, piano, trumpet (not well), cello, and harmonica.

2. I do dual boot windows and ubuntu. I recently had to reformat windows so I haven't used the linux disk to put GRUB back, so technically I only boot straight to windows (until I find my ubuntu live cd).

3. MKVtoolnix, is a matroska utility built on linux and ported to windows. It's to create and inspect Matroska files. I have not had to use it yet, because I haven't gotten my blu-ray drive in yet. So I can't back up my blu-ray discs to my home theater server.
Hi Brandonc,

I decided to post a "preview" of where we may go, if we do not find any errors in the Registry Locations that I have already asked you to inspect and report on.

Sorry if this is taking time to find that "everything is OK", but we really do need to verify that those locations are correct and free of corruption.
_______________

so, after you report on the questions from my post above, I will be giving instructions of a more general nature.

It is "possible" that various application executable files became "unregistered" during your recent infection and/or the removal process.

It is possible to re-register those application connections to restore your ability to "simply click" on applications to open them, instead of having to "right-click - open"

The process we will use is safe and is as follows:
Go to Start - Run - (type)regsvr32 /i shell32 - Enter

here's a graphic to illustrate.
📎regsvr32_i_shell32.dll.jpg

I suppose I could have suggested this initially, but I wanted to first discover the information that I have already asked about.
I would "prefer" for you to wait until you receive instructions to go ahead with the regsvr32 procedure, but it is "safe" so I feel comfortable giving you this "preview" of what we may do next.

It is also possible that JPShortStuff may enter back into this Thread, and may wish you to complete this instruction.
That's fine. I have sent a note to consult JShortStuff and am happy if he participates here.

Doug

I did not find
: REG_SZ: "files32.vxd" "%1" %*

but rather found this in both locations
: REG_SZ: "%1" %*


OK, we may be getting closer….. or not.
I'm going to have to Research this feature a little more. It may be nothing…. or?

Will you please "repeat" the Registry "Export" function so that you include "all" of the items in the right-hand panel of the (3) three locations I have already had you report on? Sorry for the extra trouble.

Simply hold the "ctrl" key down while you use left-click once on each of the items in the right-hand panel - then repeat the Export function.
Copy/Paste the contents of these new .reg exports into your next reply.

Now I'm off to work.

I'll catch up to you later.

Doug
HKEY_CLASSES_ROOT exe
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

HKEY_CLASSES_ROOT exefile shell open command
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

HKEY_LOCAL_MACHINE software classes exefile shell open command
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
@="\"%1\" %*"
Well Brandonc, Hello again.
I am hopeful that you've had a great day.
My day was somewhat ordinary, which is to say, I had a hard time keeping up with it. :P

But I did use break and distraction times to sift through information that could help us here.
Lots of sifting, no nuggets.

It would just "seem like" there would be one or two main entries somewhere that would command this problem to be banished.
Yet it does not seem to be so.

There is a "slim" possibility that the Start - Run - (type)regsvr32 /i shell32 - Enter could bump everything up a notch but expect success only if all other application values are sitting there waiting in their correct value settings. <– Go ahead and give it a shot, once.

There is a sometimes offered series of about two dozen values to be registered that may affect a solution to a variety of problems, but no guarantee that it would help yours.

The kind of "scan" that we would hope would find and replace various missing or corrupt operating system files is the System File Checker (SFC /scannow) which CatByte has already recommended much earlier and you indicated didn't help.

Question:
When you ran "sfc /scannow" …. How long did the scan take?
If it only took less than 2 minutes, then it didn't actually run and should be repeated until it runs completely (time varies between 7 minutes to half an hour)
If SFC does identify and replace any files, it should be run a second and even third or more times until it runs the full course without identifying any missing or corrupted files.

The other place where we may get some descriptive information is from Event viewer.

Start - Run - (type)eventvwr.msc - Enter

Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning". Double-clicking on such an entry will open a properties window with more detailed information on the error; post the details from a representative sample of some of the different error messages. Don't post duplicates, but do tell us if a single even code is being repeated over and over.

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

Please run SFC /scannow from a command prompt
Start - (type)cmd - Enter
At the blinking cursor - (type)sfc /scannow <– notice the required space between "c" and "/"

let us know how the scan went…. meaning sit there and watch to see if it calls for and is replacing missing or corrupt files.
Sorry…. Almost as exciting as watching paint dry.
_______________

Next:
Have a look in Event Viewer — per the above instructions, and post back with any observations.

I'm going looking for someone smart enough to identify and fix this situation.
We've got some talented folks here. Something will turn up short of doing a Repair Installation (last resort)

Looking forward to hearing from you.

Doug
Hi Brandonc,

Please go have a look at a setting in Registry Editor.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Highlight the word Winlogon only
Then Right-click and select Export.
Name the file Winlogon.reg and Save it to your DeskTop

Open Winlogon.reg using Right-Click - open with NotePad
Now SAVE Winlogon as a Text File, by renaming it to Winlogon.txt (Save Winlogon.reg –> change to Winlogon.txt)

Please upload Winlogon.txt as an attached file in your next reply.
You should get a file similar to this practice one that I have uploaded into this post.

I want to have a look at some of the settings.
Thanks.

📎winlogon_Doug_Test.txt
Doug, I ran regsvr32 /i shell32, but nothing happened (at least nothing visible.) It surely did not fix my problem. I don't remember how long 'sfc' took to run because I ran it while I was in the shower. I will rerun it again shortly. In my event viewer, I have a lot of errors and warnings over the past few months but when I double-click on them, I *DO NOT* get a properties window with further details. I also tried right clicking and selecting 'properties' but there was no further information. It seems I've run into another snag. My cd-rom is no longer being recognized. 'sfc' needs me to input my windows cd but now that won't work. What is going on with this machine!

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI