1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Resolved Not able to start any program at start even when fixing the registry

Discussion in 'Windows XP' started by maternag, 2011/09/01.

Page 1 of 2
  1. 2011/09/01
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    I have recently been infected with the 'XP Security 2012' malware. My computer is now clean (confirmed by Broni from malware-virus-removal forum, see http://www.windowsbbs.com/malware-v...rity-2012-leads-exe-problems-each-reboot.html) but the .exe file extension association still disappears at each reboot.
    When I run exeHelper.com (to fix the registry), I can run .exe file again normally and it stays ok when I log-off then log-in. But when I shutdown and restart, it is gone.

    I have made a comparison of my registry before and after the restart and I see that these keys are gone after the reboot:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
    @= "exefile "
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
    @= "\ "%1\" %* "

    I tried to fix the registry in safe-mode and restart in safe-mode but still not working.

    The registry stays ok if I logout then login.

    There must be a piece of software somewhere deleting these registry entries at shutdown or at start. Does someone have any clue on how to fin out? Should I reinstall my windows?

    Thanks, cheers,
    Gérard.
     
    maternag,
    #1
  2. 2011/09/01
    retiredlearner

    retiredlearner SuperGeek WindowsBBS Team Member

    Joined:
    2004/06/25
    Messages:
    7,214
    Likes Received:
    514
    Hi, only a suggestion, but sfc /scannow or chkdisk?
    These would be worth a try before doing a re-install. Neil.
     
    retiredlearner,
    #2


  3. to hide this advert.

  4. 2011/09/06
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    Thanks for your response. I tried both sfc and chkdsk but no changes.

    Any other clue?

    Thanks,
    Gérard
     
    maternag,
    #3
  5. 2011/09/06
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    TonyT,
    #4
  6. 2011/09/06
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    I have already tried that. It works at the moment I execute it but the problem appears again at next boot. My registry is modified back and I don't know how (my computer is malware free according to windows BBS malware forum.)
     
    maternag,
    #5
  7. 2011/09/06
    rsinfo

    rsinfo SuperGeek Alumni

    Joined:
    2005/12/25
    Messages:
    4,076
    Likes Received:
    178
    Create a new user & test there. Could be that your user profile is damaged.
     
    rsinfo,
    #6
  8. 2011/09/06
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    If rsinfo's suggestion does not work and you have a retail XP install CD I would suggest a Repair install. In fact this can generally be done with a borrowed CD of the same version and Service Pack level as the installed OS using your CD code. If the install CD is not at the correct SP level the SP can be slipstreamed into the original CD provided that is retail.

    Please enter your System Details. It helps us in answering your questions!
     
    PeteC,
    #7
  9. 2011/09/07
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    I tried to create a new user and to make a repair install but both were unsuccessfull.

    Any other idea? There must some way to know what is modifying my registry, no?

    Thanks,
    Gérard.
     
    maternag,
    #8
  10. 2011/09/07
    rsinfo

    rsinfo SuperGeek Alumni

    Joined:
    2005/12/25
    Messages:
    4,076
    Likes Received:
    178
    Hm. I believe we have reached the end of road & whetever damage has been done by malware/virus is more or less permanent.

    Unless somebody else comes up with a solution I believe you are looking at backup/format/reinstall/restore routine.
     
    rsinfo,
    #9
  11. 2011/09/07
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    It's possible the malware set a system policy that disassociates exe files, run at logon, logoff or shutdown.
    Look in group policy editor: (not available in Starter, Home Basic or Premium editions of Windows)
    Start > Run > gpedit.msc

    Or the policy gets set at startup via a logon script. Look here:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System key and here:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System key
    for a script value.

    Did you try the reg file I linked to? You must download and unzip the file, rt click & select Merge.
     
    TonyT,
    #10
  12. 2011/09/07
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    I tried the .reg file from http://www.dougknox.com/xp/file_assoc.htm but it only works until next restart.

    I have checked the system policy (both registry and mmc), there are no script at logon, logoff, startup nor shutdown.

    Any other idea?

    Thanks,
    Gérard.
     
    maternag,
    #11
  13. 2011/09/07
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Apply the Doug Knox fix again and reboot in safe mode.
    If it works then we know that a script or program must be running at startup in normal mode. If it doesn't work then there's possibly still a rootkit on your computer that's undetected.

    If you have a known uninfected restore point you could try using system restore to load it. You'd have to pick a time back of when your computer got infected to begin with.

    Another idea is to use the registry fix, then open regedit, find each key, rt click > select Permissions and verify that your account has Full Control, and you can even try to take ownership of the key & its subkeys. Then apply the fix again, reboot & see what happens.
     
    TonyT,
    #12
  14. 2011/09/07
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    TonyT,
    #13
  15. 2011/09/08
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    Thanks for all your suggestions.
    1) Safe mode : already tried but not working. I also tried to apply the reg fix in safe mode and reboot in safe mode but it is the same.
    2) Restore point: unfotunately I have none
    3) Reg key permissions : My user is already in teh Administrators group, but I gave him the full control on top of it, executed the fix then restarted and problem remains
    4) file & registry permissions to the defaults : I used secedit (since I have XP pro ) and I re-ran the fix but still the same problem

    Thanks,
    Gérard.
     
    maternag,
    #14
  16. 2011/09/08
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Thanks for the effort.

    This seems narrowed down to 2 possible causes:

    1. undetected rootkit (another ComboFix scan would not hurt)
    2. corrupted Windows files/registry keys

    I lean more toward 2, a repair install should fix it.

    However, were it my computer, I'd backup my data, wipe the drive & do a clean install.
     
    TonyT,
    #15
  17. 2011/09/08
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    1. I reran combofix but nothing found.
    2. I already tried a repair install.

    I can do a clean install but I was very curious to find out how registry keys can disappear that way.

    I think I have no other option than leave it as a mystery ;-)

    Thanks for your time and your science, best regards,
    Gérard.
     
    maternag,
    #16
  18. 2011/09/08
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Well, there could be a rootkit hiding in the boot sector or MBR. You could try booting to recovery console and running the commands:

    fixboot > enter key

    fixmbr > enter key

    to recreate them.

    I almost wish I was in front of the computer so I could solve the problem, a real doozy of a challange.
     
    TonyT,
    #17
  19. 2011/09/09
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    Hello,

    I tried fixboot and fixmbr but no luck.

    I will not reinstall immediately so if you have anyother idea, I would be glad to try it.

    Thanks, cheers,
    Gérard.
     
    maternag,
    #18
  20. 2011/09/09
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    TonyT,
    #19
  21. 2011/09/09
    maternag

    maternag Inactive Thread Starter

    Joined:
    2011/08/17
    Messages:
    23
    Likes Received:
    0
    I went trough it. It is pretty much the way I got rid of it at the beginning. Then after a lot of different checks, my computer was declared clean on the malware forum. The only remaining problem is this one.
     
    maternag,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...