.EXE Files Do Not Open - even in safe mode!

[contristo]

this has been occurring ever since my computer was diagnosed with a trojan. i removed it, and ever since then no .EXE files will open. I will click on any .EXE file, the revolving circle signifying loading will show for a second, and then it won't load at all - it is not present in the task manager.

the weird thing is, there is no difference in safe mode. no .EXE file will run in any variation of safe mode. this prevents me from running ANYTHING apart from the command prompt, viewing folders, and notepad. i cannot load the internet, a virus scanner, NOTHING. it is difficult to fix something when one is literally unable to access anything.

i have attempted the 'repair my computer' option when i press f8, but it says it can't be repaired automatically. i downloaded a registry fix from a different computer, but it reads the message "Could not import exefix.reg: Not all data was successfully written to the registry. Some keys are open by the system or other processes".

I cannot load a registry fix, virus scanner, or the internet. i STILL cannot open .EXE files in any variation of safe mode. i do not have the windows 7 disc so i cannot reformat. additionally, the trojan appears to have erased all my system restore points, so i cannot restore to any previous time.

i have literally run out of ideas. i can't even install any fixes! any help would be greatly appreciated. thank you.

 

[WR2]

Hello contristo;
Sounds like you're in a bad place at the moment.
That 'no difference in safe mode' says to me you've been the victim of a rootkit attack so you might try one of the rootkit scanner tools like Sophos Anti-Rootkit.

If I were in your position I think I'd back up all the personal data I could find, buy a Win7 installation disk and do a clean install to clear things up.

 

[contristo]

thanks for the reply. i would love to run any type of scanner, but unfortunately since they're all .exe they won't run.

so you're saying the only fix is to spend $120 on an installation disc even though i just bought this laptop a few months ago? why does microsoft do this? why can't there just be an option to reset to factory defaults? i have essential work to do and i can't be waiting for days for the disc to arrive from amazon.

i don't even care about saving my files at this point. i just want a clean install so i can actually do work for my clients. this really is a pain. i've had every version of Windows since 95 and this is the first of the sort to happen to me. so much for 7 being the best

 

[pjmelect]

There is a possibility that you still have a root kit virus on your system, to fix it try and download a bootable version of an anti-virus program such as the one by AVG at this link.

http://www.avg.com/us-en/avg-rescue-cd

Even better is to do a clean install of the operating system. Did you not create the rescue discs when you first got your computer?

 

[WR2]

You should be able to load an minimal OS through a bootable CD/DVD and run command line programs like Sophos Anti-Rootkit.
There are options like BartPE http://www.nu2.nu/pebuilder/ or Avast/Bart-CD http://www.avast.com/bart-cd
You can also try creating one of the LiveCD (or USB stick) options using a Linux OS. http://www.livecdlist.com/?order=value_1&sort=desc

 

[WR2]

so much for 7 being the best

This is not a Win7 issue.
The trojan/rootkit problem is worse in WinXP and also affects Vista systems the same way.

so you're saying the only fix is to spend $120 on an installation disc even though i just bought this laptop a few months ago? why does microsoft do this? why can't there just be an option to reset to factory defaults?

Microsoft did not ship that laptop without an install disk. The rootkit might have disabled access to the installation mirror on a separate partition of your laptop's hard drive.

I know its too late to fix the current problem but once you get up and running again be sure to create a Rescue Disk?
Go to “Control Panel” and go to “System and Security.”
Click on “Backup and Restore” and select “Create a system repair disk” on the left side. Follow the wizard prompts to burn a bootable recovery CD/DVD.

 

[aford10]

You've got some good advice above. The bootable antivirus disc is a good option. Either the AVG or Avast software will work fine.

Another option, is to pull your hard drive, and slave it into another PC. You can use that 2nd PC to scan your slaved hard drive.

 

[Saga Lout]

You've got some good advice above. The bootable antivirus disc is a good option. Either the AVG or Avast software will work fine.

Another option, is to pull your hard drive, and slave it into another PC. You can use that 2nd PC to scan your slaved hard drive.

There may also be a place for Doug Knox's .exe file fix here. Find it at http://www.dougknox.com under XP Tip>XP File Fixes - it isn't an exe itself but a Registry addition and it will work in a W7 Registry. If you are able to make exe files work with that method, and since ComboFix may not work in your system, try GMER on your Rootkits.[/#000ff]

 

[plasmastorm]

Follow this tutrial, boot into safe mode, download combofix and run it. it will remove the rootkit.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

then download
http://filext.com/WinXP_EXE_Fix.reg
this will reset the .exe file associations on your machine.

Whole process should take about 20min.

I fix the same problem on customer machiens 2-3x a week.

 

[aford10]

Follow this tutrial, boot into safe mode, download combofix and run it. it will remove the rootkit.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

As much as I advocate combofix, it won't work if .exe's are being blocked. The OP has already tried to go into safe mode. And to download combofix, you would need to go into safe mode with networking, not just safe mode.

 

[Guest]

http://windowsxp.mvps.org/exefile.htm

 

[LePhuronn]

Copy somebody else's install disc and just reinstall the OS using your serial number.

 

[saidsamadli]

Hi Contristo,

I explained in another thread http://www.tomshardware.com/forum/20670-45-unable-open-files about how to fix .exe file issues. I will add this information over here also. Please go thru these steps see if it helps.

1. Copy code below and save as fixrun.reg on your hard drive


Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"

[HKEY_CLASSES_ROOT\exefile]

@="Application"
"EditFlags"=hex:38,07,00,00
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,\
00,2c,00,2d,00,31,00,30,00,31,00,35,00,36,00,00,00

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"


2. Run file fixrun.reg either by by double clicking on it. After that any file with extension .exe should be working and .pif & .ink files should be running as well.

3. Go to http://www.piriform.com/ccleaner/download and download ccleaner
and run and follow the instructions on the program

4. Goto http://free.antivirus.com/hijackthis/ and download hijackthis and run

5. Go to http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button download malwarebyes and scan whole computer

after that you should be able to remove malicious code from your system

Thanks

Said Samadli
Senior Software Engineer

 

[daw910]

hey i was just wondering if that was for vista/7 or xp also my laptop will only run in safe mode and i have to do that in cmd prompt wish me luck im taking my a+ next week im fixing this for a friend its been a pain since no portable apps open

 

[daw910]

also this does not work if regedit doesnt open you should post how to do it in the command center

 

[daw910]

http://support.microsoft.com/kb/950505 hey this isnt the reg fix for this problem but it will show you how to save the notepad regfix into an actual registry fix

 

[kaichou22]

Hi Contristo. Did you try already opening suspected virus file in a secure way with Avast? Avast had introduced its new feature enabling you to visit ‘shady’ websites, read potentially infected PDF files, executing keygensor even free games, which are usually carriers of spyware. To give you more idea, I found a useful article for you: http://darktips.com/how-to-open-a-suspected-file-in-a-secure-way/