Solved Removed malware, now I can't start a program

[mitchellb]

So I became infected with some malware (the vista anti-virus malware). I removed it with MalwareBytes'. But now whenever I go to use a program it asks me to choose which program to open with. It does it with all programs.

 

[richc46]

Welcome give this a try
Try to reset the exe and lnk (LNK) associations.
Default File Type Associations - Restore

 

[mitchellb]

Okay, now I have to say. At this moment I'm in my admin account, the standard account is the one affected by this. So how do I merge the file to take affect on the standard account?

 

[mitchellb]

Nevermind it's called a flashdrive. lol.

 

[richc46]

Just follow these instructions as given in the tutorial

Click on the file extension type link listed below for the one that you wish to restore to default to download it's .zip file.

2. Save the .zip file to your desktop.

3. Open the downloaded .zip file, then extract the .reg file to the desktop.

4. Right click on the extracted .reg file and click on Merge.

Do it for .exe and .lnk

 

[tom982]

As well as following the excellent advice that Rich is giving you, can you do the following for me please? Let's make sure the virus is gone

OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.


Once OTL has completed its first scan it will save notepad copies of the scans in the folder that OTL was started from. Unless set to produce an Extras log it will only produce OTL.txt in subsequent scans.

A copy of an OTL fix log is saved in a text file at

:\_OTL\MovedFiles
in most cases this will be C:\_OTL\MovedFiles

Please attach both OTL.txt and Extras.txt with your next post for me to analyse

Tom

 

[mitchellb]

Did as you asked. Here are the text files.

 

[tom982]

Okay, I'm fairly sure there's no malware left. Here's your problem:

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.

If Rich is happy with this, I'll leave the rest to him - he is far more experienced than me and you'll be in better hands

Tom

 

[Brink]

Hello Mitchell,

Oh my, you got a nasty one.

According to that log, you will need to do the TIP under step 4 in the tutorial below first to fix .reg files. Afterwards, you need to download and merge the .bat, .cmd, .com, .exe, .hlp, .pif, .scr, and .txt options in the tutorial below to restore the default associations for these file extensions.

http://www.vistax64.com/tutorials/233243-default-file-type-associations-restore.html

Hope this helps,
Shawn

 

[mitchellb]

Thanks everyone, appreciate all the feedback from this nasty malware.

 

[Brink]

You're welcome Mitchell. We're happy to help. Were you able to get it all sorted out?

 

[mitchellb]

I assume all is well now, I want to ask: should I do another OTL scan and post up results?

 

[tom982]

Yes, it can't hurt. You can never be too careful with malware

Tom

 

[mitchellb]

Ok here's the texts.

 

[tom982]

Follow this tutorial to show both hidden and system files: http://www.vistax64.com/tutorials/86163-hidden-files-folders.html

Then go to C:\ProgramData and you should see a file called 5ck18628083b8y8gi4y3dlivvx1u4n7pkvj5y1.

Go to VirusTotal - Free Online Virus, Malware and URL Scanner and upload this file. Send me the link that it takes you to (the report of the scan)

Tom

 

[mitchellb]

Ok, here's the link. Please notify me if the link is incorrect.

VirusTotal - Free Online Virus, Malware and URL Scanner

 

[tom982]

Okay that's fine. One last thing just to be sure, can you scan your computer with the ESET Online Scanner please:

Free ESET Online Antivirus Scanner

Upload the log for us upon completion

Tom

 

[mitchellb]

On the scan settings, should I mark both "Remove found threats" & "Scan Archives"?

 

[Brink]

Yes, it will take a bit longer, but it would be a more thorough scan.

 

[mitchellb]

Ok, now I'm having problems. Or at least I think. It's been over 2 hours and it got stuck at 49%. Or am I being impatient?