EXE file association issue with old XP computer (Screenshot attached)..

[thecomputerguy]

I'm having an issue with an old XP computer that a client cannot get rid of. He installed some Speedy My PC junk and the result is was that his .exe file association was damaged.

Basically he cannot open EXE files unless the file association is fixed EVERYTIME the computer reboots.

I'm using this tool to fix the file association: http://www.bleepingcomputer.com/download/fixexec/

I've also tried manually fixing the file association, and manually importing the correct registry entries from another old XP computer.

After using the tool the repairs made to the system are shown below...



Note the path of the registry entries.

Immediately after running this tool, all of the shortcuts and .exe files work perfectly fine.

After a reboot into normal or safe mode the association is messed up again and .exe's no longer work until this tool is run again or the entries are manually repaired, the registry entries are either gone or changed.

Malware scans come clean, tired combofix, msconfig'd everything out of startup, same issue in safe mode.

Not sure what else I can try aside from dropping this tool into the startup and having it run every time the computer boots.

N&P is not an option.

Ideas?

 

[Altster]

Take a look at this and see if it can help with your issue(s).

Personally I'd go ahead and make sure to reset "all types" of file associations in this case.

 

[thecomputerguy]

Take a look at this and see if it can help with your issue(s).

Personally I'd go ahead and make sure to reset "all types" of file associations in this case.

Unfortunately no ... this is definitely an issue with the registry or something modifying the registry, this isn't an "Open With" issue.

 

[glennd]

I'm having an issue with an old XP computer that a client cannot get rid of. He installed some Speedy My PC junk and the result is was that his .exe file association was damaged.

Basically he cannot open EXE files unless the file association is fixed EVERYTIME the computer reboots.

I'm using this tool to fix the file association: http://www.bleepingcomputer.com/download/fixexec/

I've also tried manually fixing the file association, and manually importing the correct registry entries from another old XP computer.

After using the tool the repairs made to the system are shown below...

View attachment 5332

Note the path of the registry entries.

Immediately after running this tool, all of the shortcuts and .exe files work perfectly fine.

After a reboot into normal or safe mode the association is messed up again and .exe's no longer work until this tool is run again or the entries are manually repaired, the registry entries are either gone or changed.

Malware scans come clean, tired combofix, msconfig'd everything out of startup, same issue in safe mode.

Not sure what else I can try aside from dropping this tool into the startup and having it run every time the computer boots.

N&P is not an option.

Ideas?

Time to stop relying on tools and start using the gray matter. I'd probably start by looking through the startup programs, perhaps with Autoruns, and look for stuff that doesn't belong. That may involve researching and understanding what all the various things are. Secondly, a registry monitor tool inserted into the startup to monitor what changes are made to the registry. Others may have more refined methods for chasing this stuff but basically you need to think about how you're going to track down what is causing the association changes.

 

[thecomputerguy]

Time to stop relying on tools and start using the gray matter. I'd probably start by looking through the startup programs, perhaps with Autoruns, and look for stuff that doesn't belong. That may involve researching and understanding what all the various things are. Secondly, a registry monitor tool inserted into the startup to monitor what changes are made to the registry. Others may have more refined methods for chasing this stuff but basically you need to think about how you're going to track down what is causing the association changes.

I already painstakingly went through autoruns ... forgot to mention that ... I am not personally familiar with any registry monitors ... any reccomendations?

 

[thecomputerguy]

Oh my goodness I got lucky and found a Dell program in the computer that was BURIED in

local/appdata/dfiosjfs/dsijfi3.d/2.0/dell/sdkfjhtekfj39u5320t/blah.exe

I think that might have done it, going to do further testing

 

[glennd]

Basically he cannot open EXE files unless the file association is fixed EVERYTIME the computer reboots.

So you must have missed something when scanning the autoruns or it's rooted (some system file has been replaced). Did you scan *all* of autoruns or just the usual startup entries? There are other locations where malware can be auto started.

http://www.howtogeek.com/school/sysinternals-pro/lesson6/

Maybe try the SFC tool, you'll need an XP install disk.

Check services. Do a clean boot using MSCONFIG.

http://netsquirrel.com/msconfig/msconfig_xp.html

 

[thecomputerguy]

I think we're fixed boys! only 3 hours later

 

[glennd]

I think we're fixed boys! only 3 hours later

Well done! Your client will worship you Now if only you could convince the client the trash the old XP box because we *all* know it's going to die any day now....

 

[thecomputerguy]

I already explained to him he should get a new computer with 7 on it and I can convert the system to a virtual box he can run inside the Windows 7 computer and he said he didn't want to buy a new computer at this time.

 

[glricht]

Don't remember if RKILL supports XP (I think it does), but it's perfect for this situation, plus it fixes a number of other issues. See http://www.bleepingcomputer.com/for...a-brief-introduction-to-the-program/?hl=rkill

One of the things it fixes is file extension problems. There are different-named copies of RKILL (rkill.exe, rkill.com, rkill.scr, eXplorer.exe, etc) in case an active infection is disallowing some of your programs. This is the first program I run on almost any PC that's having problems.