Bogus Vista Security Alerts and Std Programs Fail to Run

pbmax · May 21, 2011

Vista OS infected with popup windows and system tray alerts about infections and suggestions to download Vista Security software.

Malware disabled AVG Free on one users account. Infection does not seem to have infected local Admin account and I ran all suggested programs from Run and Read First Thread.

After scanning and removing Malware (SAS and ComboFix found items to delete) I can no longer run any program or open files in the formerly infected user. Programs respond normally in the local admin account.

TimW · May 21, 2011

Try doing this on the infected user account:
http://filext.com/faq/broken_exe_association.php

Also, go to C:\MGTools\fixATTR.bat and run that.

Use windows explorer to find and delete:
C:\ProgramData\9EAE9AEFA0.sys
C:\ProgramData\cs5b421r67o

Is your start menu populated with programs, or have they disappeared? Are your documents missing in that user account?

pbmax · May 21, 2011

Ran small Reg modifier for Vista from the Filext website and it restored IE. But no other .exe.

Ran fixATTR.bat and no change (though it seemed to run normally-no errors).

Deleted files (.sys needed to be removed by an admin acct).

Start menu and Programs folders (and contents) all seem normal. No docs missing that are immediately apparent. Shortcuts work to find .exe, but exe will not run.

All pop up and system tray notices from malware seems gone.

TimW · May 22, 2011

Can you create a new user account with Admin. privileges and if so, does it work?

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\MGlogs.zip

pbmax · May 22, 2011

New admin user created and working. Ran MGlogs bat from that account.

Did not get asked to accept HijackThis license at all.

TimW · May 22, 2011

That set of logs are clean. You can just delete the user account that is having the issues.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

pbmax · May 22, 2011

Thanks for the help, much appreciated. As a last ditch effort, I went to a link provided on the page of your *.exe association fix mentioned below

Try doing this on the infected user account:
http://filext.com/faq/broken_exe_association.php
Click to expand...

specifically listed for Vista file association fixes.

http://www.winhelponline.com/articles/105/1/File-association-fixes-for-Windows-Vista.html

I merged only the reg entry for *.exe files and this seems to have restored the exe functionality to the point where a few short tests of major programs do open or run successfully.

TimW · May 22, 2011

Sorry, I should have given you that link. Good to know it is working now!! Safe surfing.

Kestrel13! · May 22, 2011

You gave the correct link Tim, the vista fix was there, just at the bottom of the page.

pbmax · May 22, 2011

Kestrel13! said: ↑

You gave the correct link Tim, the vista fix was there, just at the bottom of the page.
Click to expand...

Yes, I definitely found the second fix on the page of Tim's link.

But just to be clear if anyone references this, I ran two registry edits to attempt to solve the *.exe file assoc. problem. The first was the copy and paste code for Vista at Tim's link: http://filext.com/faq/broken_exe_association.php and that brought IE back to life, but didn't change the status of other exe files.

In that same section, below the code there was a link to a second Vista method located at http://www.winhelponline.com/articles/105/1/File-association-fixes-for-Windows-Vista.html.
That site has multiple zipped files to edit the registry for various file assoc. problems. And their *.exe fix was the one that solved the balance of my particular issue.

Sorry for any confusion.

Kestrel13! · May 22, 2011

Thanks for letting us know!

Log in or Sign up

Bogus Vista Security Alerts and Std Programs Fail to Run

pbmax Private E-2

Attached Files:

4LogFiles.zip

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

pbmax Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

pbmax Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

pbmax Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

pbmax Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Log in or Sign up

Bogus Vista Security Alerts and Std Programs Fail to Run

pbmax Private E-2

Attached Files:

4LogFiles.zip

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

pbmax Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

pbmax Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

pbmax Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

pbmax Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches