Corrupted exe file

Will Arrrrgh · Mar 9, 2011

Hi all

I have been hit by an internet nasty and am completely stumped as to how to deal with it. The virus has apparently hit all my exe files.

When I go to launch a programme I get the message "C:\users\blah\blah\blah
whatever.exe The archive is either in unknown format or damaged'.

This occurs with every exe I have tried, from word processing to games to graphics apps etc

The icons of most, but not all, exes file has turned from its usual pic to something resembling a rar archive icon

While I can't launch any programmes by directly running the exe file, oddly enough I can get some programmes like Word to run by clicking on a word doc and Word launches from there. Similarly with Firefox. I can't launch it by clicking on an icon but it goes just fine if I open an offline webpage.

Internet access is unimpaired. I am making this post from the infected computer.

I have downloaded new programmes from the internet but they fail as well.

Any thoughts on the matter would be greatly appreciated- or should I start another thread asking about the best way to go about a re-install?

Will.

TimW · Mar 9, 2011

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Administrator

You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.exe

Rkill.com

Rkill.scr

Rkill.pif

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.

If you are having problems running Rkill, you can download iExplore.exe or eXplorer.exe, which are renamed copies of Rkill.com, and try them instead.

* If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run then try to immediately run the following.

Now download and Run exeHelper from Raktor

Please download exeHelper to your desktop.

Double-click on exeHelper.com to run the fix.

A black window should pop up, press any key to close once the fix is completed.

A log file named log.txt will be created in the directory where you ran exeHelper.com

Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

If you already have them installed, be sure to update Malwarebytes and SUPERAntiSpyware before the scan!

Now run this: Using Malwarebytes Anti-Malware

Now run this: SUPERAntiSpyware - running & getting a log

Now run this: Using MGtools

Now you need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the above scans

exeHelper log

Malwarebytes Anti-Malware log

MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

Will Arrrrgh · Mar 9, 2011

Hi Tim

Thanks for your reply, but alas it is to no avail

The problem is the exe file not working. Even when I downloaded and used the rkill.com or even rkill.scr when I open them the exe files within the program still failed with the same message as below, "unknown format or damaged"

I tried right clicking to run as admin (as I use Vista), but I was not given that option.

I tried downloading and running all the files down to eXplorer.exe, but as I received the same result, I gave up there.

The result of attempting to run those programmes has resulted in persistent error message boxes which bounce back every time I click OK. As a result I have a ton of the buggers lurking behind the open windows on my screen...

Will

I tried

TimW · Mar 9, 2011

Did you try to run Exe helper?

Do you have your Windows install disc?

Will Arrrrgh · Mar 9, 2011

No I didn't try exehelper, but have just done so. It worked and I attach the log results below.

I am sure I have the install disks about somewhere. The trick is to find them...

Will

exeHelper by Raktor
Build 20100414
Run at 09:44:48 on 03/10/11
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

TimW · Mar 9, 2011

Are you now able to run exe files? If so, please do the following:

Now run this: Using Malwarebytes Anti-Malware

Now run this: SUPERAntiSpyware - running & getting a log

Now run this: Using MGtools

Now you need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the above scans :

SAS
MBAM
C:\MGLogs.zip

Will Arrrrgh · Mar 9, 2011

Unfortunately the exe files still don't work. Same problem as before. I rebooted the computer as well to see if that would help. Nope.

Will

TimW · Mar 9, 2011

Have you tried in safe mode? There isn't much I can do to help you without seeing any logs. Try renaming the exe files to .com.

Will Arrrrgh · Mar 9, 2011

I have tried renaming files as com, but that doesn't work either.

I haven't tried starting the system in safe mode. How do I do that?

TimW · Mar 9, 2011

Restart your computer and continually tap F8 as it starts up.

Will Arrrrgh · Mar 9, 2011

Safe mode isn't doing the trick either.

Is it worth doing a System Restore from the f8 screen? I can't remember when the last restore point was done (it might be automated, it might not...)

TimW · Mar 9, 2011

Yes, I would definitely try doing a system restore.

Will Arrrrgh · Mar 9, 2011

The system restore seems to have done the trick. About a third of my icons are still looking like winrar icons, but the programmes themselves all seem to work fine.

Thanks muchly for your help

Will

TimW · Mar 10, 2011

I would still suggest that you go through our cleaning procedures to make sure that the restore point was also not infected.

Log in or Sign up

Corrupted exe file

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

Corrupted exe file

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Will Arrrrgh Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches