All my EXE's are gone

Printable View

February 5th, 2004, 09:35 AM
jeffharding

All my EXE's are gone

So I wake up this morning and I go to check my email to see if I have to go to work and when I click on Outlook, an error message comes up saying it can't find the .exe in the system directory. I tried opening trillian, same thing. Then I tried to run AVG and it couldn't find that either. I finally got thru by right clicking on the C:\ and telling it to scan with AVG. It did and found a trojan optix and cleaned it. But my programs still don't work. And I can't even run system restore to fix my OS. Is the only way out, to reformat? Or is this a virus that can be quarantined and fixed?
February 5th, 2004, 09:47 AM
gazzak

You can fix it, print the following and follow it through...

Removal Instructions;
NOTE: These instructions are for all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Update the virus definitions.
2. Do one of the following:
Windows 95/98/Me: Restart the computer in Safe mode.
Windows NT/2000/XP: Stop the Trojan process.
3. Run a full system scan, and delete all files that are detected as Backdoor.OptixPro.11.
4. Reverse the changes that the Trojan made to the registry.
5. (Windows 95/98/Me only) Restore the shell= line in the System.ini file, and restore the run= line in the Win.ini file.

For details on how to do this, read the following instructions.

To update the virus definitions:
All virus definitions receive full quality assurance testing by Symantec Security Response before being posted to our servers. There are two ways to obtain the most recent virus definitions:
Run LiveUpdate, which is the easiest way to obtain virus definitions. These virus definitions are posted to the LiveUpdate servers one time each week (usually Wednesdays) unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up.
Download the definitions using the Intelligent Updater. Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). They must be downloaded from the Symantec Security Response Web site and installed manually. To determine whether definitions for this threat are available by the Intelligent Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up.

Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.

To restart the computer in Safe mode or end the Trojan process:
Windows 95/98/Me
Restart the computer in Safe mode. All Windows 32-bit operating systems, except for Windows NT, can be restarted in Safe mode. For instructions on how to do this, read the document How to start the computer in Safe Mode.

Windows NT/2000/XP
To end the Trojan process:
1. Press Ctrl+Alt+Delete one time.
2. Click Task Manager.
3. Click the Processes tab.
4. Double-click the Image Name column header to sort the processes alphabetically.
5. Scroll through the list, and look for Win32loader.exe.
6. If you find the file, click it, and then click End Process.
7. Exit the Task Manager.

To scan for and delete the infected files:
1. Start your Symantec antivirus program, and make sure that it is configured to scan all files.
Norton AntiVirus consumer products: Read the document How to configure Norton AntiVirus to scan all files.
Symantec enterprise antivirus products: Read the document How to verify a Symantec Corporate antivirus product is set to scan All Files.
2. Run a full system scan.
3. If any files are detected as infected with Backdoor.OptixPro.11, click Delete.

To reverse the changes that the Trojan made to the registry:
Because the Trojan modified the registry so that you cannot run .exe files, you must first make a copy of the Registry Editor as a file with the .com extension and then run that file.

To make a copy of the Registry Editor:
1. Do one of the following, depending on which version of Windows you are running:
Windows 95/98: Click Start, point to Programs, and click MS-DOS Prompt. A DOS window opens at the C:\Windows prompt. Proceed to step 2 of this section.
Windows Me: Click Start, point to Programs, point to Accessories, and then click MS-DOS Prompt. A DOS window opens at the C:\Windows prompt. Proceed to step 2 of this section.
Windows NT/2000:
a. Click Start, and click Run.
b. Type the following, and then press Enter:

command

A DOS window opens.

c. Type the following, and then press Enter:

cd \winnt

d. Go on to step 2 of this section.

Windows XP:
a. Click Start, and click Run.
b. Type the following, and then press Enter:

command

A DOS window opens.

c. Type the following, and then press Enter after typing each one:

cd\
cd \windows

d. Proceed to step 2 of this section.

2. Type the following, and then press Enter:

copy regedit.exe regedit.com

3. Type the following, and then press Enter:

start regedit.com

The Registry Editor opens in front of the DOS window. After you finish editing the registry, exit the Registry Editor, and then exit the DOS window.

To edit the registry:

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to make a backup of the Windows registry for instructions.

1. Navigate to and select the following key:

HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\ open\command

CAUTION: The HKEY_LOCAL_MACHINE\Software\Classes key contains many subkey entries that refer to other file extensions. One of these file extensions is .exe. Changing this extension can prevent any files ending with an .exe extension from running. Make sure that you browse all the way along this path until you reach the \command subkey.

Modify the HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\ open\command subkey that is shown in the following figure:

4. Delete all text (on the shell=Explorer.exe line only) that is to the right of Explorer.exe. When you have finished, the line should read:

shell=Explorer.exe

5. Click File, click Exit, and then click Yes when you are prompted to save the changes.
6. Click Start, and click Run.
7. Type the following and then click OK:

edit c:\windows\win.ini

The MS-DOS Editor opens.

NOTE: If Windows is installed in a different location, make the appropriate path substitution.

8. In the [windows] section of the file, look for an entry similar to the following:

run=

9. Delete all text (on the run= line only) that is to the right of run=. When you have finished, the line should read:

run=

10. Click File, click Exit, and then click Yes when you are prompted to save the changes.
February 5th, 2004, 09:53 AM
gazzak

...and read this too...

more removal instructions
February 5th, 2004, 10:09 AM
jeffharding

Quote:

Originally Posted by gazzak

...and read this too...

more removal instructions

Thanks, I'll try it tonight.
February 6th, 2004, 12:08 AM
FatalException0E

Useless comment:
When I saw the title of this thread, the first thing I thought was, "All my EXE's live Texas..."
February 7th, 2004, 01:07 PM
gazzak

Any luck jeffharding?
February 8th, 2004, 03:07 PM
jeffharding

Quote:

Originally Posted by gazzak

Any luck jeffharding?

Yep, worked like a charm, thanks much!
February 8th, 2004, 03:33 PM
Matridom

For a sec there i thought it read "All my EX's Gone" and i was thinking.. that's not a bad thing.

But i digress
February 9th, 2004, 02:49 PM
gazzak

Quote:

Originally Posted by Matridom

For a sec there i thought it read "All my EX's Gone" and i was thinking.. that's not a bad thing.

But i digress

Quote:

Originally Posted by FatalExeptionOE

When I saw the title of this thread, the first thing I thought was, "All my EXE's live Texas..."

Great minds think alike?
February 10th, 2004, 07:57 PM
hi ho sliver

anti-virus

Ok..ongoing saga....I dropped zonealarm...I really haven't had any problems with it..but!! its gone, so is AVG. and I re-installed the updates I had deleted. The computer store tech also said I should drop outlook express and go to a web email...well I did and I can read it there, but would prefer to send thru outlook express, that way norton checks the emails...but another big BUT, now outlook express says there is an error in my "dial up" I have no dial up, am on cable? Also it would not let me export my address book to the web email....this stuff is a pain!! I have decided to forget all the other stuff...and get a Norton upgrade...I don't know enough about all this, or the programs available to mess with all of them..and Norton seems to be respected by about everyone. Any ideas how to fix the outlook express...oh yes it said that POP3 was in error? what in the world is pop3..something came up and said to send ,it had to be httm, pop3 or something else, my wife clicked on pop3 by mistake and now we can't figure out how to correct this mess! We can't find pop3 or httm?? Life is too short for all this ;)
February 11th, 2004, 05:14 AM
charlescpc

Quote:

Originally Posted by hi ho sliver

Ok..ongoing saga....I dropped zonealarm...I really haven't had any problems with it..but!! its gone, so is AVG. and I re-installed the updates I had deleted. The computer store tech also said I should drop outlook express and go to a web email...well I did and I can read it there, but would prefer to send thru outlook express, that way norton checks the emails...but another big BUT, now outlook express says there is an error in my "dial up" I have no dial up, am on cable? Also it would not let me export my address book to the web email....this stuff is a pain!! I have decided to forget all the other stuff...and get a Norton upgrade...I don't know enough about all this, or the programs available to mess with all of them..and Norton seems to be respected by about everyone. Any ideas how to fix the outlook express...oh yes it said that POP3 was in error? what in the world is pop3..something came up and said to send ,it had to be httm, pop3 or something else, my wife clicked on pop3 by mistake and now we can't figure out how to correct this mess! We can't find pop3 or httm?? Life is too short for all this ;)

I'm no expert on outlook express. But it sounds like your setting in outlook express got messed up. If it was working earlier you should be able to fix it back relatively easy.

You should be able to call your cable provider and they should be able to tell you the setting you need to get outlook express working again. It should just be a simple process.
They may have given you some kind of install disk that will help you set up your email.
Pop3 is just a protocal that outlook express uses.
Call you internet provider and they should be able to help. Sounds like it might be just a five minute phone call when you get through.
Hope that helps a little....
February 11th, 2004, 06:12 AM
NooNoo

Quote:

Originally Posted by hi ho sliver

Ok..ongoing saga....I dropped zonealarm...I really haven't had any problems with it..but!! its gone, so is AVG. and I re-installed the updates I had deleted. The computer store tech also said I should drop outlook express and go to a web email...well I did and I can read it there, but would prefer to send thru outlook express, that way norton checks the emails...but another big BUT, now outlook express says there is an error in my "dial up" I have no dial up, am on cable? Also it would not let me export my address book to the web email....this stuff is a pain!! I have decided to forget all the other stuff...and get a Norton upgrade...I don't know enough about all this, or the programs available to mess with all of them..and Norton seems to be respected by about everyone. Any ideas how to fix the outlook express...oh yes it said that POP3 was in error? what in the world is pop3..something came up and said to send ,it had to be httm, pop3 or something else, my wife clicked on pop3 by mistake and now we can't figure out how to correct this mess! We can't find pop3 or httm?? Life is too short for all this ;)

POP3 is a server. In your oe, tools, accounts, you put in the details. Your isp has the details for what goes in the POP3 box. Quite often they have a "how to" on line complete with screen pics so you can see what you are supposed to do. What isp do you have?

Zone Alarm is a firewall, AVG is a virus checker, with Norton it depends what setup you have as to whether you have any firewall capability. If you are on broadband, a firewall is a must.