Super Nasty Virus

[natejj]

I offered to fix a friend's PC for her, it has some crazy virus's on it.

Running windows XP, first virus i notice is XP Total Security 2011. Problem is, I can't run any EXE files, REGEDIT, or installers. This is making me very frustrated as I can put virus removal software on the PC, but cant run it. I can't access any web browsers either. No luck in safe mode either.

Any immediate solutions come to mind? I've tried to kill a ton of tasks in the task manager, but everytime I attempt to run an .exe, such as MABM, or combofix, it just restarted "XP Total Security 2011", the virus.

[DENZILDON]

Have you tried working in safe mode?

[natejj]

Originally posted by DENZILDON
Have you tried working in safe mode?

Yes, the virus still runs in safe mode. Any time i try to launch an EXE, it just launches "XP Total Security 2011".

[YamahaV8]

Originally posted by natejj
No luck in safe mode either.

Originally posted by DENZILDON
Have you tried working in safe mode?

[Thaco]

google for an exe association regfix, that helped me fix this

[phreezee]

You need to run a registry fix script, copy and paste this into notepad and name it fix.reg:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\pezfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[taemo]

have you tried running MBAM through command prompt while on safemod?

I was dealing with the same issue last week where even on safemod the malware keeps on running and not allowing me to install MBAM, so I just opened CMD and run the exe from there.

[natejj]

Originally posted by phreezee
You need to run a registry fix script, copy and paste this into notepad and name it fix.reg:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\pezfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

So far, this is working! Thank you.

[superflychief]

I had this on my laptop a couple of weeks ago. I went into safemode and did a system restore to a point a couple of days before the virus hit and problem solved. It was a nasty one.

[phreezee]

Originally posted by natejj


So far, this is working! Thank you.

Use Malware Bytes to remove the virus, and you're done.

[revelations]

Originally posted by phreezee


Use Malware Bytes to remove the virus, and you're done.

As per OP, the virus prevents any programs from running on your system (including web browsers).

On a system I was working on suffering from same, the owner happened to have URL hyperlinks on their desktop.

Clicking these still worked and I was able to go to the Trend on-line virus scan site and clean the box.

Even MSE wasnt able to help with its "real time" scanning tool installed and running at the time.

[beecue]

My dad had this on this laptop. I think I just downloaded MB on my computer and renamed it to explorer and ran it on his laptop.

[phreezee]

Originally posted by revelations


As per OP, the virus prevents any programs from running on your system (including web browsers).

Reading fail, I posted the fix to his exe problem.

[n1zm0]

then after you fix it, tell her to stop opening up emails that say "hey long time no see...' from: [email protected] :P

side note: im amazed how some ppl surf the internet, read the urls if youre unsure, you can usually spot a bs site right away with url.

[SilverGS]

Yup, the fun part is figuring out the virus has mapped anything with a .exe extension to run the virus itself.

Another way you can get rid of it is to run the portable version of antispyware. It will remove the registry mappings but you will still need to remap your .exe mapping aftewards as per phreezee's fix still.

[3drian]

I ran into a similar problem last week, I did a system restore to 2 weeks before and it worked like a charm

[Proyecto2000]

we had 2 computers infected with this at work and my personal computer at home while on youtube last week. We tried removing it with malwarebytes but things where still not working properly so we reformated the drives

[Seth1968]

Here's a .exe fix that doesn't require you to edit the registry, nor is it contingent upon the version of Windows you use:

http://www.superantispyware.com/down...FixEXEfile.com

[Toma]

Weird, I just had this thing as well.

I have no idea what I did, but I kept shutting down odd looking programs in task manager.

Then, when I went to run malaware bytes, it asked what program I wanted to use to open the program. I chose malwarebytes lol...

and it fixed it.

Weirdest thing I ever had.

And I honestly have no idea where it came from. Someone said it was from googles ad sense or whatever it's called.

[taemo]

out of curiosity, everyone that got infected, are they using IE?

I've used Firefox since 03, Chrome since last year and never had any virus