My Anti Spyware

[lizfromerma]

Hello. I am new here so please excuse if I don't know very much. Used my computer last week. I was about to log off when I got a message about some kind of virus or whatever. I thought it was my AVG program so when it ask me if I wanted to remove it I said yes. I really was not paying attention. Came back that afternoon and all my .exe extensions are turned to .ink. Not only that, but when I try to download any kind of help program it automatically gives me the message"windows cannot open this file because it doesn' have a program associated with it etc,." I can get on the internet and also access my email but that's it. I am really getting desperate because I have been to many!! help sites but I cannot access their programs. I looked in my registry key HKEY_CLASSES_ROOT\exefile\shell\open\command and it is set to "%1 %*. So I GUESS IT IS NOT SIRCAM VIRUS. I JUST REALLY NEED HELP. THANK YOU TO ANYBODY THAT CAN HELP. Liz Eisele

[12056]

Preliminary Steps:
Please download FixNCR.reg and save it to your desktop.
Double-Click the FixNCR.reg file to activate the fix, when prompted, click "YES".

Then, download RKill to end currently infected processes.

Removal Steps:
Please download TFC to your desktop,
Save any unsaved work. TFC will close all open application windows.
Double-click TFC.exe to run the program.
If prompted, click "Yes" to reboot.

Please download ComboFix from here.
Close your browser, and Double-Click on the tiger icon.
Let ComboFix run unhindered, mouse clicks may cause it to stall.
Your computer may restart, after the scan, this is normal.

Please post the ComboFix log, it will appear after the restart.

[lizfromerma]

Thank you for responding so quickly. I am going to try what you said, but the problem is that even when I download a fix off the internet I can't open it because it seems not to let me open anything .com, .exe, nothing. The only thing I've been able to do was to run the scanner on microsoft but it could not fix most of the problems. I will answer if it works. Here's hoping. Liz Eisele

[lizfromerma]

Hi! I just tried downloading the first program and no luck. I try to change the program to open it but all the program ex. are corrupted. If you have anything else I would appreciate it. I also tried to run the housecall scanner on trend but could not do it.

[12056]

Did you try running the FixNCR.reg file first?
This file will restore the registry associations for .exe,.com, etc...

[lizfromerma]

Yes, I click on the link and it asks me if I want to run it and I click run then it just goes off. It doesn't run or anything.
(RE: FixNcr.reg) Thanks, Liz Eisele

[12056]

Try FixShell by Prevx.

fixshell.zip

or EXEHelper

Extract the ZIP file to your desktop, double-click on fixshell.exe and when prompted click "YES".

And/Or

Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)

[lizfromerma]

I unzipped fixshell and that worked but when you open the folder contents and it asks you if you want to run this program, yes, but it won't run. This is really getting crazy. I hope I don't have to clean everything off the computer. Even the people who make the virus program I have (AVG) are having a hard time finding a solution. Thanks again, Liz E.

[12056]

You must be logged in as an Administrator to use these tools, it is also recommended that you temporarily disable UAC (User Account Control).

Please right-click the file, Click "Properties", then at the bottom right there should be a button labeled "Unblock", click it.
Or,
Right-Click the file as choose "Run as Administrator".

Let me know if this doesn't work , so that I can seek alternate solutions...

[lizfromerma]

Hi! I am logged on as administrator. I don't know where to disable UAC. If it is in system info or system tools I cannot open them either. I even tried downloading onto a flash drive, but I knew better and it just did the same thing on opening them. I really do appreciate all of your help. This is really the worse thing I've ever had. I have been able to get out of and fix alot of things with my computer but this stinks! Thanks again, Liz E.

[lizfromerma]

Just thought I'd let you know, last nite I found an online scanner that I did not have to download (BIT DEFENDER). I definitely have a virus. I thought they were fixing it also; at least that is what it implied. It took all my info and maybe they are going to send it to me. Anyway I am still with the same problem. I went to a site called www.tomshardware.com/forum/77700-45-files-open. THere are a number of fixes that you do to the registry yourself. I never did that before and I am afraid to make things worse. Could you look at it and see if you think it is any good? Thank you, Liz E.

[12056]

Try downloading UnHookExec.inf.
Right-Click the file and click install.
(Note: This is a small file, but powerful tool, It does not display any notice or boxes when you run it.)

Then try running Combofix again.

[lizfromerma]

Hi. I haven't done what was suggested on the last post yet, but I found 3 things from the Bit Defender online scanner. I had alot of stuff wrong, but now I am left with these: "ADware.hotbar.GG, Exploit.HTML.MHT, Trojan.Script.14669. Any suggestions? Also, if I can get rid of these will my .exe files automatically go back to normal? Thanks, Liz E.

[12056]

The .exe problem will only go away with the reistry fix (provided in my last post).
We can work on the infections, once you fix this!

[lizfromerma]

Tried to install the file but when I did (right click install) it gave me the windows cannot open this file message and it listed it as an .exe file. I am sorry to be such a pain. Thanks Much, Liz E.