major ugh

[Noodlez]

i decided to do a trojan scan today because my computer was running sluggish, and i found one. to sum it up, i deleted it and removed every file that has anything to do with it.

the problem?

now, *every* program gives me "<name> is not a valid win32 application" for some reason the programs that are built into windows (IE, for example) are running.

*PLEASE* help

edit-
i cant even access regedit

[Noodlez]

ok, so i found out all exe's launch unwise.exe. i put notepad there and notepad will launch.

i need to find a way to make exe's launch them self...or make a program to launch whatever its told

but, seeing as i cant open vb right now thats kind of hard

[l)ragon]

what os 8\

[n00blar]

http://www.lib.utk.edu:90/files/polsci/311/plaas

Are you referring to the Shell() function in visual basic?

[Grok]

I dont know what operating system you have, but if you have Windows 2000, save this as a .reg file and run it.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]
"Extended"=""

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies]

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\command]
@="C:\\VSTUDIO\\Common\\Tools\\DEPENDS.EXE /dde"

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\ddeexec]
@="[open(\"%1\")]"

[HKEY_CLASSES_ROOT\exefile\shell\View Dependencies\ddeexec\Application]
@="DEPENDS"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}]
@=""

[Grok]

Oh, you can remove the lines that reference "View Dependencies" unless you have Visual Studio.  Even then you'll need to correct the path.

Someone has hijacked Exefile in your HKCR.  It's a pretty common way to install a trojan.  Guarantees that their program gets run every time you run an exe.

[Noodlez]

/me gives grok a huge hug

it worked! thanks so much

[iago]

Damn, you got here faster :-P

The same thing happened to me a long time ago, and it fixed it the same way.  Windows really ought to provide a built-in way to fix .exe's