3

I'm cleaning up a Windows 7 computer that was infected with malware. I pulled the HD out, hooked it up to my machine with a USB adapter and then scanned it with MalwareBytes which found (2) Trojan.FakeAlert files from C:\Users\%username%\AppData\Local\ and (1) Trojan.FakeAlert file from Temporary Internet Files. I went ahead and told Malwarebytes to remove the files which it did successfully.

The computer appears to run OK now except I can't get into anything without getting the following error message:
The version of this file is not compatible with the version of windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher.

I get this error message when trying to use Regedit, Task Manager, Windows Update, System Restore, msconfig, Internet Explorer, Google Chrome, etc. It appears this problem affects all .exe files.

I should add that the error prevents the program from running.

How can I get rid of this error message and allow Windows programs to run normally? (Sorry I failed to put my question in right from the beginning.)

Edit1:
The names of the malware files removed are:
dpc.exe
vew.exe
download[1].exe

Edit2:
I've discovered that I can avoid the error message and make any program run normally by right clicking and choosing Run as Administrator. I'm currently downloading and installing MalwareBytes on this machine. I'm suspicious there might still be some malware running on this machine.

Edit3: The symptoms have now changed slightly. If I double-click on Internet explorer I get the "Open With" window. If I choose Task Manager from the TaskBar right-click menu, I get an error message: Application Not Found I'm pretty sure this is a problem that can be corrected in the Windows Registry. I remember fixing this issue, or a similar one, on Windows XP but I don't remember anymore how I did it.

2
  • Please ask a question. Also try adding a program to startup menu. This might start it before the virus kicks in. If nothing helps, try with Kaspersky rescue Disk 10 or something similar to scan the computer form another OS (the disk runs live GNU/Linux distribution and downloads newest virus definitions).
    – AndrejaKo
    Jun 27, 2011 at 18:51
  • 1
    Do yourself a favour - backup, format, and reinstall. It's safer that way ;) Jun 27, 2011 at 18:56

2 Answers 2

1

After you mentioned fixing this in XP before, you made me remember a reg file one of the other admins at my job keeps on his FTP. I have used it once on a users PC who was having the exact same issue as you (only he had xp) after I removed some malware. I figure I will post it here since it may help you out, even if it just points you in the right direction:

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"

If you want to try testing this back up HKEY_Classes_Root first, then paste the above text into notepad and save it as .reg then double click the file to import it. You made need to do it in safe mode. If it works for 7 please let me know!

UPDATE

I tried to import this key in an (ill advised) attempt at testing to make sure this wouldn't hose your PC. Windows 7 didn't take the file not really sure why... I don't have the time to look at it right now but I hope it at least points you towards the keys you should be looking at.

3
  • I cannot confirm that this for sure works in Windows 7. I installed and ran MalwareBytes and it did resolve the issue. I'm pretty sure it fixed the same thing you've just posted here. MalwareBytes called it .exe Hijack, or something like that.
    – HK1
    Jun 27, 2011 at 19:44
  • O cool @HK1 was this what you remembered looking for? Jun 27, 2011 at 19:45
  • Yep. I remember fixing this same issue on XP using the information you have posted above.
    – HK1
    Jun 27, 2011 at 20:58
0

Assuming your answer is how to fix the problem in bold, you can try running sfc /scannow from the command line. This will scan and repair your core system files.

I am assuming the problem is caused by the virus attempting to replace a file, but it got the wrong version. The breadth of the problem suggests it is a core file.

You can find more information here about how sfc works and how to use it.

3
  • running now. I didn't expect the command line or sfc to load. I figured I'd get the same error message.
    – HK1
    Jun 27, 2011 at 18:55
  • sfc /scannow did not find any problems. However, I should mention that I can open programs such as regedit from the command line.
    – HK1
    Jun 27, 2011 at 19:04
  • I would follow Breakthrough's advice at this point. The problem with this is that if the virus was messing with core system files, there is a chance a rootkit was installed. Since the error isn't being fixed easily, I would suggest the safe path and reinstall. That is unless you have a copy somewhere already, but most people don't. If you do, kudos!
    – Camron B
    Jun 27, 2011 at 19:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .