up vote 5 down vote favorite
share [g+] share [fb]

I had a virus on my computer and was able to remove it, however, now almost all of my programs won't work. Even trying to open freecell pulls up the "select a software to run this in" window. I can't even install software anymore because after downloading a setup file and clicking on it, it too opens the "choose a program to run this in" window. I'm trying to find a way to fix without reinstalling the OS. Does anyone know a way to restore the file/files that are missing that are causing this problem without starting over?

link|improve this question
1  
+1 extremely difficult problem. – SLaks Apr 25 '10 at 14:36
2  
You should associate your accounts; this will give you 100 reputation. – SLaks Apr 25 '10 at 14:36
feedback

2 Answers

up vote 6 down vote accepted

The registry entry for .EXE files has been modified.

You need to boot the computer to a functioning copy of Windows (Such as WinRE on the Vista install CD), run regedit, mount the file \WINDOWS\system32\config\SOFTWARE, and set the (Default) value of the registry key Classes\exefile\shell\open\command to "%1" %*. If it is already, make sure that the (Default) value of the key Classes\.exe is exefile.

Also, (I'm curious), please tell us what that value is now.

I don't think there is any way to do this without a second copy of Windows; however, yuo can try using explorer to copy Regedit.exe as regedit.com.

link|improve this answer
Caught me writing something similar! +1 – William Hilsum Apr 25 '10 at 14:27
And if I don't have the vista install cd anymore? – Bryan Apr 25 '10 at 14:28
Any install CD for Vista / Windows Server 2008 or later will do, even the trial versions. – SLaks Apr 25 '10 at 14:34
Also, if explorer works (press Windows+E), try copying regedit.exe from WINDOWS\system32 and renaming the copy to end in .com; if the copy runs, you can do it there. (Don't mount any file; replace Classes in my instructions with HKEY_CLASSES_ROOT) – SLaks Apr 25 '10 at 14:35
Sorry it took me so long. I booted with a copy of windows 7 I had and opened the registry editor, got to HKEY_CLASSES_ROOT \exefile\shell\open\command and Default and IsolatedCommand both have under the Data header a value of "%1" %* and for the Classes\.exe the Default has exefile in there already. Is there supposed to be anything else in there? – Bryan May 21 '10 at 12:57
show 15 more comments
feedback
up vote 1 down vote

I suggest running the system restore utility to revert your computer's state back to before you had the virus. Do this by:

  1. Press windows+r to bring up the run utility
  2. type in rstrui and hit enter
  3. follow the steps and choose an appropriate restore point (windows should make them for you automatically at regular intervals)
link|improve this answer
This will not work. (rstrui is an exe file and will not run) – SLaks Apr 25 '10 at 17:43
I thought that would work. Can you boot into safe mode with the command prompt? It is possible to make changes to the registry through the command line. After that you can activate rstrui from the command prompt as well. – Jonno_FTW Apr 26 '10 at 4:01
You can't – it's an EXE. Almost anything you can do (including cmd) is an exe file. – SLaks Apr 26 '10 at 17:54
Then you'll have to find an install disc and use the repair installation feature from there. This seems the only reasonable solution without going for a complete reinstall. – Jonno_FTW Apr 27 '10 at 23:28
No; you can mount and edit the registry from a different copy of Windows. See my answer. – SLaks Apr 28 '10 at 14:05
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.