Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently got some malware on a machine that I don't use for much (partly intentional). I've cleaned it, but now everytime I open any .exe the 'Run As' dialog pops up asking me which user I want to use to run the program.

What causes this, and what's the fix for it?

edit> My process to remove the malware was as such:

  • Disconnected from the network
  • Deleted DisableTaskMgr reg key
  • Inspected with Process Explorer and Task Manager and noticed that all applications were being run within another executable located in Documents and Settings...\Temp\Some.exe
  • The system tray application was also in Documents and Settings...\Temp\SomeOther.exe
  • I suspected that a service was in place as the system tray application would restart if it was killed, but couldn't find any service that I didn't recognize.
  • Removed permissions from Some.exe and SomeOther.exe (on those files only)
  • Restarted and deleted Some.exe and SomeOther.exe
  • Deleted startup entries that were created
  • Ran AVG Free and Windows Defender to remove anything else (they would be killed immediately before the two .exe's were removed)
  • Cleaned registry via CCleaner

note that system restores would finish saying something to the effect of 'couldn't restore system: there were no changes made'. I attempted to restore to a week ago, and I only got the malware yesterday.

share|improve this question
    
Could you tell us what you did to get rid of the virus, I have a feeling it will be highly relevant. This dialog only comes up with you don't have permission to run the executable you are trying to use. Your account might have lost permissions (assuming you were origionally admin, or the files on your computer might have corrupted properties). –  Daisetsu Jun 29 '10 at 19:24
    
@Daisetsu: The account has permissions, because I can use the account in the run as dialog without problems, but it always asks. I suspect there might be a user account reg setting for all .exes. –  SnOrfus Jun 29 '10 at 21:31
    
This may be to general, but it sounds like you have some corrupted system files then. It might be worth a try to use your Windows CD to repair the installation. –  Daisetsu Jul 1 '10 at 16:45

2 Answers 2

This forum post suggests that disabling the Run As command in Explorer will also fix the behaviour you don't like. It seems a bit kludgey though as it will also remove the Run As command in Explorer for legitimate use.

It's more likely that registry keys for running EXE files have been left damaged. I believe you want to restore HKEY_CLASSES_ROOT\exefile\ and it's sub keys to the right information. This article suggests some ways to do that. FAIR WARNING: I haven't tried this and don't know if the information in the article is correct. Searching for HKEY_CLASSES_ROOT\exefile will yield an number of other articles and forum posts that sound like your problem. Again I don't know if the information is correct.

You could also compare those registry keys against a known good PC. Perhaps there's only one or two that need tweaking to correct the issue.

Always back up the registry before making changes. Save the backup somewhere that's not on the PC you are trying to fix just in case.

share|improve this answer

This should be easier to fix than it seems. Just paste the text below into Notepad, save the file with a .reg extension, then double-click the file and confirm. Now try re-opening an executable... did it work correctly? (This is for Windows 7 -- if you have another version, this might need to be slightly different.)

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.