“start” action on right-click

Question

I was hit with a virus the other day. It was one of the viruses that pretend to be anti-virus software and keep hitting you with fake warning messages.

I ran spybot and malware bytes, and the virus, i think was removed.

I have noticed that when I right-click on an executable, I get an option called "start".

This looks fishy to me because it isnt even capitalized, and it is very vague.

I have updated spybot and malware bytes, and ran them again, but both programs found nothing.

Any ideas?

Answer 1

You hit two of the three legs in the stool. Try running SUPERAntiSpyware. The name and the site are cheesy, but I've had good results with it catching things the other two have missed.

Answer 2

I've had great success with Microsoft Security Essentials. Its free. Its fast. Its not annoying.

Answer 3

You could use Autoruns to find the context menu handler setting that "Start" function, but I'd save that for after I'd run a few more full scans while in safe mode or with the hard drive slaved into another box for the scan.

Answer 4

It is common for malware to do this so exe will not launch and instead popup a message saying the file is infected, to fix this you will need to modify the registry:

Save the code below as a .reg and execute it, it should correct the issue:

Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\exefile\shell\open\command]
    @="\"%1\" %*"
    "IsolatedCommand"="\"%1\" %*"