Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was hit with a virus the other day. It was one of the viruses that pretend to be anti-virus software and keep hitting you with fake warning messages.

I ran spybot and malware bytes, and the virus, i think was removed.

I have noticed that when I right-click on an executable, I get an option called "start".

enter image description here

This looks fishy to me because it isnt even capitalized, and it is very vague.

I have updated spybot and malware bytes, and ran them again, but both programs found nothing.

Any ideas?

share|improve this question

6 Answers 6

You hit two of the three legs in the stool. Try running SUPERAntiSpyware. The name and the site are cheesy, but I've had good results with it catching things the other two have missed.

share|improve this answer
3  
I've never heard of this tool before today, which sets my skeptic bells ringing. Anybody else ever used this? –  Shinrai May 23 '11 at 18:59
1  
    
Thanks for links to reputable sources, @Ray. I'll have to look into this app. (And now let's see how long it takes for somebody to call one of those 'not reputable'...) –  Shinrai May 23 '11 at 20:13
    
I've used it. It caught things other programs missed. –  Xavierjazz May 23 '11 at 21:27
    
good info but not the actual answer to question... –  tumchaaditya Jun 13 '12 at 8:22

I've had great success with Microsoft Security Essentials. Its free. Its fast. Its not annoying.

share|improve this answer
1  
+1 - To continue mixing metaphors, the other shoe that needs to drop is keeping AV software up to date. This is the one I use. –  Ray Mitchell May 23 '11 at 19:29

You could use Autoruns to find the context menu handler setting that "Start" function, but I'd save that for after I'd run a few more full scans while in safe mode or with the hard drive slaved into another box for the scan.

share|improve this answer

It is common for malware to do this so exe will not launch and instead popup a message saying the file is infected, to fix this you will need to modify the registry:

Save the code below as a .reg and execute it, it should correct the issue:

Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\exefile\shell\open\command]
    @="\"%1\" %*"
    "IsolatedCommand"="\"%1\" %*"
share|improve this answer

Try right click enhancer's right click editor tool. this tool can easily remove this.

Download Right Click Enhancer

share|improve this answer

Download SheelExView:
http://www.nirsoft.net/utils/shexview.html

Run it. Once the extensions are loaded, sort them by Type.
Check for entries with "Context Menu" type.
You should find the suspicious entry there.
Disable/Delete it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.