2

Sorry the question title isn't very helpful.

Anyway, every so often (week or so, irregular intervals) my computer just stops working properly. I get a program claiming to be something like "Win7 Security 2012". It reads all of my files and marks random ones with random "virus" warnings. It hooks into .exe binaries and claims that they are keyloggers and trojans and should be deleted. If I happen to have a browser already open, it blocks all HTTP requests and claims that the site I'm trying to access contain malware.

The program is located in %LOCALAPPDATA% and has what appears to be three random letters (it changes each time and sometimes there's two of them) followed by .exe. If I kill it in Task Manager (which I can only get to via Ctrl+Alt+Delete => Start Task Manager) it just comes back again. If I delete the file, I can no longer run .exes because it asks me what program to open them with (which is of course an infinite loop).

The only way I can fix this is to run System Restore. I'm assuming that it's something in the registry that's being restored.

Can someone please tell me how to make .exes run on their own again, and optionally find out where these .exes are coming from and how to block them in future? Bonus points if you can tell me if it's possible (and if so how) to "protect" the .exe entry in the registry to stop it happening again.

Improve this question
6
  • 1
    have you tried the usual proper AV stuff like malwarebytes or combofix? There's a question/community wiki on it. Failing which, back up, and nuking it would be a good idea, since what you have is obviously a rather pesky persisitant virus
    – Journeyman Geek ♦
    Jan 9, 2012 at 4:15
  • 1
    My answer to superuser.com/questions/314830/… will get .exe running again. I think you have a corrupted backup (the virus is in it)
    – soandos
    Jan 9, 2012 at 4:17
  • Yes, I have tried AV, antimalware, rootkit finder, everything I could think of. I could nuke the computer (I have full backup with JungleDisk) but I would rather not if an alternative is available because then I'd have to get all of my programs installed again.
    – Niet the Dark Absol
    Jan 9, 2012 at 4:18
  • @Kolink, does the patch allow you to run .exe s again?
    – soandos
    Jan 9, 2012 at 4:24
  • I imagine it would. Obviously I can't test it until I get the problem again, but I'm pretty sure that would fix it.
    – Niet the Dark Absol
    Jan 9, 2012 at 4:29

1 Answer 1

Reset to default
0

Seen it before. If you can pull out the hard drive and put it into another computer, delete the files in question from your %APPDATA%\Local folder, which are probably hidden. Otherwise, start in Safe Mode with Networking. Download the .EXE fix (directions to create it from Microsoft are here). Once you apply that fix, you can run applications. Connect to the internet and download a program such as Malwarebytes Antimalware and run a scan (NOTE: Link is from Ninite to get the install right away). Do a full system scan, then you can restart your computer in normal mode

Improve this answer
4
  • FYI I have never downloaded a single piece of pirated software. As a developer myself I am strongly against such practices and would appreciate it if you didn't accuse me of them.
    – Niet the Dark Absol
    Jan 9, 2012 at 6:03
  • @Kolink Appologies, removed the comment
    – Canadian Luke
    Jan 9, 2012 at 8:16
  • Answer accepted, because it just happened again (I wasn't even doing anything at the time, just idling) and this answer helped a lot. btw, can anyone tell me how to track the source of an exe? Windows can ("Downloaded form the Internet" / "CD-DVD" / "Hard drive on local machine" etc) so can I?
    – Niet the Dark Absol
    Jan 13, 2012 at 0:36
  • That would be another question, but it's basically from the ADS (Alternate Data Stream). I don't know how much info it stores though
    – Canadian Luke
    Jan 13, 2012 at 0:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .