Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sorry the question title isn't very helpful.

Anyway, every so often (week or so, irregular intervals) my computer just stops working properly. I get a program claiming to be something like "Win7 Security 2012". It reads all of my files and marks random ones with random "virus" warnings. It hooks into .exe binaries and claims that they are keyloggers and trojans and should be deleted. If I happen to have a browser already open, it blocks all HTTP requests and claims that the site I'm trying to access contain malware.

The program is located in %LOCALAPPDATA% and has what appears to be three random letters (it changes each time and sometimes there's two of them) followed by .exe. If I kill it in Task Manager (which I can only get to via Ctrl+Alt+Delete => Start Task Manager) it just comes back again. If I delete the file, I can no longer run .exes because it asks me what program to open them with (which is of course an infinite loop).

The only way I can fix this is to run System Restore. I'm assuming that it's something in the registry that's being restored.

Can someone please tell me how to make .exes run on their own again, and optionally find out where these .exes are coming from and how to block them in future? Bonus points if you can tell me if it's possible (and if so how) to "protect" the .exe entry in the registry to stop it happening again.

share|improve this question
1  
have you tried the usual proper AV stuff like malwarebytes or combofix? There's a question/community wiki on it. Failing which, back up, and nuking it would be a good idea, since what you have is obviously a rather pesky persisitant virus –  Journeyman Geek Jan 9 '12 at 4:15
1  
My answer to superuser.com/questions/314830/… will get .exe running again. I think you have a corrupted backup (the virus is in it) –  soandos Jan 9 '12 at 4:17
    
Yes, I have tried AV, antimalware, rootkit finder, everything I could think of. I could nuke the computer (I have full backup with JungleDisk) but I would rather not if an alternative is available because then I'd have to get all of my programs installed again. –  Niet the Dark Absol Jan 9 '12 at 4:18
    
@Kolink, does the patch allow you to run .exe s again? –  soandos Jan 9 '12 at 4:24
    
I imagine it would. Obviously I can't test it until I get the problem again, but I'm pretty sure that would fix it. –  Niet the Dark Absol Jan 9 '12 at 4:29

1 Answer 1

up vote 0 down vote accepted

Seen it before. If you can pull out the hard drive and put it into another computer, delete the files in question from your %APPDATA%\Local folder, which are probably hidden. Otherwise, start in Safe Mode with Networking. Download the .EXE fix (directions to create it from Microsoft are here). Once you apply that fix, you can run applications. Connect to the internet and download a program such as Malwarebytes Antimalware and run a scan (NOTE: Link is from Ninite to get the install right away). Do a full system scan, then you can restart your computer in normal mode

share|improve this answer
    
FYI I have never downloaded a single piece of pirated software. As a developer myself I am strongly against such practices and would appreciate it if you didn't accuse me of them. –  Niet the Dark Absol Jan 9 '12 at 6:03
    
@Kolink Appologies, removed the comment –  Canadian Luke Jan 9 '12 at 8:16
    
Answer accepted, because it just happened again (I wasn't even doing anything at the time, just idling) and this answer helped a lot. btw, can anyone tell me how to track the source of an exe? Windows can ("Downloaded form the Internet" / "CD-DVD" / "Hard drive on local machine" etc) so can I? –  Niet the Dark Absol Jan 13 '12 at 0:36
    
That would be another question, but it's basically from the ADS (Alternate Data Stream). I don't know how much info it stores though –  Canadian Luke Jan 13 '12 at 0:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.