I was hit with a virus the other day. It was one of the viruses that pretend to be anti-virus software and keep hitting you with fake warning messages.

I ran spybot and malware bytes, and the virus, i think was removed.

I have noticed that when I right-click on an executable, I get an option called "start".

enter image description here

This looks fishy to me because it isnt even capitalized, and it is very vague.

I have updated spybot and malware bytes, and ran them again, but both programs found nothing.

Any ideas?


You hit two of the three legs in the stool. Try running SUPERAntiSpyware. The name and the site are cheesy, but I've had good results with it catching things the other two have missed.


I've had great success with Microsoft Security Essentials. Its free. Its fast. Its not annoying.

  • 1
    +1 - To continue mixing metaphors, the other shoe that needs to drop is keeping AV software up to date. This is the one I use. – Ray Mitchell May 23 '11 at 19:29

You could use Autoruns to find the context menu handler setting that "Start" function, but I'd save that for after I'd run a few more full scans while in safe mode or with the hard drive slaved into another box for the scan.


It is common for malware to do this so exe will not launch and instead popup a message saying the file is infected, to fix this you will need to modify the registry:

Save the code below as a .reg and execute it, it should correct the issue:

Windows Registry Editor Version 5.00

    @="\"%1\" %*"
    "IsolatedCommand"="\"%1\" %*"

Try right click enhancer's right click editor tool. this tool can easily remove this.

Download Right Click Enhancer


Download SheelExView:

Run it. Once the extensions are loaded, sort them by Type.
Check for entries with "Context Menu" type.
You should find the suspicious entry there.
Disable/Delete it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.