7

We have a user who is unable to open some .exe files by any means except for right-clicking on the file and selecting "Run as...", and specifying login info.

I've tried opening the file a number of ways. By default, it should be launched by another program, however I've also tried double-clicking it to open it, and starting it from the command prompt using start MyFile.exe

When trying to launch an executable, nothing appears to happen. The program does not appear in Task Manager and nothing appears to be getting started up at all.

But I still get EventId 592 in the EventManager saying "A new process has been created" and specifying the executable's name, and immediately afterwards there is EventId 593 saying "A process has exited" for the executable.

Right-clicking the file and using "Run as..." does not work if I choose the "Current user" radio option, however specifying "The following user" option and filling in the credentials for the current user works fine.

All the programs that are failing to open begin with a 3rd login control and use a 3rd party control library, however not all programs that start with that login control or use that 3rd party control library are failing to open.

What can cause this behavior, and what do I need to do to fix it?

Improve this question
  • Out of curiosity, are you on a domain and is this issue on a local machine or over terminal services? – Dave Mar 13 '13 at 14:17
  • @DaveRook The PC is part of our network domain, however it is a standalone computer and running applications locally. The problem occurs regardless of which profile is used to login to the machine. – Rachel Mar 13 '13 at 14:23
  • I wonder if this is a problem that it requires AD information, doesn't access it but the Run As performs some sort of look up – Dave Mar 13 '13 at 14:25
  • 1
    @Rachel - You had malware on this system? Why are you not using a restored configuration for the pc? – Ramhound Mar 13 '13 at 14:52
  • 3
    @Rachel - You don't have a standard configuration image? I am trying to suggest you nuke the current image. Clearly the malware did more damage then you thought. I would ran sfc /scannow before you do anything. You need to repair those files before we can give you any other suggestions. Send a digital image of a system disk have somebody in the remote office burn the disk, then use that disk to repair the system files. – Ramhound Mar 13 '13 at 15:00
2

First thing that comes to mind is that a virus/trojan hijacked the .exe class by inserting a wrapper executable, and when you removed that virus, you lost that wrapper. I would check registry key HKEY_CLASSES_ROOT.exe entry and see if anything funny is going on there, possibly restoring it from another windows installation.

Improve this answer
  • 3
    This by far is the most evil thing about windows. You can write a registry entry and disable EVERY DAMN EXECUTABLE by putting a wrapper around it and running malware instead. – Rich Homolka Mar 13 '13 at 17:37
  • Thanks, but I checked both exefile and .exe against another XP machine and neither have anything unusual – Rachel Mar 14 '13 at 12:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.