Application cannot be executed. The file *.exe is infected.

[mstolp]

Would you be able to help me figure out how to recover my PC that displays this pop-up whenever I try to execute anything (Application cannot be executed.  The file *.exe is infected).

Mark

[Allan]

http://www.computerhope.com/forum/index.php/topic,46313.0.html

[mstolp]

I tried to follow the instructions and got the following results:

- I have Service Pack 3 installed.
- No TeaTimer installed.
- ClamWin installed but can't open it to run.
- Can't download any of the anti-virus software.  I tried installing some software from my USB Flash Drive.  So, I can't get any traces.
- I found the following programs that I'm not sure if I installed them:  AdwareSpy, Google Talk, Indeo Software, Learnout & Hauspie TruVoice American English, NROS, PS2, Spybot - Search & Destroy 1.3, and Spyware Doctor 3.1.

Mark

[mstolp]

I'm still not able to do anything with this computer.  I forgot to mention that I'm getting a pop-up from 'Antivirus Soft' and it start a scan of this computer.  This virus (or whatever it is) starts up internet explorer to a porn page (very annoying).  So, I disconnected the wire.  I noticed another posting where the person was instruction to overcome the problem with .exe files not working.  I haven't tried that because the thread warned that we shouldn't try using another persons instructions to fix our problem.  So, I'm waiting for instructions from you.  I appreciate any help you can offer.  Unfortuneately, I wasn't able to complete all the steps described in the link you gave me because I can't download anything or execute anything.

Mark

[mstolp]

I noticed a problem reported by Jdog66 regarding 'Need Help Removing Malwar'.  It looks identical to my problem.  Can I use those instructions?

Mark

[evilfantasy]

http://www.computerhope.com/forum/index.php/topic,46313.0.html

You risk damaging your operating system using instructions for other computers. Follow the above link and post the logs.

[mstolp]

I've read the instructions using the link you gave me but I can't get any logs.

I'm at 'Step A: Antivirus'.  I have ClamWin installed but I don't think it's doing any good.  So, I tried downloading avast but the internet explorer keeps getting misdirected when I enter www.avast.com.

Is there a way to get around the misdirected internet site problem.

Mark

[evilfantasy]

Skip down to the HijackThis instructions and see if you can get that to run.

ClamWin does not have any real time protection so no it isn't doing any good.

[mstolp]

Unfortunately, that didn't work.  I copied HijackThis.exe to my flash drive and then copied it to the infected PCs desktop.  When I double click on it I can see the installation pop-up but the pop-up previously described always overrides the install pop-up (Application cannot be executed.  The file HijackThis.exe is infected).

Any ideas?

Mark

p.s. - I just noticed that HijackThis.exe was indeed installed under Program Files but when I followed the rest of the instructions.  Trying to open sniper on the desktop displays a license agreement but before I can accept the same old pop-up shows up again.

[evilfantasy]

Try not to restart the computer until one of the tools we use does it for you or tells you to.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
 
There are 4 different versions. If one of them won't run then download and try to run the next one.
 
Vista and Windows 7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.pif
* Rkill.exe

* Double-click on the Rkill desktop icon to run the tool.
* If using Vista or Windows 7 right-click on it and choose Run As Administrator.
* A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
* If not, delete the file, then download and use the one provided in Link 2.
* If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
* Do not reboot until instructed.
* If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run then try to immediately run the following.

 
Download and run exeHelper

* Please download exeHelper from Raktor to your desktop.
* Double-click on exeHelper.com to run the fix.
* A black window should pop up, press any key to close once the fix is completed.
* A log file named log.txt will be created in the directory where you ran exeHelper.com
* Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).


Download ComboFix from one of the below links. You must rename it before saving it!

Important! You MUST save ComboFix to your desktop.

Link #1
Link #2

Rename ComboFix to Combo-Fix before saving it to the desktop.





Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click on Combo-Fix.exe & follow the prompts.

Vista and Windows 7 users Right-Click on Combo-Fix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)

Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

When the scan completes it will open a text window.
 
Post the contents of that log in your next reply.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

[mstolp]

None of the rkill executables worked as far as I could tell.  I saw the command prompt pop-ups but they all were replaced by the executable infected pop-up.

I then tried the exe-Helper but that didn't do anything either.  Then I clicked on the Combo thing but that didn't run either.  I couldn't find any log files either.

Any other ideas?

Mark

[evilfantasy]

Boot the computer into Safe Mode With Networking and try to download/run them that way.