Open With Problem 2

[dgreen]

Hi,

I have just read 007will's post (Open With Problem) and I have exactly the same issue.
I realise I can not simply solve this by following the instructions on his post as every one is different.

I would very much appreciate help in resolving this problem.

I am running XP and also AVG virus scanner (this runs a nightly scan)

Thanks so much

David

[BC_Programmer]

Hello dgreen-

Even if you are experiencing the same symptoms as another poster, it could be caused by something completely different. Either way- the malware experts will need you to follow the steps described  here, and to post the logs here for them to examine, and then they can advise you further.

[dgreen]

Hi BC,

Thanks for that advice, the only problem is, how do I run these utilities if I can't open anything on the infected PC ?

(I hope that isn't a dumb question)

Thanks

David

[SuperDave]

Hello dgreen and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
Save Rkill to your desktop.

There are 4 different versions. If one of them won't run then download and try to run the other one.
 
Vista and Win7 users need to right click Rkill and choose Run as Administrator
 

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.exe
Rkill.com
Rkill.scr
Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.
 
Now download and Run exeHelper.

Please download exeHelper from Raktor to your desktop.

• Double-click on exeHelper.com to run the fix. A black window should pop up, press any key to close once the fix is completed. A log file named log.txt will be created in the directory where you ran exeHelper.com Attach the log.txt file to your next message.
  
  Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).
  

[dgreen]

Hi Dave

Thanks for your help.
I have copied the files to CD and hopefully one of them will run on the PC.
I will post the logs on here as soon as I get back home (I travel quite a bit so apologies for any delays between postings)

Thanks again, I really appreciate it.

Regards,

David G

[dgreen]

I've run the Rkill & exeHelper utilities.

The logs are below:

Rkill log:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as Administrator on 06/03/2010 at 16:01:36.


Processes terminated by Rkill or while it was running:


C:\Documents and Settings\Administrator\Desktop\rkill.com


Rkill completed on 06/03/2010  at 16:01:41.



exeHelper:

exeHelper by Raktor
Build 20091220
Run at 16:07:20 on 03/06/10
Now searching...
Checking for numerical processes...
Checking for sysguard processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

[SuperDave]

Hi Dave. Now, could you please go to the link in Reply 1 and see if you get those programs to run? Please post any logs that you can create.

[dgreen]

Hi Dave,

I am about to follow the instructions listed in the Computer Hope Virus and Spyware section Guidelines but I can not do step A as the PC will not allow me to open anything.
I have AVG installed but it has been deactivated and is not running.

Regards,
David

[SuperDave]

Ok. I would like for you to try this. Please ensure that you follow all the directions.

Go to this link to create a Rescue CD or to this site to create a Rescue USB. Carefully follow all the instructions for whichever method you choose.

[dgreen]

Since my last post and prior to your latest post I have somehow managed to get AVG to run.
I did a scan and there was no infection detected.

Shall I still go ahead with the Rescue USB?

[SuperDave]

Shall I still go ahead with the Rescue USB?

Only if you can't get the other scans to run. I will need the SAS, MBAM and HJT logs.

[dgreen]

Hi Dave,

I have tried to get the USB bootable to work but there is no option in the PC's setup to allow a USB as a bootup.
The infected PC is a DELL Optiplex GX260.
Should I be doing something else to get this working.

Thanks

[SuperDave]

You still cannot run the SAS, MBAM and HJT scans? What happens when you try to download and run them?

[dgreen]

Hi Dave,

I managed to run SAS and left it overnight to complete the scan.
When I came back to it this morning the scan seemed to have finished but there was no summary box or anything else open relating to SAS.
The only thing that was open was AVG asking for an upgrade to ver 9 (free) which I did.
I opened SAS and saved the log (see attached).
I then ran MBAM (see log attached).
I've updated JAVA and run CCleaner.
I then ran HJT (see attached Log)

Thanks



[recovering disk space - old attachment deleted by admin]

[SuperDave]

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R3 - URLSearchHook: (no name) - 0467aefd-1e68-4957-a5a7-5ace32ea1167} - (no file)
R3 - URLSearchHook: (no name) - bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - (no file)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
(Description: Intel hotkey applet. Unnecessary. Removing this will free up a small amount of system resources.)
O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Common Files\Java\Java Update\jusched.exe\"
(Description: Sun Java update scheduler. Checks for updates. Not necessary. Removing this entry will free up a small amount of system resources.)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] \"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe\"
(Description: Adobe reader startup - unnecessarily uses system resources.)
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

==========================

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1
link #2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts. (you will receive a UAC prompt, please allow it)

Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix