• Home
  • About 404TS
  • Contact

404 Tech Support

Where IT Help is Found

  • Articles
    • Code
    • Entertainment
    • Going Green
    • Hardware, Gadgets, and Products
    • Management
    • Network
    • News
    • Operating Systems
    • Security and Privacy
    • Software
    • System Administration
    • Talking Points
    • Tech Solutions
    • Web
    • Webmaster
  • Reviews
  • Media
    • Infographics
    • Videos
  • Tech Events
  • Tools
    • How do I find my IP address?
    • Browser and plugin tests
  • Get a Technical Consultation
You are here: Home / Articles / Tech Solutions / Post Virus Clean Up – .EXE Files Stop Working

Post Virus Clean Up – .EXE Files Stop Working

2010-02-05 by Jason

After cleaning up a virus today for one of my users, I noticed an odd remaining side effect: No executables would successfully launch. This included Explorer.exe under the user’s account that got infected, so after they would login it would just sit there at a blank screen. You could press Ctrl+Alt+Del to launch the Task Manager, but trying to run any executable would result in a message like this:

Windows cannot open this file: File: notepad.exe

Fortunately, I was still able to log in under another account which would load Explorer.exe, though it still gave me the above problem of wanting to open an executable file with another application. This would happen for any file I tried to launch that had a .exe file extension. This clued me in that the file extensions had been changed.

This happened as a side effect of the malware changing some registry settings. They do this with the intent of making it harder to clean up after the infection. Here are the default values for HKEY_CLASSES_ROOTexefileshellopencommand: (Default) name, REG_SZ type, and “%1″ %” for the data field.
The Registry key at HKEY_CLASSES_ROOT.exe will need to have its Data field for the (Default) value set to exefile.

From an article on an MVP site, I found the registry keys that needed fixed and quick fix in the form of a .com file. You can simply download the exefix_xp.zip file and extract the exefix_xp.com file to your desktop. Then just double-click the .com file and it will set the default registry settings. If you’d rather complete the fix manually, you can find the effected Registry keys and their values at the Windows XP MVP article.

You may also need to fix the problem under the Current User. Open up Regedit and delete the .exe key under HKEY_CURRENT_USERSoftwareClasses if it exists. Getting into Regedit can be a little tricky. Copy C:\Windows\Regedit.exe and paste it into the same directory. Then rename the copy to Regedit.com. If you’re not seeing the extensions, refer to this previous article.

The above fix works for Windows XP. To resolve the same problem in Windows Vista, refer to this article as the locations in the Registry have changed.

Filed Under: Tech Solutions

Trending

  • Product Review: Garmin Forerunner 405CX GPS Watch
    In Hardware, Gadgets, and Products, Reviews
  • Robotics5 Industries Reaping Big from Robotics Technology
    In Hardware, Gadgets, and Products
  • The Significance of October to Computer Users
    In Security and Privacy

Latest Media Posts

Find Out Where To Download SNES ROMs

Find Out Where To Download SNES ROMs

Multifunctional Video Conversion Tools – Wondershare Video Converter

Multifunctional Video Conversion Tools – Wondershare Video Converter

  • Popular
  • Latest
  • Today Week Month All
  • How to ‘Unblock’ multiple files at a time with PowerShell How to 'Unblock' multiple files at a time with PowerShell
  • Increase IIS Private Memory Limit to improve WSUS availability Increase IIS Private Memory Limit to improve WSUS availability
  • Configure Outlook to recurring appointments for the last weekday of the month Configure Outlook to recurring appointments for the last weekday of the month
  • Read the Event Logs on Windows Server Core Read the Event Logs on Windows Server Core
  • SOLVED: “This modification is not allowed because the selection is locked.” SOLVED: "This modification is not allowed because the selection is locked."
  • 3d rendering circuit cloud for cloud computing technology Build and Deploy a Modern Web 3.0 Blockchain App in 2022
  • Telecom Application Development: When to Outsource Telecom Application Development: When to Outsource
  • Printer printing document wirelessly from mobile phone or smartphone wifi connection vector flat cartoon illustration, file air print on fax or ink jet via cellphone bluetooth modern design Why Your Business Needs Online Fax Services In 2022
  • 6 Best Ways to Protect Your Business Account 6 Best Ways to Protect Your Business Account
  • How to download videos from Instagram How to download videos from Instagram
Ajax spinner

Elevator Pitch

404 Tech Support documents solutions to IT problems, shares worthwhile software and websites, and reviews hardware, consumer electronics, and technology-related books.

Subscribe to 404TS articles by email.

Recent Posts

  • Build and Deploy a Modern Web 3.0 Blockchain App in 2022
  • Telecom Application Development: When to Outsource
  • Why Your Business Needs Online Fax Services In 2022

Search

FTC Disclaimer

404TechSupport is an Amazon.com affiliate; when you click on an Amazon link from 404TS, the site gets a cut of the proceeds from whatever you buy. This site also uses Skimlinks for smart monetization of other affiliate links.
Use of this site requires displaying and viewing ads as they are presented.

Copyright © 2022 · Magazine Pro Theme on Genesis Framework · WordPress · Log in