(Resolved) Help! Virus! Cannot run .Exe or .Reg

[Hickabod]

I'm really at my wits end here. Some how I've contracted a virus which has fucked with my Vista regestry. Every time I try to run a .EXE or a .REG I get told
Windows cannot find 'C:\Users ect. ect.' Make sure you typed the name correctly, then try again

[Spastic]

Try using one of the free virus programs listed here (http://forums.explosm.net/showthread.php?t=28782). Download it, then reboot and run in safe mode and install it. If the same thing happens in safe mode, post here again.

[Sarge51]

What file/folder is it trying to find in your users folder? Sounds like something deleted or dis-allowed access to your documents/user folder.

[Hickabod]

What file/folder is it trying to find in your users folder? Sounds like something deleted or dis-allowed access to your documents/user folder.

It's absolutely every .exe and .reg on my entire computer.

My anti-virus software (F-Secure) couldn't use it's updater to download the latest anti-virus definitions, so it could only scan with stuff dating back to 2006. I downladed a seperate .exe that updates the definitions without starting the program itself, needless to say it would not find it on my desktop so I restarted in Safe Mode and installed it. It's found no viruses, what bullshit. I'm going to try a System Restore next, it's the last thing I can think of. Obviously I'm going to have to do this in Safe Mode because it can't find Sysconfig.exe =/

Also, I have no problem running things in Safe Mode

[Spastic]

Try AVG Hickabod, it always finds anything I get.

[DruNkiN_mONkeY350]

That would possibly be the SirCam virus which modifies the .exe file association in registry
heres a few steps to fix it using the registry editor



Click Start, Run and type Command
Type the following commands one by one:

cd\windows
regedit

If Registry Editor opens successfully, then navigate to the following key:
HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command

Double-click the (Default) value in the right pane
Delete the current value data, and then type:
"%1" %*
(ie., quote-percent-one-quote-space-percent-asterisk.)

Navigate to:
HKEY_CLASSES_ROOT\.exe

In the right-pane, set (default) to exefile
Exit the Registry Editor.

I hope it helps.

[Hickabod]

I used a Symantic stand-alone SirCam scanner/remover and that came up with nothing, even if the virus is very similar.
It seems that F-Secure found nothing, but System Restore saved the day. I pity the people with little technical know-how that have to do battle with viruses like these.

Thanks for all your help!

[DruNkiN_mONkeY350]

I'm glad its all better now.
And no problem. Happy to help.