Member Avatar for bayan.r

Hi I already posted this in the XP forums but I really need help for this bit of malware

I'm stuck with the New Folder.exe virus and I tried following the steps and ended up screwing up some key system files(step 3 to be precise) and now I cannot open any commands except with the Run As option( I am running windows xp professional) and applications are hopeless.

What I have tried so far:

Malwarebytes in safe mode and normal mode

The exe registry fix in normal and safe mode.

I am a Linux user so please be detailed in your responses as I am not really windows savvy. I REALLY want to avoid a windows format so please help.

  • 3 Contributors
  • 2 Replies
  • 204 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Short diagnosis and where to start: when EXE files open in Notepad the system’s EXE file association has been replaced or corrupted in the registry. That can be caused by the New Folder.exe family or by an incorrect registry edit. Because you said you ran the linked guide and then lost normal program execution, the keys that map “.exe” to the exefile handler were likely altered or removed.

Try these least-invasive fixes first:

  • Reboot and press F8; choose "Last Known Good Configuration (advanced)". This restores registry settings saved at the last successful logon and often fixes broken associations without touching user data.
  • If that fails, boot Safe Mode (F8) and run System Restore to a restore point dated before the infection/registry change.
  • If you can launch anything with "Run as", export the registry hives (or at least back up HKCU\Software\Classes and HKLM\SOFTWARE\Classes) before further edits.

If GUI fixes don’t work, do an in-place (repair) install of Windows XP from the original CD. Boot from the CD, proceed to setup, and when it detects your existing XP installation follow the prompts to repair (this replaces system files and core registry defaults while keeping user data and programs; you will need to reapply service packs and updates). Back up personal files first.

Linux-savvy offline option: boot a Linux live USB, mount the Windows partition and copy the registry hive files from Windows/System32/config to a safe location before touching anything. Example backup commands (adjust device and mount points):

sudo mkdir /mnt/win /mnt/usbbak
sudo mount -t ntfs-3g /dev/sdXY /mnt/win
sudo cp /mnt/win/Windows/System32/config/{SYSTEM,SOFTWARE,SAM,SECURITY,DEFAULT} /mnt/usbbak/

Use the chntpw/regedit tools to edit the SOFTWARE hive and restore HKLM\SOFTWARE\Classes entries for ".exe" and "exefile" (work only from your backups). As noted, a .reg restore can fix many cases, but because keys were changed you may need Last Known Good, System Restore, repair install, or the offline hive edit. After recovery run full malware and rootkit scans and review startup items with Autoruns. If unsure, backup data and do a clean install.

Recommended Answers

All 2 Replies

Member Avatar for rch1231

I have used this before. create a file called exefix.reg with the following in it:

Windows Registry Editor Version 5.00



[-HKEY_CURRENT_USER\Software\Classes\.exe\shell\open\command]

[-HKEY_CURRENT_USER\Software\Classes\secfile\shell\open\command]

[-HKEY_CLASSES_ROOT\.exe\shell\open\command]



[HKEY_CLASSES_ROOT\.exe]

@="exefile"

"Content Type"="application/x-msdownload"



[-HKEY_CLASSES_ROOT\secfile]

Then right click on it and select install.

Member Avatar for gerbil

Bayan, did you try the second fix I suggested?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.