Contact Us

Programs won’t open after malware infection on Win XP

After a malware infection when you try to open any program the computer asks you what program you want to open with..

This is due to the file associations being screwed up by malware..

FIX…
This may have to be done on a clean system…
Right click on the desktop and select a new text document, then open it and copy the text below and paste it into the new doc and save as “association_fix.reg”
This will then have to be double clicked on the system with the problem, then things should be back to normal

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT.exe]
@="exefile"
"Content Type"="application/x-msdownload"
[HKEY_CLASSES_ROOT.exePersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"
[HKEY_CLASSES_ROOTexefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"
[HKEY_CLASSES_ROOTexefileDefaultIcon]
@="%1"
[HKEY_CLASSES_ROOTexefileshell]
[HKEY_CLASSES_ROOTexefileshellopen]
"EditFlags"=hex:00,00,00,00
[HKEY_CLASSES_ROOTexefileshellopencommand]
@=""%1" %*"
[HKEY_CLASSES_ROOTexefileshellrunas]
[HKEY_CLASSES_ROOTexefileshellrunascommand]
@=""%1" %*"
[HKEY_CLASSES_ROOTexefileshellex]
[HKEY_CLASSES_ROOTexefileshellexDropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"
[HKEY_CLASSES_ROOTexefileshellexPropertySheetHandlers]
[HKEY_CLASSES_ROOTexefileshellexPropertySheetHandlersPEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"
[HKEY_CLASSES_ROOTexefileshellexPropertySheetHandlersPifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"
[HKEY_CLASSES_ROOTexefileshellexPropertySheetHandlersShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
[HKEY_CLASSES_ROOTregfile]
@="Registration Entries"
"EditFlags"=dword:00100000
"BrowserFlags"=dword:00000008
[HKEY_CLASSES_ROOTregfileDefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,
00,5c,00,72,00,65,00,67,00,65,00,64,00,69,00,74,00,2e,00,65,00,78,00,65,00,
2c,00,31,00,00,00
[HKEY_CLASSES_ROOTregfileshell]
@="open"
[HKEY_CLASSES_ROOTregfileshelledit]
[HKEY_CLASSES_ROOTregfileshelleditcommand]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,
54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,25,00,31,00,00,
00
[HKEY_CLASSES_ROOTregfileshellopen]
@="Mer&ge"
[HKEY_CLASSES_ROOTregfileshellopencommand]
@="regedit.exe "%1""
[HKEY_CLASSES_ROOTregfileshellprint]
[HKEY_CLASSES_ROOTregfileshellprintcommand]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,4e,00,4f,00,
54,00,45,00,50,00,41,00,44,00,2e,00,45,00,58,00,45,00,20,00,2f,00,70,00,20,
00,25,00,31,00,00,00
[HKEY_CLASSES_ROOT.lnk]
@="lnkfile"
[HKEY_CLASSES_ROOT.lnkShellEx]
[HKEY_CLASSES_ROOT.lnkShellEx{000214EE-0000-0000-C000-000000000046}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT.lnkShellEx{000214F9-0000-0000-C000-000000000046}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT.lnkShellEx{00021500-0000-0000-C000-000000000046}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT.lnkShellEx{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT.lnkShellNew]
"Command"="rundll32.exe appwiz.cpl,NewLinkHere %1"
[HKEY_CLASSES_ROOTlnkfile]
@="Shortcut"
"EditFlags"=dword:00000001
"IsShortcut"=""
"NeverShowExt"=""
[HKEY_CLASSES_ROOTlnkfileCLSID]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOTlnkfileshellex]
[HKEY_CLASSES_ROOTlnkfileshellexContextMenuHandlers]
[HKEY_CLASSES_ROOTlnkfileshellexContextMenuHandlersOffline Files]
@="{750fdf0e-2a26-11d1-a3ea-080036587f03}"
[HKEY_CLASSES_ROOTlnkfileshellexContextMenuHandlers{00021401-0000-0000-C000-000000000046}]
[HKEY_CLASSES_ROOTlnkfileshellexDropHandler]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOTlnkfileshellexIconHandler]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOTlnkfileshellexPropertySheetHandlers]
[HKEY_CLASSES_ROOTlnkfileshellexPropertySheetHandlersShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}]
@="Shortcut"
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}InProcServer32]
@="shell32.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}PersistentAddinsRegistered]
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}PersistentAddinsRegistered{89BCB740-6119-101A-BCB7-00DD010655AF}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}PersistentHandler]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}ProgID]
@="lnkfile"
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}shellex]
[HKEY_CLASSES_ROOTCLSID{00021401-0000-0000-C000-000000000046}shellexMayChangeDefaultMenu]