Gerry

I managed to solve this problem on my own. It seems that my system wasn't entirely clean after all. Running one more additional Malwarebytes scan found some additional items which were removed. So, I guess this thread can be closed. Thanks Gerry

Hi All, It was suggested that I post my problem here to ensure that all evidence of maleware was removed and that hopefully, I will get instructions for file association fixes. First a little back history I'm running XP Professional with Service Pack 3 on a partitioned computer. That is my computer is set up to have two different users on it at one time. That is the system boots up and asks to select a user, ie; user1 or user2 When logged on as user1, I received the trojan virus XP Defender. So I tried to run Malwarebytes, it would not open. I decided to log on as User2 because Malwarebytes is installed there as well. XP Defender was not running on the User2 side. With Malwarebytes I was able to successfully remove the trojan and Malwarebytes recommended a reboot of which I did. When I relogged on as User1 all my program file associations are broken. However, they are not broken at all when logged on as User2. As User1, when clicking on an executable file I get one of the following errors: 1). Please choose a program from the list to open this file or 2). Application Not Found Clicking shortcut icons on the desktop, or the start menu or even through Windows explorer returns one of the two errors above. Also, some of the icons in my system tray are missing and don't boot up at start-up. I think there is now a file association problem within the registry for executable files. I have run Malwarbytes again and there is no evidence of malware on my computer. I tried to open HiJack This (Which was installed before the Trojan infection) but it asks me to choose a program from the list and it isn't in there so it won't open. I can post the Malwarebytes log if someone wishes to see it. Any help would be greatly appreciated. Thanks Gerry

Hi Marktreg Ok, I will go there. Thanks for your help. Gerry

Hi Marktreg Thanks for writing back. The reason why I posted here is the problems that I am having is the result of the aftermath of malware removal using Malwarebytes and that during the removal process, some things got screwed up. (please see above) Since there is no longer any sign of malware on my computer I posted my information here in the pc help forum. Was that not correct? Let me know if you feel I should still go there. Thanks Gerry

This is just a follow-up but I'm wondering if this is an .exe file association problem within the registry and that the registry may in fact be corrupted. I've seen some online .exe fixes but I haven't tried any of these for fear of doing more damage. I'll wait till you respond back. Thanks Gerry

@noknojon Sorry for the late reply, I was up til 3:00 am this morning trying to sort out this problem. Ok, since I could not run cmd.exe from the user1 side, I ran your code on the user2 side of my computer. It took several hours then I got a message saying that the volume is now clean and I sat here at the computer while the CHKDSK ran and saw no indications of errors. When the system rebooted I logged on as user1 and I still get the same problems. Example 1). Going from the start menu -->All Programs -->Microsoft Office -->Microsoft Word ....returns "application not found. 2). Going from the start menu -->All Programs-->Adobe Master Collection -->Adobe Dreamweaver....returns "Choose a program from the list to run this file Couple of other problems 1). Some of the icons in my system tray are missing (This was even before running CHKDSK) icons like my "printer ready icon" "drag to disc icon" among others. 2). Trying to access programs from the explorer menu still returns the "Choose a program from the list to run this file" Of course logging on as user2 does not have these problems at all. Any other ideas? Thanks Gerry

no I didn't because I was afraid to I am scared that I'm going to really damage something. Gerry

Hi Thanks for the quick reply, Actually, no. I ran a few more tests, I tried to run ChkDsk from the command line by typing Start -->run -->cmd but even that doesn't work it asks me to please choose a program to run cmd.exe. So I logged off as user1 and logged on as user2 and did chkdsk but it says there are errors on the disk so it stopped. Any other suggestions? Thanks Gerry

Hi guys, I received a really bad trojan today and have been working all day to sort out its aftermath on my computer. First I should say that I'm running XP Professional with Service Pack 3 on a partitioned computer. That is my computer is set up to have two different users on it at one time. That is the system boots up and asks to select a user, ie; user1 or user2 When logged on as user1, I received the trojan virus XP Defender and even though Norton antivirus flagged it, it didn't remove it, it still installed. So I decided to run Malwarebytes which was already installed on the computer. When I tried to run Malwarebytes, it would not open. I have heard of this happening but instead of renaming mbam.exe to a different extension and try to run it, I decided to log on as User2 because it is installed at the same time on that side as well. XP Defender was not running on the User2 side. With Malwarebytes I was able to successfully remove the trojan and Malwarebytes recommended a reboot of which I did. Now when I log on as user1 (the user that got the infection) none of my programs work! WEll, that's not entirely true some work but act strange. For instance 1). Clicking on the Safari browser icon on the desktop returns an error of "application not found" 2). Clicking on the Firefox browser icon on the desktop returns the List of programs pop up and asks me to choose which program I would like to open this file with and firefox is not in the list. The same happens with other programs like Photoshop, Dreamweaver, Flash etc. 3). Clicking on a Microsoft Office program from the start menu (like Access, Word, Powerpoint etc) returns the error "Application not found" 4). However, if I have a microsoft word, or access or powerpoint document on the desktop, I can open it just fine. 5). clicking on the Malwarebytes Icon on the desktop also asks me to choose an associated program and malwarebytes isn't in the list. 6). This is the really weird part, when I open notepad, it asks me again to choose a program to open this file. When I choose notepad from the list of programs, instead of getting a blank document, I get a document filled with tons of strange characters but some of the words I can make out. However, If I relog on as User2 (the user on the same computer that didn't have XP Defender and where I ran Malwarebytes from) has no problem opening these same programs. Guys, I really need help with this. I'm suspecting that maybe some shared .dlls may have accidentally been deleted? Any idea of the steps I need to take to try to fix this problem? Thanks so much Gerry

Hi Ron, Thanks, I went in and removed it for now. If it comes back, I'll probably have to accept the installation. Thanks for your help. Gerry

Hi Everyone, With Microsoft's latest security patch for my Windows XP Pro machine, there came an option to install Windows Genuine Advantage. I know that my operating system is legit but I have heard some horror stories about this program giving good legit operating systems false negatives. With my recent problems with Malware and spending the better part of a week paying to have it all removed, I'm not ready to agree to this install for fear of more problems. That being said, every time I reboot my machine, I get a dialog box asking if I want to confirm the installation of WGA of which I just cancel and it doesn't install. I see it sitting there in my scheduled tasks folder ready to be installed. Should I install this? Can I remove it from the scheduled tasks folder and not have to worry about it coming back? Thanks for any feedback/suggestions. Gerry

Hi Ron, Thanks. I think the malware is pretty much removed. However, I will run a Malwarebytes log and see what happens. I have read all the prerequisites for posting to the HJT forum. If I find any problems, I'll just post there. Thanks for you help, you guys are great. Gerry

Hi Thanks for the reply. I actually paid Norton $100.00 to remove the malware remotely. But now I am having a whole slew of other problems. I'm going to get back in touch with them. Let me ask, was this a good thing or a bad thing to have them remove the malware? They were deleting .dlls and processes left-and-right and now I'm getting all kinds of funky errors. Gerry

Hi All, Went to a bad web site last night and which immediately attempted to download tons of trojans and malware on to my computer. I had thought that Norton AV caught all of it but apparently there is still some stuff getting through. I tried to run my Malwarebytes software but I get an error that it cannot find mbam.exe. I tried to uninstall it seemed to uninstall successfully but it said it couldn't remove all associated files. I then tried to re-install a fresh version and even though it installed successfully, I still cannot find the executable file. I did a search on my system for the file with no results found. Can anyone suggest anything? Thanks Gerry