My exe files all turned to 0 bytes won't open

[wirejay]

A month ago I connected a flash drive to my laptop to transfer files from it to another PC. The flash drive showed duplicate files which I tried deleting to no avail.

Apparently it was malware or virus which then infected my laptop. In a short space of time my applications and programs stopped launching and the pop up message eg "C:\Program Files (86)\GlassWire\GlassWire.exe is not a valid Win32 application" would pop up. I then checked the files and found every exe file was now 0kb. Office programs open briefly then a pop up message "Microsoft Office has encountered a problem with licensing and will need to close. If this problem persists,uninstall and reinstall your product." After much labor in online forums I downloaded Malwarebytes Anti-Malware and did the scans. It Identified some 63 threats and I "quarantined" them. My problem still persists though after using FixExec i re-installed about 2 programs including Firefox which now work. I can't practically do this for all exe files which are still at 0kb. Can anybody help. I'm really desperate. I'd appreciate all the help I can get.

Addition.txt

FRST.txt

Malwarebytes threat report.txt

Edited April 28, 2018 by wirejay
Add attachments

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malware Removal for Windows Help forum. Being infected is not fun and can be very frustrating to resolve, but don't worry because we have a team of experts here help you!!

Note: Please be patient. When the site is busy it can take up to 48 hours before a malware removal helper can assist you. If no one has replied to your new topic after 48 hours please contact a Moderator or Administrator to let them know.

 

First, if you haven't done so, please run a Threat Scan with the latest version of Malwarebytes. This may resolve your malware infection issue without the need for additional support. Click "Reveal Hidden Contents" below for details:

Spoiler

Malwarebytes can detect and remove most malware with no further actions required for free.

If you do not have Malwarebytes, please download it here and install. Be sure to post back the log as shown below.

1. Open Malwarebytes for Windows
2. To the left, click Scan > Scan Types.
   
3. Select Threat Scan. Threat Scan is the most thorough and recommended scan method available.
   
4. Click Start Scan

Next, if you're still experiencing issues after running Malwarebytes, then technical logs will be required to assist you. Click "Reveal Hidden Contents" below and follow the instructions to run the Farbar Recovery Scan Tool:

Spoiler

Don't use any temporary file cleaners unless requested - this can cause data loss and make a recovery difficult.

Please download the Farbar Recovery Scan Tool here and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

1. Double-click to run it. When the tool opens click Yes to the disclaimer.
2. Press the Scan button.
   
3. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
4. The first time the tool is run, it also makes another log (Addition.txt). If you've run it before it may not and you may need to select it manually.

Finally, attach the Malwarebytes Threat Scan, FRST.txt and Additional.txt logs to your reply and Follow this topic to get notified when an expert has replied. Click "Reveal Hidden Contents" below for details.

Note: If you are unable to attach files, please copy and past the contents of the requested files in your Reply instead. 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

After posting your new post, make sure you click the Follow button near the top right of this page, and select the option "An email when new content is posted Change how the notification is sent" so that you're alerted by email when someone has replied to your post.

Please Note the Following:

• One of our expert helpers will give you one-on-one assistance when one becomes available.
• Refrain from making any further changes to your computer (such as Install/Uninstall programs, using special fix tools, delete files, edit the registry, etc...) unless advised by a malware removal helper. Doing so can result in system changes which may hinder the attempts by a helper to clean your machine.
• Do not 'bump' or add a reply to your topic once it is started. Topics which appear to have replies are considered to have a helper assisting them and may be overlooked, resulting in a longer waiting period for help
• If you're using Peer 2 Peer software such as uTorrent or similar, please completely disable it from running while being assisted here.

Troubleshooting Tips

• FAQ - Malwarebytes won't run or failed to resolve my issues
• Groups authorized to help with Malware Removal for Windows logs

[AdvancedSetup]

Hi @wirejay and

Sorry for the delay. Can you please post back the log that shows you had Malwarebytes remove what it found. The current log you posted only shows that it detected it and that no action was taken.

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[wirejay]

Hi Ron

Thanks for the quick response. I think I have MB3 already and latest version of FRST. I will do as instructed and attach as soon as I can.

[AdvancedSetup]

Sounds good. Let me know.

 

[wirejay]

Apologies for late response. I have limited connectivity access.

Ok so I've done the scans as per instruction. I also exported the initial summary which I'll attach as well. The latest one is simply named "Export Summary"

 

AdwCleaner[C00].txt

Export Summary initial.txt

Export Summary.txt

FRST.txt

[AdvancedSetup]

It looks like the computer has had some of the operating system files damaged. I'll try to assist you in cleaning it up but if possible it might be best to backup your data, format the drive, and reinstall Windows so that you know it's clean and safe.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Thanks

Ron

 

 

[wirejay]

Yikes. Was hoping to avoid the format route. Ok let me try out your suggestion and give feedback when possible.

[AdvancedSetup]

Yes, I understand. Most users don't relish the idea of format and reinstall as it is a lot of work. I actually just did that on one of my main computers and I'm still finishing up tweaking it a couple days later.

We'll do our best to get your computer cleaned up, just want you to be aware that it probably will not run like it did or should but hopefully still pretty good.

The complexity of finding, preventing, and cleanup from malware

Go ahead and run the fix I posted above and attach that log back when ready and we'll go from there.

Ron

 

[wirejay]

Ok. Ran the fix. I've attached log below.

Thanks for the assistance by the way.

Fixlog.txt

[AdvancedSetup]

Okay, great looks good overall. Please restart the computer one more time and then run the 3 steps again and post back all new logs.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[wirejay]

Did all 3 steps again. Still no change. Exe files still at 0 bytes. Do u know what causes this? I've attached files as requested.

Addition.txt

AdwCleaner[C01].txt

FRST.txt

Summary.txt

[AdvancedSetup]

As I said, it's best to format the drive and install Windows again. We are trying to put a band-aid on a gaping wound. 

Please run the following fix.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

 

[wirejay]

No change. Though laptop froze for an hour on reboot.

Fixlog.txt

[AdvancedSetup]

Okay, please run the following

Click on Start and type in CMD.EXE and when it shows on the menu right click and select "Run as administrator"

Then type in the following and press the Enter key. When it's completed please take a screen shot and post that back.

SFC   /SCANNOW

 

Ron

 

Edited May 10, 2018 by AdvancedSetup
typo

[wirejay]

Ok. Done. I've included the log mentioned in report as well in case u need it.

CBS.log

[AdvancedSetup]

Mostly some game stuff where the files were missing and it could not repair.

Please follow the article advice from below and run the DISM repair.

Dism /Online /Cleanup-Image /RestoreHealth

https://www.tenforums.com/tutorials/7808-use-dism-repair-windows-10-image.html

Post a screen shot of it's final message too.

Thanks

Ron

 

[wirejay]

Does this apply to Windows 7? I'm seeing instructions for W10.

[AdvancedSetup]

No, I'm sorry. My fault. So used to Windows 10 lately.

Go ahead and restart the computer one more time. Then run FRST again and make sure you place a check mark in the Additions.txt check box and attach both logs and I'll take another look tomorrow.

Also let me know what issues you're still seeing or having.

Thanks

Ron

 

[wirejay]

Ok did the scan. Apart from the 0 bytes exe files ,a longer standing issue is the "Windows Explorer stopped working." which results in the window crashing then restarts.

This has been going on much longer than the infection phase. Dunno if there's any relation there.

 

Addition.txt

FRST.txt

[AdvancedSetup]

STEP  01

Please uninstall ALL versions of Java from the computer.

STEP  02

Temporarily Uninstall your Avast antivirus. Reboot.

STEP  03

Run the following fix again.

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

STEP  04

Once the above has been completed then reset your browsers to default settings.

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• First, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
  • 
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

RESTART the computer again.

STEP  05

Reinstall your Avast antivirus if that's the one you want to use.

STEP  06

Run a new FRST scan and attach back both new logs

 

Thanks

Ron

 

[wirejay]

Just did the whole step by step and forgot to do Step 05. I don't know if that's problematic but here are the logs without AV.

Fixlog.txt

FRST.txt

Addition.txt

[AdvancedSetup]

Please see if you can download and reinstall Internet Explorer 11 or not.

It may not let you, but give it a try

https://www.microsoft.com/en-us/download/confirmation.aspx?id=40901

 

[wirejay]

It won't allow that download. This is what I get

[wirejay]

Do I have a problem with file association or  my exe files were somehow deleted?

What do u suspect? And thanks as always for the patient assistance.