programs can't open

[Ross Fu]

Today, after I closed Windows Media Player by accident, I
found out I couldn't open it again. Windows gave an
error message, saying "file could not be found", which
was totally illogical. Restarting didn't help. I later
found out that I couldn't open any file at all, with the
exception of Internet Explorer and Outlook Express. I
couldn't open System Restore. I tried booting off the cd
that came with my very new computer, and it offered me
the option of "repairing" my OS. After what seemed like
a full system reinstall, I rebooted my computer only to
find that the display had become worse, and my previous
problem remained. I can't open any files except for IE
and Outlook: I get the error message saying "file could
not be found." What is going on?

I think it might have to do with the fact that earlier,
while I was looking for spyware to delete, I found a
suspicious file in the C:\Windows\Prefetch directory. I
deleted the entire folder. Could that have anything to
do with it?

Ross

 

[Kelly]

Hi Ross,

Go to Start/Run and paste this line in:
rundll32.exe advapi32.dll,ProcessIdleTasks

Also download and run this edit:

EXE Fix for Windows XP - Line 12 (Restores EXE association)
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedits: Save the REG File to your hard disk. Double click it
and answer yes to the import prompt. REG files can be viewed in Notepad by
right clicking on the file and selecting Edit.

/top10faqs.htm

 

[Ross Fu]

I still can't get it to work. Here's what I did:

Go to Start/Run and paste this line in:
rundll32.exe advapi32.dll,ProcessIdleTasks

It didn't work: it wouldn't run rundll32.exe because it
can't run exe files.

Also download and run this edit:

EXE Fix for Windows XP - Line 12 (Restores EXE association)
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedits: Save the REG File to your hard disk. Double click it
and answer yes to the import prompt. REG files can be viewed in Notepad by
right clicking on the file and selecting Edit.

I downloaded the file and tried to open it. It
said "sqwzmeoa.exe cannot be found. Please select the
executable file with which to run this". sqwzmeoa.exe
was the suspicious spyware-like file that I had
originally deleted. Guessing that maybe it had
remapped .reg files to itself, I entered the path name
for regedit.exe. It then said that registry editing was
disabled by the "administrator." This is really weird,
because I have been the only person ever to use the
computer, and I had assumed that I would have
administrative access. I think there might be a virus
going mucking about. What can I do?

Ross

 

[Kelly]

Hi Ross,

My mistake......rename regedit.exe to regedit.com then try the previously
suggested.

Other than that and more importantly, in the Task Manager, end process of
that particular exe. Once you can gain access to regedit, remove it from
here:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

 

[Kelly]

Also:

Lift Restrictions - TM, Regedit and CMD (Line 275)
http://www.kellys-korner-xp.com/xp_tweaks.htm

 

[Stephen Johnson]

There's a mistake in your files. If somebody can't edit the registry because of being "disabled by
the administrator", then they won't be able to ru your fix because it's a reg file. It's a
never-ending loop. I have attached the Visual Basic Script (vbs) file that they can run instead to
enable registry editing. I would suggest you put this on your website.

Stephen

 

[Kelly]

Renaming regedit.exe to regedit.com works.

/top10faqs.htm

 

[Will Denny]

Hi

What makes you think that people are going to download .vbs files posted in an NG? With all the viruses running havoc ATM, people have got to be very careful. Hopefully most people have got either their AV program or OE to stop these files.

 

[Stephen Johnson]

Not if they can't run com files either, which is typical. And I don't see instructions telling
someone to renam regedit.exe to regedit.com. You have other fixes as vbs files, why not this one?

Stephen

 

[Stephen Johnson]

Any intelligent person can view the vbs file in notepad to see what it does. It's obvious that it
does what I say.

Stephen

Hi

What makes you think that people are going to download .vbs files posted in an NG? With all the
viruses running havoc ATM, people have got to be very careful. Hopefully most people have got
either their AV program or OE to stop these files.

 

[Kelly]

Not necessarily as the virus is looking for the "process" to kill
(regedit.exe), in many other posts and because I just haven't.

/top10faqs.htm

 

[Stephen Johnson]

We may be talking about two different viruses, but the one I'm talking about isn't actually active
usually. It does the damage and then dissapears. Usually Norton gets it. So it's not looking for
certain processes to kill, it just disables registry editing by setting the option. And it disabled
execution of files by re-associating exe, com, pif, and reg files to the virus.

Stephen

 

[Kelly]

Hi Stephen,

The term is virii....that said, it again depends on which one, if and how
you deem active. The setting to disable is easy enough to do and undo and
no, Norton hasn't been catching them as new one's crop up each and every
day.

The one's we have been dealing with here is programmed to kill the process
each time regedit, msconfig, cmd and for the better part, task manager is
invoked, period. Not 'all' .exe's, com's ....etc.

Thanks for your reply and feedback.

/top10faqs.htm

 

[Stephen Johnson]

I encountered this problem twice in the last two weeks, and in both settings the executables were
disabled from running. And if you con't fix each of the problems, then your site isn't so great is
it. Just kidding. It's a great site, just misused I think.

Stephen

 

[Kelly]

Ah but....if "you" can't fix them on your "own" system, then neither are
you! I can fix them, but .com has never been an issue. If so, it would
have been done.

/top10faqs.htm

 

[Torgeir Bakken (MVP)]

in order to apply this patch, you have to log in to the Administrator account. Your account may have
administrative privileges, but in this case it's not the same. I have attached the files that you
need to fix this problem. Save these files to your desktop.

Hi

From the header of Ross Fu' post:

X-Newsreader: Microsoft CDO for Windows 2000

This means he is using the Web interface to the newsgroups and therefor he will not see your attachments.

 

[Stephen Johnson]

Where'd you come from. Thank you for that info, I didn't know what. What is Microsoft CDO?

Stephen

 

[Stephen Johnson]

It actually wasn't my own computer, it was two of my customers' computers.

Let me get this straight. The fix you have on your site is to remove the registry editing
restriction that displays the message "Registry editing has been disabled by the administrator". You
have the patch in the form of a reg file. Are you saying that Windows will allow registry editing if
you merely rename "regedit.exe" to "regedit.com"? If so, I'd say that's a security problem in
windows. It'd be nice for hacking those library computers.

Stephen

 

[Stephen Johnson]

I just tested your solution, and it doesn't work. So your fix actually can't fix what it's supposed
to. If it was a virus causing regedit to close, then deleting that reg location isn't going to help.
And if it's that reg key causing the problem, you can't run your reg file.

Stephen

 

[Kelly]

Stephen,

Again, it depends.

Let it be known that if a virus/worm has crippled a system beyond disabling
the norm (regedit.exe, msconfig.exe, etc...that a mere simple registry
edit/change can't fix) then other cleansing means are needed.

In that case, no....the edit nor renaming won't help. But for many other
'depending' cases, it does. My primary focus/study is not on virii, I do
the best I can to get folks up and running in the interim/aftermath of such
said. And is to be used for the norm.

Your case(s) on hand, presumably differ at this point and need to be handled
in yet another spectrum. Good luck!

/top10faqs.htm