Author Topic: default program take over  (Read 9548 times)

0 Members and 1 Guest are viewing this topic.

moose07

  • Guest
default program take over
« on: July 16, 2011, 01:22:08 PM »
Hello

I recently tried opening a picture file with windows photo viewer and ever since then all my files, including short cuts try to open with this program. How do i reverse this? The only thing i can find is that i can choose other programs to be my default program but this doesnt help even slightly. Is there a way i can restore it so it is back to the way it is.
I run windows 7

Cheers
Moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #1 on: July 16, 2011, 01:30:31 PM »
Have a look here http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html  there is a zip file registry fix for all file types

moose07

  • Guest
Re: default program take over
« Reply #2 on: July 16, 2011, 01:35:41 PM »
I would but i cant access it on the computer with the problem, im using a laptop at the moment. If i open internet explorer with internet explorer it comes up to open or save the program, no matter what i press it will just loop that and keep asking me to open or save it. unless i cancel it.

Moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #3 on: July 16, 2011, 01:42:24 PM »
The following registry fix will reset your exe file associations for you

REGISTRY FIX
Quote
Windows Registry Editor Version 5.00

[-HKEY_CLASSES_ROOT\.exe]

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"FriendlyTypeName"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,\
  00,6f,00,6f,00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,\
  32,00,5c,00,73,00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,\
  00,2c,00,2d,00,31,00,30,00,31,00,35,00,36,00,00,00

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]
"HasLUAShield"=""

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"
"IsolatedCommand"="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runasuser]
@="@shell32.dll,-50944"
"Extended"=""
"SuppressionPolicyEx"="{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"

[HKEY_CLASSES_ROOT\exefile\shell\runasuser\command]
"DelegateExecute"="{ea72d00e-4960-42fa-ba92-7792a7944c1d}"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers]
@="Compatibility"

[HKEY_CLASSES_ROOT\exefile\shellex\ContextMenuHandlers\Compatibility]
@="{1d27f844-3a1f-4410-85ac-14651078412d}"

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[-HKEY_CLASSES_ROOT\SystemFileAssociations\.exe]

[HKEY_CLASSES_ROOT\SystemFileAssociations\.exe]
"FullDetails"="prop:System.PropGroup.Description;System.FileDescription;System.ItemTypeText;System.FileVersion;System.Software.ProductName;System.Software.ProductVersion;System.Copyright;*System.Category;*System.Comment;System.Size;System.DateModified;System.Language;*System.Trademarks;*System.OriginalFileName"
"InfoTip"="prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size"
"TileInfo"="prop:System.FileDescription;System.Company;System.FileVersion;System.DateCreated;System.Size"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids]
"exefile"=hex(0):

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"



Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file.  Ensure there is no space above the Windows Registry Editor Version 5.00
.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
This will create a fix.reg file on your desktop

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.

moose07

  • Guest
Re: default program take over
« Reply #4 on: July 16, 2011, 01:54:14 PM »
did all of that and merged it but everything even all the icons on the home page are all still trying to open with the same program, i had to change it to notebook to type that code in so all of the icons are the notebook icon and everything is opening with notebook which is what it was doing with microsoft picture viewer.

moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #5 on: July 16, 2011, 02:00:26 PM »
OK lets see if I can reset them

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTS  to your Desktop
  • Close ALL OTHER PROGRAMS.
  • Double-click on OTS.exe to start the program.
  • Check the box that says Scan All Users
  • Under Additional Scans check the following:
Reg - Approved Shell Extensions
Reg - Ext
Reg - File Associations
Reg - NetSvcs
File - Lop Check
File - Purity Scan

  • Under the Custom Scan box paste this in

%SYSTEMDRIVE%\*.exe
/md5start
volsnap.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
CREATERESTOREPOINT


  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Please attach the log in your next post.

moose07

  • Guest
Re: default program take over
« Reply #6 on: July 16, 2011, 02:23:54 PM »
ran the scan
http://www.mediafire.com/?75d68ierq3527ed
thats the link to the log after the scan, i beleive thats the one you wanted if not then let me know and i'll upload what you want.

moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #7 on: July 16, 2011, 02:31:01 PM »
If this does not work - could you select a restore point to before you had the problem

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Code: [Select]

[Unregister Dlls]
[Registry - Additional Scans - Safe List]
< 64bit-File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\
YN -> .exe [@ = exefile] -> "%1" %*
YN -> .url [@ = InternetShortcut] -> C:\Windows\SysNative\rundll32.exe
YN -> .pif [@ = piffile] -> "%1" %*
< File Associations - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>\
YN -> .cpl [@ = cplfile] -> C:\Windows\SysWow64\control.exe
YN -> .exe [@ = exefile] -> "%1" %*
YN -> .pif [@ = piffile] -> "%1" %*
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.  Post that information back here

I will review the information when it comes back in.

Depending on what the fix contains, this process may take some time and your desktop icons might disappear or other uncommon behavior may occur.

This is no sign of malfunction, do not panic!

moose07

  • Guest
Re: default program take over
« Reply #8 on: July 16, 2011, 02:44:36 PM »
ran the fix and here is the note pad which popped up. nothing really happened other than a reboot was needed. everything at this point is still using notepad to open again still the icons so i'm taking it this isnt the last step?

moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #9 on: July 16, 2011, 02:48:47 PM »
OK next step do you have a restore point to before this happened ?

moose07

  • Guest
Re: default program take over
« Reply #10 on: July 16, 2011, 02:53:43 PM »
sorry i may be being stupid but what do you mean by restore point?

moose

moose07

  • Guest
Re: default program take over
« Reply #11 on: July 16, 2011, 03:12:26 PM »
if it helps this problem happened yesterday afternoon

moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #12 on: July 16, 2011, 03:14:38 PM »
OK no problem

Click the start button and type in the search box rstrui.exe
Then click the programme
Click next and you will then be given a list of restore points
Select one that is prior to your problem

moose07

  • Guest
Re: default program take over
« Reply #13 on: July 16, 2011, 03:21:40 PM »
when i opened it i had to turn the system protection on and after that it came up with a window telling me there have been no restore points created

moose

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: default program take over
« Reply #14 on: July 16, 2011, 03:24:45 PM »
OK not good news

Could you reboot the computer
Press and hold F8
On the menu that comes up select "repair my computer"
Let it run and see if that cures it