PC will open no apps or programs...gives View Downloader Pop Up

[theblackyak]

Hi everyone:
I hope you can help me. My neighbor is having a problem with his PC. It is polluted with fake antivirus, that much I can see. I found PC Mighty Max and Win 7 Security 2013 right off. He also legitimately has McAfee and MS Security Essentials, and has had for some time by the looks of things. However, I can't get rid of anything.

All of his shortcuts now feature the Internet Explorer Icon. Everything. Any attempt to open a working program, even the regedit, results in the View Download Manager pop up, at which point you have to select run or save. regardless of which selection you choose, or cancelling out of it, nothing works. I can't download any help, I can't access the Net from his PC to locate help (it will actually ask if you want to run or save iexplorer) and I can't put any new files on his PC or run them from a flash. Same thing. The pop up.

Starting in Safe Mode does not help and I can't do a system restore because it asks if I want to run or save that, also.

The best I can tell, this began following some automatic updates to IE on Tuesday night. Getting rid of the updates did not help. There were also two add-ons running without permission that were acquired at the same time as the update. I disabled those. Nothing.

Suspicious entries in the task manager include IGFXTray Module and CTFmon.exe, as well as OpenWithMonitor from PC Mighty Max. Ending those processes also does not help.

I would love to tell you exactly what he was doing when all of this began, but he has a raft of little grandkids under ten and it was messed up when he got home, so it's hard to tell. I can concretely say that his wife logged on between 5:30 and 6 and that the automatic updates were at 5:41. She had all of these issues immediately.

Any advice? I am no tech genius, but I can usually figure out a virus. This one, though, is beyond me. Thank you so much in advance.

 

[Kaktussoft]

Put an exe a jpg a doc a mp3 file an usb stick. Attach stick to sick system. Double click on the files. Also opens as html? I think virus just renamed the files (?)

 

[theblackyak]

I tried it. It will let me move the files from the flash drive onto the PC. However, if I click them from the flash (or from the PC, after I copy them over), I still get the same big square pop up asking if I want to run or save. It also does the same thing with txt. It is pretty irritating, I have to say.

 

[Kaktussoft]

exe - Executable application files.
lnk - Shortcut link (LNK) files.
txt - Text document files. The default program is Notepad.

More extension problems?
Source: http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html

 

[theblackyak]

Thank you so much! That appears to have worked. After the reg fix, I was able to get in and sort out the raft of other problems and kill the reg entries that needed to die, as well. It seems to be operating correctly now.

 

[Kaktussoft]

Did you have malware or virus? Do an offline virusscan. What is Windows Defender Offline?

 

[theblackyak]

He had a cornucopia of junk. He had a TON of adware and spyware, four fake anti virus sweeps that were all malware, the fakealert Trojan, some Microsoft IE CVE 2013 stuff...and I don't even know what those are... Bloodhound and an older version of Zbot...maybe Zbot41, I don't recall the number.

Evidently, someone disabled MSE about a month ago, which was the beginning....

I will run an offline scan for him when I go up there tomorrow. I should have done that today when I was there the first time, but I was so thrilled to finally be able to navigate that I got ahead of myself.

Thanks for all of your help. I plainly could see the icon change for anything exe. That should have registered in my brain. Thanks for pointing it out. You made life much simpler.

 

[Kaktussoft]

He had a cornucopia of junk. He had a TON of adware and spyware, four fake anti virus sweeps that were all malware, the fakealert Trojan, some Microsoft IE CVE 2013 stuff...and I don't even know what those are... Bloodhound and an older version of Zbot...maybe Zbot41, I don't recall the number.

Evidently, someone disabled MSE about a month ago, which was the beginning....

I will run an offline scan for him when I go up there tomorrow. I should have done that today when I was there the first time, but I was so thrilled to finally be able to navigate that I got ahead of myself.

Thanks for all of your help. I plainly could see the icon change for anything exe. That should have registered in my brain. Thanks for pointing it out. You made life much simpler.

Not someone but something did disable MSE... most likely a virus. Must be a crazy porn lover or someone who doesn't read and clicks on everything on internet. Those people keep bad browsing behaviour for ever