[toopay]

Ok here is the problem?
It seem that something has change a lot of my shortcuts and some folders
over from (.exe) to (.lnk) and now I can not open or run these programs not
even in safe mode.
When I try to open one I get the message box.
"Windows cannot open this file:
File: PowerDesk .lnk (example)
To open this file, windows needs to know what program created it. Windows can go online to look it up automatically, or you can manually select from a
list of programs on your computer.
What do you want to do? Then you must choose one of two "use the web" or "select from list"
in either case the web or selection does not open the program. What can be done.

 

[JSntgRvr]

Ok here is the problem?
It seem that something has change a lot of my shortcuts and some folders
over from (.exe) to (.lnk) and now I can not open or run these programs not
even in safe mode.
When I try to open one I get the message box.
"Windows cannot open this file:
File: PowerDesk .lnk (example)
To open this file, windows needs to know what program created it. Windows can go online to look it up automatically, or you can manually select from a
list of programs on your computer.
What do you want to do? Then you must choose one of two "use the web" or "select from list"
in either case the web or selection does not open the program. What can be done.

.lnk are normal extensions for shortcuts. Click on the attacheck file and merge it to the registry. Restart and try again.

 

[toopay]

ok tied and still nothing is changing. Tried to do it in safe mode and still nothing.

 

[JSntgRvr]

Are you sure is the .lnk file association or the .exe association. Here is a link with various fixes:

http://www.dougknox.com/xp/file_assoc.htm

 

[toopay]

Have tried this site also. the problem is that on one user account all is well but on the others there are problems with this ".lnk" thing. Have tried to do the "dougknox" thing in each account and it fixes nothing.

 

[JSntgRvr]

Are there any restrictions on these accounts?

Check the following entries in the Registry on each of these accounts:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSaveSettings"=dword:00000000

If the value "DisableRegistryTools"=dword:00000001, there is a restriction not to allow Registry Tools. If dword:00000000 is present then there is no restrictions. There may be other restrictions.

Is the issue present in the Administrator's Account?

Please come back with some feedback.

 

[toopay]

Have check as suggested the only one that I could not find was; [Group Policy], all the rest have no value listed.
All accounts as listed as Administrator's accounts. Only one account is free of this infection. Would it be wise to delete the other accounts and then reopen them.

 

[JSntgRvr]

I guess this will be the easier way to resolve the issue.

 

[toopay]

have tried to deleted other users accounts and then reinstall them but all is the same. Lnk files are still present.

 

[JSntgRvr]

Try this fix. Download the file and extract it to the Desktop (You will need a .zip utility to extract the file). A new icon will appear on the desktop. Doubleclick on this icon and merge it into the registry. Once done, restart the computer and test.

 

[toopay]

I have tried this and still nothing.

 

[JSntgRvr]

Post a Hijackthis log for review:

http://www.majorgeeks.com/download3155.html

Clear something for me.

LNK are link files (Shortcuts). Most of these are located on the Desktop, Quick Launch Bar, Start Menu and System Tray.

Just to make sure we are talking about the same files, are the .lnk files as I describe them above the ones having problems, of are these files (Not shortcuts) within an especific location that have been transformed from .exe (executables) to .lnk (link) files?

 

[toopay]

Yes you are correct, But am also have the same problem in Safe Mode and on all users accounts.

 

[toopay]

Logfile of HijackThis v1.99.1
Scan saved at 18:54:13, on 8/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\cisvc.exe
C:\PowerPanelPlus\upssrv.exe
C:\PowerPanelPlus\upsio.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HiJackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [KAV50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kav.exe" -run -n PersonalPro -v 5.0.0.0 -chkss
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {02CF1781-EA91-4FA5-A200-646E8241987C} (VaioInfo.CMClass) - http://esupport.sony.com/VaioInfo.CAB
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: PowerPanel Plus Service (CyberPowerUPS) - Cyber Power System Inc. - C:\PowerPanelPlus\upssrv.exe
O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PDEngine - Unknown owner - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Unknown owner - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

 

[JSntgRvr]

There is no Malware in the computer. Close all browsers. Run Hijackthis. Place a checkmark on the following lines and click on Fix Checked:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.130.185.122/sidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O14 - IERESET.INF: START_PAGE_URL
O23 - Service: Kaspersky Anti-Virus Service (KLBLMain) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro 5\kavmm.exe" -run bl -n PersonalPro -v 5.0.0.0 -ttsr 10000000 (file missing)

Yes you are correct, But am also have the same problem in Safe Mode and on all users accounts.

I still have doubts. Is the issue related to the icons on the Desktop, Start Menu, Quick Lauch and/or System Tray, or an especific file in other location that has been converted into an .lnk file from an .exe file?

 

[toopay]

Have done a clean install. Thanks for tring to help fix problem. Hope someone can find a fix for this sort of thing because it will happen to others and hope that they will not have to wipe their system just to fix this problem.

 

[JSntgRvr]

That was premature as not all alternatives were exhausted. You could have ran the System File checker if the installation CD was available, as well as a Repair Install. That would have saved your personal data.

 

[sbudnik]

ok. i am having the EXACT same problem as above. where should i start to fix this? and when you say "merge this into the registry", how do i do that?

 

[sbudnik]

i figured out how to merge into registry and the links you provided fixed my .ink problems. Thanks!!!!!