Prev: can not open downloaded Zip files
Next: Spk Icon Missing @ startup on older machine
From: helpwanted on 25 Jul 2010 18:03
When I try to open my System Restore on my HP computer I get an "Open with"
window telling me to "choose the program you want to use to open this file:"

File: rstrui.exe

Any ideas? I think someone has removed things from my computer as I have
used this as few years ago.


From: Elmo on 25 Jul 2010 18:32
helpwanted wrote:
> When I try to open my System Restore on my HP computer I get an "Open with"
> window telling me to "choose the program you want to use to open this file:"
>
> File: rstrui.exe
>
> Any ideas? I think someone has removed things from my computer as I have
> used this as few years ago.

After you remove the malware which damaged the file association for
executables, you may still have to repair the association.

Boot into Safe Mode and run this program,

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

The run in in regular mode. If you can't:

Either remove the hard drive and insert it in an uninfected machine to
run a virus scan, then download (either) the Avira Antivir Rescue System
program which will burn a CD image to a blank CD, (or one of the other
CD's mentioned below). It's updated a few times per day. Insert the CD
into the damaged machine and let it do a scan of your system. Before
starting the scan, select "Configuration" and set to repair or rename
the infected files. Sometimes your machine won't restart after such a
repair process, so you might want to save needed files to another system
before using this. If you can't, then you can move the hard drive to
another machine to copy needed files. You can do that before, or after
this scan.

http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html

AVG now has a Rescue CD that's free. They also have a free USB download
that should work on newer systems that can boot from a USB device. Get
them here:

http://www.avg.com/us-en/avg-rescue-cd

You can try some of the CD's mentioned at the following site.
BitDefender was my favorite, but if the infected machine can't connect
to the internet to get updates, Avira comes with current virus
definitions. Also, some of these just won't run on some systems,
perhaps because there's no drivers available for some system devices,
motherboard, graphics card, etc. So try a few of these till you find
one that works:

Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem:

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Download the executable rather than the .iso image, if one is available,
(though no .exe is available for BitDefender).

After the scan is run, if you elect to quarantine files, they're
quarantined to RAM and lost after you reboot. You'll need to copy any
quarantined files to the hard drive, a thumb drive or elsewhere before
exiting.

Fix .exe file association:

Fix File Associations.
http://dougknox.com/xp/file_assoc.htm

--

Joe =o)
From: PA Bear [MS MVP] on 26 Jul 2010 00:00
There is a very good chance that you are seeing the effects of a hijackware
infection!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including unwanted
software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

Also available via the Consumer Security Support home page:
https://consumersecuritysupport.microsoft.com/

Otherwise...

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

2b. Vista or Win7=> Run this scan instead:
http://onecare.live.com/site/en-us/center/whatsnew.htm

3. Now post the requested logs in an appropriate forum for assistance by an
expert in such matters. DO NOT SKIP THIS STEP!!

I can recommend the expert assistance offered in these forums:
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php, and
http://aumha.net/viewforum.php?f=30

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.


helpwanted wrote:
> When I try to open my System Restore on my HP computer I get an "Open
> with"
> window telling me to "choose the program you want to use to open this
> file:"
>
> File: rstrui.exe
>
> Any ideas? I think someone has removed things from my computer as I have
> used this as few years ago.

 | 
Pages: 1
Prev: can not open downloaded Zip files
Next: Spk Icon Missing @ startup on older machine