🚀 go-pugleaf

William Allen <mail@mayfly13.fsnet.co.uk> wrote in message
news:zzFF4.6513$Q5.23128@stones...
> Andy Mabbett <andy@pigsonthewing.demon.co.uk> wrote in message
> news:MEPrAtJaUm54Ewxr@pigsonthewing.demon.co.uk...
> ...snip
> > Windows starts , but attempting to run anything including Win
> > Explorer, OE, etc al) brings up a Windows dialogue saying
> > something to the effect "mueexe.exe not found; needed for
> > file association .exe", and asking to be told where the file is
> located.
>
> Mueexe is **CERTAINLY NOT** needed for exe file association. No extra
> files are needed to start an executable .EXE file other than the OS
> provides.  Mueexe.exe is one of the files dropped by the trojan,
> BackDoor-G2.svr.21, (aka Subseven).  Your file association for
> exefiles has been corrupted by the trojan to make sure its own files
> are run when execuables are started by you.
>
> > That, though has set me wondering - I wonder if that was the virus,
> > and it had set an association for all .exe files, to itself.
>
> Yes.  This is what subseven does.
>
> > My machine doe snot seem to have an association for .exe - how
> > would I remove one from my friends machine, If I can't open
> > Explorer?
>
> Yes it does, otherwise how would it know to run the Subseven trojan
> when you start a file?  The point is that the association has been
> hijacked by the trojan.
>
> You can start to repair the problem.  First, don't try to re-install
> mueexe, you're just re-installing the trojan. Second, get the
> executable file association working.  Yes, I know you can't run
> anything in Windows - that's what DOS is for.
>
> Do this:
> Cut and paste (don't retype) the text below, between the ======
> lines, but not the ====== lines themselves and put it in a Notepad
> text file called EXE.REG - DO INCLUDE the blank lines.
>
> ======
> REGEDIT4
>
>
> [HKEY_CLASSES_ROOT\exefile\shell\open\command]
> @="\"%1\" %*"
> ======
>
> This file should rebuild enough of the EXE association to get EXEs
> working (and overwrite the false association created by the trojan in
> the process).  This is how you use it.  Put in on a floppy.
> Take/send it to your friend.  Boot his/her machine, and when you see
> the message "Starting Windows..." press F8






for win98 read press Ctrl soon after the floppy drive is accessed





 and choose boot to Dos
> command line (item 6 I seem to recall).  When you see the Dos command
> line, put the floppy in A: and type the command:
> c:\windows\regedit.exe a:\exe.reg
>
> This will load the new data into the registry.  Remove the floppy.
> Reboot to Windows.  Now executables should work.  Don't breathe a
> sigh of relief.  Now you have to start clearing up the mess the
> trojan left.  You could try an AV scanner to do this (**NOT** the one
> that got you in this mess), or email me for more details.
>
> > His dealer told him to reinstall windows, loosing all his data -
> > which is not backed up :-(
>
> The dealer should be shot, shortly after your friend (for not backing
> up - inexcusable)<G>.
>
> --
> William Allen
>
>