🚀 go-pugleaf

Andy Mabbett <andy@pigsonthewing.demon.co.uk> wrote in message
news:MEPrAtJaUm54Ewxr@pigsonthewing.demon.co.uk...
...snip
> Windows starts , but attempting to run anything including Win
> Explorer, OE, etc al) brings up a Windows dialogue saying
> something to the effect "mueexe.exe not found; needed for
> file association .exe", and asking to be told where the file is
located.

Mueexe is **CERTAINLY NOT** needed for exe file association. No extra
files are needed to start an executable .EXE file other than the OS
provides.  Mueexe.exe is one of the files dropped by the trojan,
BackDoor-G2.svr.21, (aka Subseven).  Your file association for
exefiles has been corrupted by the trojan to make sure its own files
are run when execuables are started by you.

> That, though has set me wondering - I wonder if that was the virus,
> and it had set an association for all .exe files, to itself.

Yes.  This is what subseven does.

> My machine doe snot seem to have an association for .exe - how
> would I remove one from my friends machine, If I can't open
> Explorer?

Yes it does, otherwise how would it know to run the Subseven trojan
when you start a file?  The point is that the association has been
hijacked by the trojan.

You can start to repair the problem.  First, don't try to re-install
mueexe, you're just re-installing the trojan. Second, get the
executable file association working.  Yes, I know you can't run
anything in Windows - that's what DOS is for.

Do this:
Cut and paste (don't retype) the text below, between the ======
lines, but not the ====== lines themselves and put it in a Notepad
text file called EXE.REG - DO INCLUDE the blank lines.

======
REGEDIT4


[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
======

This file should rebuild enough of the EXE association to get EXEs
working (and overwrite the false association created by the trojan in
the process).  This is how you use it.  Put in on a floppy.
Take/send it to your friend.  Boot his/her machine, and when you see
the message "Starting Windows..." press F8 and choose boot to Dos
command line (item 6 I seem to recall).  When you see the Dos command
line, put the floppy in A: and type the command:
c:\windows\regedit.exe a:\exe.reg

This will load the new data into the registry.  Remove the floppy.
Reboot to Windows.  Now executables should work.  Don't breathe a
sigh of relief.  Now you have to start clearing up the mess the
trojan left.  You could try an AV scanner to do this (**NOT** the one
that got you in this mess), or email me for more details.

> His dealer told him to reinstall windows, loosing all his data -
> which is not backed up :-(

The dealer should be shot, shortly after your friend (for not backing
up - inexcusable)<G>.

--
William Allen