🚀 go-pugleaf

On Sat, 1 Apr 2000 13:56:48 +0100, Andy Mabbett
<andy@pigsonthewing.demon.co.uk> wrote:

>
>A non- PC friendly acquaintance of mine had a virus warning from his
>scanning software, and followed its helpful advice to "delete
>mueexe.exe"; now he can't run any *.exe file in Win 98.
>
>It's gone from his recycle bin; can he restore it any other way, without
>reinstalling Windows?
>
>I can't seem to find such a file on my machine at all- where is it
>hidden?

  It's not on my machine either.  Which leads me to the conclusion
that it isn't required to be available under Windows, which I kind-of
expected anyway.

   If you cant run *any* .exe file then Windows simply will not start.
Which leads me to feel that the problem may not be as stated.
   I assume you haven't seen said machine to verify the exact problem,
so in your place I'd either go and see it, or if not practical, point
the owner at his dealer, or entice a more accurate description of the
fault from him/her.

   Regards,
         Harry.

In article <41lcessf3a5kukrim25p2oudk5rf4plgte@4ax.com>, Harry Broomhall
<haeb@pc60.demon.co.uk> writes
>   If you cant run *any* .exe file then Windows simply will not start.
>Which leads me to feel that the problem may not be as stated.

Windows starts , but attempting to run anything including Win Explorer,
OE, etc al) brings up a Windows dialogue saying something to the effect
"mueexe.exe not found; needed for file association .exe", and asking to
be told where the file is located.

That, though has set me wondering - I wonder if that was the virus, and
it had set an association for all .exe files, to itself. My machine doe
snot seem to have an association for .exe - how would I remove one from
my friends machine, If I can't open Explorer?

>   I assume you haven't seen said machine to verify the exact problem,
>so in your place I'd either go and see it, 

I did - see above.

>or if not practical, point
>the owner at his dealer,

His dealer told him to reinstall windows, loosing all his data - which
is not backed up :-(
-- 
Andy Mabbett
"Give a man a fish, feed him for a day; teach a man to fish, 
 feed him for life"  - Chinese proverb (500 B.C.)
"Teach him to use the 'Net and he won't bother you for weeks." - Les King

.. and it came to pass that Andy Mabbett <andy@pigsonthewing.d
emon.co.uk> uttered forth:
>In article <41lcessf3a5kukrim25p2oudk5rf4plgte@4ax.com>, Harry 
>Broomhall
><haeb@pc60.demon.co.uk> writes
>>   If you cant run *any* .exe file then Windows simply will not start.
>>Which leads me to feel that the problem may not be as stated.
>
>Windows starts , but attempting to run anything including Win Explorer,
>OE, etc al) brings up a Windows dialogue saying something to the effect
>"mueexe.exe not found; needed for file association .exe", and asking to
>be told where the file is located.

I don't suppose that this is an anti-virus scanning program, is it?
Something set in the registry to scan executables on launch, and
the reg can't find this particular app when calling a scanner. Just a
thought.

If this is the case, try performing a find in the registry for this
filename - the reg or hive key may give some clue to its purpose or
origin.
<snip>
>
>His dealer told him to reinstall windows, loosing all his data - which
>is not backed up :-(

A reinstall of Windoze (over an existing version) doesn't actually
cause a loss of data, unless it attempts to create a "My
Documents" folder and - finding one - overwrites everything with a
blank folder.... does it? It should be possible to archive the data
onto another disk or folder at least to have a backup.
-- 
 
"Dungeon" Dave, in anti-harvest mode...

From: abuse@yahoo.com
From: abuse@btinternet.com
From: *@localhost

In article <SHc7odAZDn54EwCR@ghastly.demon.co.uk>, 'Dungeon' Dave
<Dungeon@SpamNot.Here> writes

>I don't suppose that this is an anti-virus scanning program, is it?

Pass - he wasn't even able to tell me which one he'd been using :-(

>If this is the case, try performing a find in the registry for this
>filename - the reg or hive key may give some clue to its purpose or
>origin.

How, please - I've never dabbled with a registry before.

>>His dealer told him to reinstall windows, loosing all his data - which
>>is not backed up :-(
>
>A reinstall of Windoze (over an existing version) 

It' snot simply a case of reinstalling Windows; he's got a Hewlet
Packard, with CD which will, apparently, return the machine to "as new"
condition.

>doesn't actually
>cause a loss of data, unless it attempts to create a "My
>Documents" folder and - finding one - overwrites everything with a
>blank folder.... does it? It should be possible to archive the data
>onto another disk or folder at least to have a backup.

Worth a try; thanks - he's also got mail, and addresses in OE (which
I've never used), how could these be preserved?
-- 
Andy Mabbett
"Give a man a fish, feed him for a day; teach a man to fish, 
 feed him for life"  - Chinese proverb (500 B.C.)
"Teach him to use the 'Net and he won't bother you for weeks." - Les King

In article <MEPrAtJaUm54Ewxr@pigsonthewing.demon.co.uk> Andy Mabbett
<andy@pigsonthewing.demon.co.uk> shared the following with us in
demon.tech.pc:
[snip]
>His dealer told him to reinstall windows, loosing all his data - which
>is not backed up :-(
[snip]

As a last resort reinstall Windows over the top of the broken copy. All
settings should be retained, and all broken files fixed as long as you
pay attention to when it says it's about to replace a file with an older
copy.

-- 
Marcus Durham
The UMTSDW Homepage. News, Reviews, Features and Locations. 
http://www.zenn.demon.co.uk/drwho/drwho.htm

In article <zzFF4.6513$Q5.23128@stones>, William Allen
<mail@mayfly13.fsnet.co.uk> writes
>Do this:
[...]
>======
>REGEDIT4
>
>
>[HKEY_CLASSES_ROOT\exefile\shell\open\command]
>@="\"%1\" %*"
>======
>
>This file should rebuild enough of the EXE association to get EXEs
>working 

Sadly not; though the other solution offered elsewhere in this thread
fixed that problem.

[...]
>Now you have to start clearing up the mess the
>trojan left.  You could try an AV scanner to do this (**NOT** the one
>that got you in this mess), 

Norton (which was the software use din this case) now reports that
Subseven is still infecting c:\WINDOWS\MSREXE.EXE, which it cannot fix;
it recommends deleting this file. The file cannot be deleted (nor even
renamed, as a backup) as it is "in use by Windows". Will Sophos Sweep
fix it (I won't have chance to try that until tomorrow night), or is
there some other solution.

>or email me for more details.

Thanks again - copy e-mailed.
-- 
Andy Mabbett
"Give a man a fish, feed him for a day; teach a man to fish, 
 feed him for life"  - Chinese proverb (500 B.C.)
"Teach him to use the 'Net and he won't bother you for weeks." - Les King

In article <oetjIBAVzy54EwVQ@tgmead.demon.co.uk>, Tom
<tom@nospam.demon.co.uk> writes
>Below is the file of exported entries which deal with .exe files from my
>registry.

This has fixed the association problem; so the machine can be used.
Thank you again.

However, as described in anther post, the Trojan still appears to be
present :-(


Now, if someone can just advise on fixing my CD/ DVD drive...
-- 
Andy Mabbett
"Give a man a fish, feed him for a day; teach a man to fish, 
 feed him for life"  - Chinese proverb (500 B.C.)
"Teach him to use the 'Net and he won't bother you for weeks." - Les King

In article <s7JTvIBA9754EwGe@pigsonthewing.demon.co.uk>, Andy Mabbett
<andy@pigsonthewing.demon.co.uk> writes
>In article <zzFF4.6513$Q5.23128@stones>, William Allen
><mail@mayfly13.fsnet.co.uk> writes

<snip>

>>Now you have to start clearing up the mess the
>>trojan left.  You could try an AV scanner to do this (**NOT** the one
>>that got you in this mess), 
>
>Norton (which was the software use din this case) now reports that
>Subseven is still infecting c:\WINDOWS\MSREXE.EXE, which it cannot fix;
>it recommends deleting this file. The file cannot be deleted (nor even
>renamed, as a backup) as it is "in use by Windows". Will Sophos Sweep
>fix it (I won't have chance to try that until tomorrow night), or is
>there some other solution.
>
You can delete anything at all from a native DOS prompt (i.e. when you
boot into DOS rather than running it within Windows).

Boot to DOS Prompt via control key

enter:

CD windows  

The file may be hidden, write protected etc, so unset the attributes:

ATTRIB -H -S -R  msrexe.exe

Now, better safe than sorry, rename it:

REN msrexe.exe msrexe.bad

This way you can reverse the thing if necessary, but the file should
probably be consigned to perdition....

<snip>

-- 
Tom

In article <MEPrAtJaUm54Ewxr@pigsonthewing.demon.co.uk>, Andy Mabbett
<andy@pigsonthewing.demon.co.uk> writes
>In article <41lcessf3a5kukrim25p2oudk5rf4plgte@4ax.com>, Harry Broomhall
><haeb@pc60.demon.co.uk> writes
>>   If you cant run *any* .exe file then Windows simply will not start.
>>Which leads me to feel that the problem may not be as stated.
>
>Windows starts , but attempting to run anything including Win Explorer,
>OE, etc al) brings up a Windows dialogue saying something to the effect
>"mueexe.exe not found; needed for file association .exe", and asking to
>be told where the file is located.
>
>That, though has set me wondering - I wonder if that was the virus, and
>it had set an association for all .exe files, to itself. My machine doe
>snot seem to have an association for .exe - how would I remove one from
>my friends machine, If I can't open Explorer?


Below is the file of exported entries which deal with .exe files from my
registry.  Cut this from the line "REGEDIT4" to include the final line
@="%1", paste it into notepad and save it as "EXEFILE.REG.  (Sorry -
this is a text group so I can't just attach it.

Copy it onto a floppy and then boot the failed machine into DOS using
control during booting and choosing "DOS Prompt Only"  Copy the file on
to the root directory of the failed computer.  Then type:

REGEDIT EXEFILE.REG

This will merge the new keys into the registry, overwriting the old
ones.  Hopefully, that will fix the problem.


====Registry file Exefile.reg====Do not include this line====
REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
"Content Type"="application/x-msdownload"
@="exefile"


[HKEY_CLASSES_ROOT\exefile]
"EditFlags"=hex:d8,07,00,00
@="Application"

[HKEY_CLASSES_ROOT\exefile\shell]
@=""

[HKEY_CLASSES_ROOT\exefile\shell\open]
@=""
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\{86F19A00-42A0-
1069-A2E9-08002B30309D}]
@=""

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

======End of registry file====Do not include this line===


>


If that fails, then you could try importing the default settings from
the file "system.1st".  It takes a LONG time, but this is how to do it:


Boot to DOS by holding down control while powering up and selecting
"Command Prompt Only."

From the DOS prompt, issue the following commands:
CD/
REGEDIT /L:SYSTEM.1ST /E DEFAULT.REG

What this does is to take system.1st and create a text version which can
be merged into the system registry by the command:

REGEDIT DEFAULT.REG

This does take a long time and it will remove the pnp devices - when you
next boot they will be detected and reinstalled.



-- 
Tom

In article <zzFF4.6513$Q5.23128@stones>, William Allen
<mail@mayfly13.fsnet.co.uk> writes

Thank you, all, very, very much - I'm off to attempt a fix now.

> Now you have to start clearing up the mess the
>trojan left.  You could try an AV scanner to do this (**NOT** the one
>that got you in this mess),

I have Sweep; I'll try that

> or email me for more details.

(Copy of post  e-mailed)

>The dealer should be shot, shortly after your friend (for not backing
>up - inexcusable)<G>.

That's my second task ;-)
-- 
Andy Mabbett
"Give a man a fish, feed him for a day; teach a man to fish, 
 feed him for life"  - Chinese proverb (500 B.C.)
"Teach him to use the 'Net and he won't bother you for weeks." - Les King

In article <pcSiWiCuC854EwU4@pigsonthewing.demon.co.uk>, Andy Mabbett
<andy@pigsonthewing.demon.co.uk> writes
>In article <oetjIBAVzy54EwVQ@tgmead.demon.co.uk>, Tom
><tom@nospam.demon.co.uk> writes
>>Below is the file of exported entries which deal with .exe files from my
>>registry.
>
>This has fixed the association problem; so the machine can be used.
>Thank you again.
>
>However, as described in anther post, the Trojan still appears to be
>present :-(

Go to www.moosoft.com & get a (free) time limited version of the Cleaner 
Well recommended by others
(Evaluating at the moment)
YMMV
-- 
John Chapple

In article <tRNR3DAIl854Ew0V@tgmead.demon.co.uk>, Tom
<tom@nospam.demon.co.uk> writes
>The file may be hidden, write protected etc, so unset the attributes:
>
>ATTRIB -H -S -R  msrexe.exe

Not in this case.

>Now, better safe than sorry, rename it:
>
>REN msrexe.exe msrexe.bad
>
>This way you can reverse the thing if necessary, but the file should
>probably be consigned to perdition....

Safely removed; though there is no a warning on start-up that it cannot
be found; I tried searching for it in the registry, and deleted (after
backing up!) the only entry which mentioned it by name, something to do
with Winload; but after a restart the message came up again, and the
registry entry returned. Have I omitted to do something to remove it, or
is it coming back from the, er backup? What do I do now?

After removing the file, Norton reported the machine as clean; I then
installed Sweep, which found three occurrences of it, in files called
BAbypaul.bmp, but which Explorer said to b executables. Trying to delete
these crashed explorer, but I finally deleted them from DOS.
-- 
Andy Mabbett
"Give a man a fish, feed him for a day; teach a man to fish, 
 feed him for life"  - Chinese proverb (500 B.C.)
"Teach him to use the 'Net and he won't bother you for weeks." - Les King

In article <8ND3CuAk0N64EwfB@pigsonthewing.demon.co.uk>,
	Andy Mabbett <andy@pigsonthewing.demon.co.uk> writes:
[SNIP]
> 
> Safely removed; though there is no a warning on start-up that it cannot
> be found; I tried searching for it in the registry, and deleted (after
> backing up!) the only entry which mentioned it by name, something to do
> with Winload; but after a restart the message came up again, and the
> registry entry returned. Have I omitted to do something to remove it, or
> is it coming back from the, er backup? What do I do now?

  I suspect (but I'm no expert on registry entries) that this may
be being reset by having an entry in the 'Load=' line in win.ini.

  This is usualy in the first few lines of that file, under the
section header of [windows].  The line *usualy* reads just 'Load='
with nothing after it, but other programs may have set something there
as well.  Look in the 'Run=' line as well.

  On boot Win9x reads the 'compatability' older files win.ini and
system.ini, and puts the result in the registry.

  Regards,
      Harry.


  

Hi,
        I've had problems with Trojans and such-like in the past and I'm
sure that there'll probably be more trouble in the future.  I've signed
up with McAfee's online anti-virus service and found it quite useful,
it's only about 20 dollars for a year's subscription.  I use it nearly
every day.  I also recommend popping along to 
http://www.grc.com 
as it has information on how to prevent your system becoming infected
and has a few pages on testing the security of your PC.  
For extra security I suggest using a software based firewall.  I'm
currently using Lockdown 2000 and Zone Labs' Zone Alarm.


In article <wR6MvUAAwE64EwO1@ch-w.demon.co.uk>, John Chapple <jc@ch-
w.demon.co.uk> writes
>In article <pcSiWiCuC854EwU4@pigsonthewing.demon.co.uk>, Andy Mabbett
><andy@pigsonthewing.demon.co.uk> writes
>>In article <oetjIBAVzy54EwVQ@tgmead.demon.co.uk>, Tom
>><tom@nospam.demon.co.uk> writes
>>>Below is the file of exported entries which deal with .exe files from my
>>>registry.
>>
>>This has fixed the association problem; so the machine can be used.
>>Thank you again.
>>
>>However, as described in anther post, the Trojan still appears to be
>>present :-(
>
>Go to www.moosoft.com & get a (free) time limited version of the Cleaner 
>Well recommended by others
>(Evaluating at the moment)
>YMMV

-- 
Digital.Antichrist