Broken registry

[crab66]

Hey folks, I denied a registry change called EXE and it turns out it disabled/broke just about every program on my pc. I have firefox running somehow through the "run" menu though not directly from choosing to run firefox. I am not sure what to do at this point. I can't open up regedit and only a few basic things that are tied to windows will run.

Any help is appreciated. Should I try safemode or windows recovery or am I just wasting my time?


:oops:

[drragostea]

Yikes a "broken" registry is a bad. Can you see your desktop? Also, can you boot in normal mode?

-------
In TeaTimer 1.5:

If you check "Remember this decision" on a registry change, the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" similar registry changes for all future changes. To edit that information: Right click on the TeaTimer system tray icon (labeled "Spybot-SD Resident") and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
Allowed registry changes
Blocked registry changes
Allowed processes
Blocked processes
You can review all the entries that you have stored by clicking on these buttons. If entries you are interested in are for registry changes, the entries that you should review are in "Allowed registry changes" and "Blocked registry changes". You can delete stored entries by clicking on the scripted black "X" to the right of the entry that you want to delete, answering "Yes" to the confirmation dialog and then clicking the "OK" button when you're done.
--------

Find the .exe entry in one of the tabs... can you see your taskbar (start menu button and clock)?

Also, have you ever had malware problems in the past? Is your machine patched? What OS (Operating System) are you using?

[crab66]

Yikes a "broken" registry is a bad. Can you see your desktop? Also, can you boot in normal mode?

-------
In TeaTimer 1.5:

If you check "Remember this decision" on a registry change, the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" similar registry changes for all future changes. To edit that information: Right click on the TeaTimer system tray icon (labeled "Spybot-SD Resident") and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
Allowed registry changes
Blocked registry changes
Allowed processes
Blocked processes
You can review all the entries that you have stored by clicking on these buttons. If entries you are interested in are for registry changes, the entries that you should review are in "Allowed registry changes" and "Blocked registry changes". You can delete stored entries by clicking on the scripted black "X" to the right of the entry that you want to delete, answering "Yes" to the confirmation dialog and then clicking the "OK" button when you're done.
--------

Find the .exe entry in one of the tabs... can you see your taskbar (start menu button and clock)?

Also, have you ever had malware problems in the past? Is your machine patched? What OS (Operating System) are you using?

Thanks for the response. Yes I am able to boot normally and see my desktop. I am able to run programs through "right-click" and "run" but not directly. No programs are running at startup so Resident is not active. Is it possible to start it manually? I am running winXP sp2 with all updates. I do not have many problems with malware and am unsure if this is related to anything of that nature.

[drragostea]

Can you elaborate on how the ".exe" registry change prompt came to be? Also, can you recall the exact message of the prompt. Also, you can access the Internet with no problems correct? Did you access your browser via. run?

Thats odd. What I would like to know is... the start-up programs, and your desktop. You said you can boot normally and see your desktop. But can you left-click on a icon. Say like "My Documents" for example. Also, can you click the "clock" on your taskbar? Or is the primary click disabled?

Edit: I re-read your first post. You said EXE not .exe. Can you clarify thanks.

[crab66]

Can you elaborate on how the ".exe" registry change prompt came to be? Also, can you recall the exact message of the prompt. Also, you can access the Internet with no problems correct? Did you access your browser via. run?

Thats odd. What I would like to know is... the start-up programs, and your desktop. You said you can boot normally and see your desktop. But can you left-click on a icon. Say like "My Documents" for example. Also, can you click the "clock" on your taskbar? Or is the primary click disabled?

Edit: I re-read your first post. You said EXE not .exe. Can you clarify thanks.

I had just extracted a zip file to my desktop, ran the program it contained(http://orbit.medphys.ucl.ac.uk/). It had a lockup and I re-booted. On startup resident prompted a registry change. I can not tell you for certain because this was several hours ago and I was not paying close attention(not an excuse but the truth) to begin with but I am pretty sure it was EXE.

I am able to open up basic Explorer stuff like My Documents as well as select icons but left clicking gives me an error for actual programs. I am unable to open the clock on my taskbar.

This is the error I receive when trying to run any program through normal means:

This file does not have a program associated with it for performing this action. Create an association in the folder options panel.

It is the same for all programs.

[md usa spybot fan]

crab66:

What Windows OS are you running?

[drragostea]

This problem is sneaky :sad:

@md, crab66 is running Windows XP with SP2.

[md usa spybot fan]

crab66:

The problem is most likely a file association problem. If you are running Windows XP, the following Web page has fixes for problems with file associations:
Windows® XP File Association Fixes
http://www.dougknox.com/xp/file_assoc.htm
The fix for EXE files is:
EXE File Association Fix (http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip) (Restore default association for EXE files)

NOTE: If your EXE file associations are corrupted, it can be difficult to open REGEDIT, or to even import REG files. To work around this, press CTRL-ALT-DEL and open Task Manager. Once there, click File, then hold down the CTRL key and click New Task (Run). This will open a Command Prompt window. Enter REGEDIT.EXE and press Enter.
Thanks to Nigel Andrews for this tip.

[Terminator]

XP Service Pack 3 is now out so once you've got this problem fixed, install it to prevent any security problems

[crab66]

crab66:
The fix for EXE files is:
EXE File Association Fix (http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip) (Restore default association for EXE files)

That fixed the problem. Thanks for the help guys.