BKDR_OPTIXPRO.12 Trojan messed up EXE association

[belgianexpatria]

Hi,

This morning my Windows 98 PC got infected with BKDR_OPTIXPRO.12 (=Trojan horse Backdoor.Optix). My AVG anti-virus detected it and blocked access to infected file REGSRV.EXE but not before it had installed itself.
Stupidly enough I did reboot my PC before checking and removing every component.
I then did an extra scan with Trend Micro Housecall (http://housecall.antivirus.com/housecall/start_corp.asp) which detected 1 more infected file in my C:/WINDOWS directory - winampw.exe
I deleted it, as the anti-virus software couldn't clean it.
After doing that I could not run ANY application unless I click on an associated file. After checking the File Types Tab under Windows Folder Options I discovered that ALL Applications had been reassociated with that infected winampw.exe file to be able to run. I obviously cannot run regedit.exe or any registry editing app under Windows anymore to change the association and the File Types Tab under Windows Folder Options does not allow editing of that particular association.
I am stumped!!! I there any way I can change the application association back to its original state?
I checked these 2 links:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=BKDR_OPTIXPRO.12
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optixpro.12.html
but none of them deal with this particular problem I got.
Please help me out! :( Throw me a bone. I'd be much obliged.

[mjc]

Ok you can try downloading and running a program called exefix...

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

It runs in DOS and restore the proper exe file associations.


EXEfix08 for Windows 95/98 - Freeware by rmbox


This program will restore the standard "EXE" information
into a Trojan altered Windows 95/98 Registry.


1. Click on the EXEfix08.com to restore the correct exe settings.



More information:

When current Anti-Virus software packages spot some trojans,
they delete or quarantine it.
This can create a system paralysis that will not allow any of the
programs with an "EXE" extension to work.

The EXEfix08 will end this paralysis and allow the programs to
operate normally again.

The next step in the trojan removal is to edit it from your
System Files and Registry.

Please see the Rx-Pack download for further assistance.

EXEfix08 only imports the neccessary "exe" data.
It does not make any other changes to your Registry.
It will not leave any unknown files on your computer.

Just click on it and let it fix things for you.



~ rmbox 12/24/2000

[belgianexpatria]

Thank you very, very much! That's exactly what I was looking for! You're the first person who replied to my posts concerning this and you saved me a considerable amount of hassle. :D Much obliged! :cool:

belgianexpatriate

[aussieolie2]

I had the same problem. Just go into console or DOS and copy regedit.exe to regedit.com and you can access the registry :)
You need to follow these instructions. Its quite easy to fix and you will not have any of the problems.
I got this worm (first ever virus/worm EVER!!! on Friday night!) because stupid NAV tried to put it in Quarantine.
Check out:
Everything to fix it is here:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optixpro.11.html

Olie :D

[belgianexpatria]

I checked out the link. It's got much more elaborate info on the effects of the Trojan and how to get rid of it than it did for my version of it (12). :mad: Even though it acted the same way.

Nice guidelines on how to access regedit in DOS! :) That's one of the things I tried and failed miserably at. I'm useless at DOS commands.

I know I'm side-tracking the thread here, but does anyone know of some good manuals or tutorials on DOS posted on the web? Preferably for free? :D

Belgian Expatriate

[YODA74]

http://www.computerhope.com/msdos.htm

http://www.easydos.com/dosindex.html

http://elsa.berkeley.edu/sst/basic.dos.html

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=DOS+commands

[tommy]

aussieolie2,


"No one will ever need more than 640k of memory" (Bill Gates, 1985)

While Gates may have made that statement, it was imposed by IBM in their original PC design circa 1982. And DOS had to live with it for years.:)

[aussieolie2]

Thats interesting. But know one can make preditions like that in the IT industry... Its like me saying you will only ever need max a 100GB drive, but who can tell in 5 years time. 5 years ago we have 500-1GB drives.

Cheers,

Olie :D

[belgianexpatria]

Hmm, and here's me who only a year ago was running an AST desktop PC with a 490mb hard drive, a 60mhz processor & 16mb of RAM.
And ironically, I am running an IBM PC right now. Slightly - I can't stress this enough - slightly more advanced than the previous one in the greater scheme of things.

Did I mention I enjoy history and antiques? :D

[Budfred]

And my first computer didn't even have a hard drive, just 2 5.25inch floppies. My next computer was a monster with a 40meg hard drive, didn't think I would ever fill that up!!

Budfred

[aussieolie2]

Im prob younger than alot of people here. The first PC I ever touched used cassette tapes!!!! I cannot remeber what it was. that was when i was in year 2...
i also used the IBM PCJR (4 disk drives (1.44 and 5 1/2 inch)!!
lol

haha check this out: http://www.obsoletecomputermuseum.org/ibmpcjr/

Olie

[belgianexpatria]

Hmm, anyone else ever had an Atari playstation as a kid in the 80s? :D