Recovering from a malicious Registry modification caused by the "Backdoor-J.svr" Trojan Virus...PLEASE HELP....

[JerryD]

I am have a little dilemma on my hands. Recently, a Trojan virus had infected my computer and, as a result, maliciously altered my Window's Registry to the point where, now, all application files (*.exe extensions) on my computer cannot be executed without a this warning message always popping up (including "Regedit.exe"!):

--------------------------------------------------
Windows cannot find "windos.exe"

This program is needed for opening
files of type "Application"
--------------------------------------------------

So, I guess my question is: Is there an area in the Registry that I can analyze in order to see
what sort of file associations or dependencies are being made on my computer? I really need to know if it exists because I have already tried looking in the Window's "Win.ini" and "System.ini" system files and could not find any associations with a "windos.exe" file. So, by process-of-elimination, I figured that my problem probably lied within the keys and sub-keys of the Window's Registry. Well, this is my dilemma. I hope somebody out there can relate and give me some helpful tips on how I can resolve this problem. Your feedback would be greatly appreciated.

- Thanks for your time and concern

[jstolz]

Yes, you can examine the registry; specifically HKEY_CLASSES_ROOT\.exe and HKEY_CLASSES_ROOT\exefile. Take a look at the following exported contents of these keys that I have on my Win98 system. You didn't say what version of Win you're running, but I don't think it'll matter: Here's what I suggest--
1. Open regedit and navigate to HKEY_CLASSES_ROOT\.exe so that key is highlighted in the left pane. Click on File>export and save that branch as file1.reg.
2. Now navigate to HKEY_CLASSES_ROOT\exefile so that key is highlighted in the left pane. Click on File>export and save that branch as file2.reg.
3. You've just made a backup of those two keys so if what I suggest next goes bad, you can at least restore back to where you are now. Now, cut between the cut marks for the script below, and paste it into an empty text file. Rename the file file3.reg.
4. Double-click the file to import (or merge) into the registry.

The change should take effect immediately, and hopefully your Windos error messages should be gone.

Regards...
---CUT
REGEDIT4

[HKEY_CLASSES_ROOT\.exe]
"Content Type"="application/x-msdownload"
@="exefile"

[HKEY_CLASSES_ROOT\exefile]
"EditFlags"=hex:d8,07,00,00
@="Application"

[HKEY_CLASSES_ROOT\exefile\shell]
@=""

[HKEY_CLASSES_ROOT\exefile\shell\open]
@=""
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHan dlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHan dlers\{86F19A00-42A0-1069-A2E9-08002B30309D}]
@=""

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

---CUT

[JerryD]

jstolz,
I just wanted to let you know that your suggested solution was a success. I can't thank you
enough for helping me resolve my problem. I greatly appreciate the time and effort that you
spent on figuring out the preceding solution. Thanks a lot. =)

- Sincerely,
JerryD