Member Avatar for Bomba

I had a particularly nasty worm that kept reappearing on my pc after each reboot. So my antivirus company wrote me a custom cleaner. Unfortunately it destroyed my file associations and now everything I try to open takes me to an open with window. They sent me this file but did not tell me how to use it. I am thinking that I need to reformat because rundll.exe is gone as well. Can someone please help me?

FileAssociationRestore.reg

  • 1 Contributor
  • 2 Replies
  • 372 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by Bomba

Dani AI

Generated

Post-mortem notes and practical next steps for 's case (file‑association break after a custom worm cleaner)

Malware cleaners frequently damage file associations and sometimes remove or relocate legitimate system binaries. The Windows host process is actually named rundll32.exe (not rundll.exe) and the genuine copy belongs in the Windows System32 folder; any instance running from other folders is suspicious. Verify whether the correct executable exists and is Microsoft‑signed before trusting replacements. (howtogeek.com)

If a core system binary is missing or corrupted, use the System File Checker to restore protected Windows files (it may prompt for the original Windows installation media). Example command:

sfc /scannow

Windows File Protection also keeps cached copies in %windir%\System32\dllcache or %windir%\ServicePackFiles\i386 on some installs; a known‑good copy can be copied into System32 if available. Back up any files before overwriting. (support.microsoft.com)

After associations and files are restored, hunt for persistence left by the worm: examine autorun entries, services and scheduled tasks with a startup inspector and review running processes for unexpected rundll32 usage. Run a current anti‑malware scan and consider a dedicated rootkit scanner (standalone tools remain useful on heavily infected systems). Keep logs of detections and, if possible, run these tools from clean media or a second machine to avoid live interference. (learn.microsoft.com)

Notes and cautions: always export the registry or create a system restore point before importing any .reg fixes; confirm any replacement system files are legitimate (path, file size, digital signature). If a persistent rootkit is discovered or system behavior remains abnormal after cleaning and file restoration, a clean reinstall from trusted media is the most certain way to eliminate deeply hidden compromises.

Member Avatar for Bomba

Here is the file that they sent me.

Member Avatar for Bomba

Never mind I fixed it with info I found here.

NOTE: If your EXE file associations are corrupted, it can be difficult to open REGEDIT, or to even import REG files. To work around this, press CTRL-ALT-DEL and open Task Manager. Once there, click File, then hold down the CTRL key and click New Task (Run). This will open a Command Prompt window. Enter REGEDIT.EXE and press Enter.
Thanks to Nigel Andrews for this tip.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.