Programs cannot be executed in explorer, but could be opened via New T

[Crisper]

Hi all,

the story is:

As I used my computer as normal in the afternoon, I had word, outlook and something opened and was using firefox, opened some websites about guitar.

All the sudden one balloon in the notification area came out and said that the firewall was turned off. I felt weird but I didn't think too much and turned the firewall on again. At this time one message box prompted and said some segment of memory cannot be read. I didn't note it and clicked OK.

And then I found that all the programs cannot be executed, with the sand glass icon turning twice and then nothing.

I restarted the Windows, finding that still all the programs cannot be opened, including all the programs that normally would be running with the start of Windows. "All programs" means, not only exe files, but also com files and others, txt, jpeg, all. All the items in control panel cannot be executed either.

I tried safe mode, directory restore mode, debug mode. Once in the debug mode the programs could be opened, so I used System Restore to go back to one restore point of yesterday (cannot see other restore points). Reboot, all the same...

One thing to be noted: I can open Task Manager via alt + ctrl + delete (not via right clicking on the taskbar and select Task Manager). If I know the path of the executables, I can run them through "New Task (Run...)" in Task Manager, the control panel items can also be executed in this way.

The second thing to be noted: I tried to open cmd through Task Manager, it works fine. But when I try to execute "cmd" in "Run", a command line window flashes once in a second then disappears. It seems that maybe all other programs were also terminated automatically, as soon as they were opened.

The third thing to be noted is, the Windows Firewall will be now turned off automatically upon restart. It worked fine before.

It seems to have something with virus, but I checked with Symantec Antivirus, no virus is reported.

Has somebody any idea? I googled all the way and searched here also, didn't get any luck...

It'll be great that any one can give some hints, thanks a lot!

cheers

Charles

[Irene]

It certainly sounds as if you have collected some infection...

Trend Micro HouseCall is an on-line free scan which is recommended to detect and remove malware.

I believe that v6.6 is advisable as it runs better than v6.5.

Just try that to begin with, then post back to let us know how it goes.

Further help will be available, I am sure. :)

[Scarecrow Man]

http://support.microsoft.com/kb/311446 or http://support.microsoft.com/kb/310585

Can you please provide the exact text of the error? A screen shot would be excellent as well.

[Crisper]

Thanks you guys.

I'll try Trend Micro HouseCall tomorrow.

I have read those two articles from Microsoft knowledge base after the problem occurred. But they are not directly related to my problem, the symptoms are different. Even though I tried the .exe solution, no use...

Hope there is still somebody who experienced this strange situation before.

Thanks again!

[Crisper]

http://support.microsoft.com/kb/311446 or http://support.microsoft.com/kb/310585

Can you please provide the exact text of the error? A screen shot would be excellent as well.

there is no error message now at all... the windows acted like normally, but only no program can be opened in explorer.

[Dencandy]

Run the virus scan recommended by Irene & follow any recommendations you get carefully.

After that, what information do you get from Security Centre about the firewall and which firewall is it?

[Crisper]

I'm scanning my system with Trend Micro HouseCall. Must wait 5 hours...

Just found another interesting thing.

I can execute programs through "Total Commander" (an explorer substituting software). And all the programs in the start menu, I can only open "My Computer". Seems that the problem is with the explorer?

[Dencandy]

Seems that the problem is with the explorer?

That's very possibel, but wait till the Trend Micro Housecall scan is finished. It's extremely thorough & will tell you if there's a virus/malware problem.

Also post the details about your firewall later (if there's still a problem).

[Crisper]

Oh, forgot to mention, the firewall is just Windows Firewall comes with Windows XP.

The message was like "No firewall is turned on, system is at risk", very simple, no other error messages. After I turned it on (also through Task Manager), it disappeared.

[Dencandy]

OK, you may have a problem with the Security Centre, but wait till you have the results of the Virus/malware scan from Trend Micro.

[Crisper]

Thanks a lot you guys.

I finally fixed the problem, although I don't know exactly how.

The result of Trend Micro listed that a grayware ADWARE_BESTOFFERS (Aliasnames: Win-Trojan/Clicker.83456 (Ahnlab), Adware.Bestofer (Ikarus), PAK:PE_Patch.PFD (Kaspersky), Adware-abetterintrnt (McAfee), Win32/Adware.BestOffer (Nod32), Trj|Downloader.FLS (Panda), The Best Offers Network (PestPatrol)) has been found.

And several MS Office related system vulnerabilities have also been found. I clicked clean the grayware and installed the Office patches. Restart, everything was the same, program cannot be opened through explorer.

So I tried several malware scan software like Spy Doctor, Spy bot S&D, SDfix, SuperAntiSpyware etc. Many problems were found.

But I think these are most critical:

Trojan_Spy.Zbot; Win32.Agent.pz.

They had something to do with "/system32/ntos.exe" and some directories named "wsnpoem" (under system32 folder and "Document and Settings/NetworkServices", "Document and Settings/LocalServices" folder, also some audio.dll, video.dll files under wsnpeom were found.

Registry entry HK_LM/Software/Microsoft/Windows NT/CurrentVersion/Winloggon/Userinit has also been modified, a value including the path of ntos.exe was added.

It was pretty difficult to change it back because ntos.exe cannot be deleted, and one wsnpoem directory was hidden somewhere, I found it at the very end. And once I corrected the registry, it would be changed back again.

What I'm not sure is, what software actually managed to solve this because they all seemed not to be able to do that, but suddenly I found the programs could be opened, although still with errors like some programs crashed, and with the registry entry about ntos.exe was still there (ntos.exe file disappeared though)...

So I tried something else and tried to boot to safe mode and checked again. Somehow everything went fine (except Outlook crashes sometimes, clipboard sometimes doesn't work well)...

Still I'm not very happy because I don't actually have a clue how exactly I solved the problem, what if it happens again?

[Dencandy]

Thanks a lot you guys.

I finally fixed the problem, although I don't know exactly how.

Still I'm not very happy because I don't actually have a clue how exactly I solved the problem, what if it happens again?

Glad to hear you solved the most urgent problems, Crisper.

I think you've got 2 main options:

1 Make sure you keep your anti-spyware and anti-virus programmes up-to-date; install an application to protect your core systems (WinPatrol or Windows Defender); install the McAfee SiteAdvisor to warn you about unsafe websites; replace the 1-way Windows firewall with a proper 2-way firewall.

2 Back up all your important data and re-install Windows, then re-install your data. This would be the best option but is likely to be time consuming.

[Crisper]

I think I'll stay with the current system for the moment with anti-spyware on.

Actually I always have Windows Defender on my computer but I think what it can do is pretty limited, right? I installed WinPatrol and SiteAdvisor. Many many thanks!