[Resolved] Windows System File AEFAH.EXE

[ebatson]

System is Win95 B. Installed Nortin AntiVirus 2001, rebooted. NAV did autoscan before Windows launched and found Sub-Seven virus in file C:\Windows\System\AEFAH.EXE - I chose
"quarantine" - bad move. Should have said "repair".
Windows still boots w/some functionality available
but file is used to launch ANY GUI app. Can't get into the
NAV Quarantine Console in Windows and I can't locate any options in NAV in DOS for that. Can access Control Panel but cannot launch any of the members (get missing aefah.exe msg) Can browse the Win95 CD - checked all CABS files for aefah.exe - no go. Tried booting from Win95 CD (to reinstall) but system not doing it. Checked BIOS - put CD in boot sequence still no go. Please try messaging answers as I'm not sure I can get to the email - maybe do both. Thanks

 

[brianF]

moving to security. That file was probably part of the virus, it's not a windows file. Seems like the virus was quarantined but not removed

 

[TonyKlein]

Hi Ebatson,

You don't need Aefah.exe, for it's a file generated by the trojan. Therefore you don't need to 'repair' it either.

Here is a site dealing with Subseven removals: http://www.hackfix.org/subseven/

It is however important to know the exact version of your Subseven trojan. If Norton can tell you that, check the site to know what steps you should take.

Maybe you should start by downloading a trial version of <A HREF="http://www.moosoft.com/intro.php">The Cleaner </A>
Update with Moolive after downloading, and scan your system.

Good luck,

 

[brianF]

You probably need to go here http://home.earthlink.net/~rmbox/Reticulated/Toys.html and download the exe fix program. But others on the board are far more knowledgeable about this than me

 

[ebatson]

Thanks. Downloaded The Cleaner and EXEfix08.
Will try The Cleaner 1st. Don't know what will
happen since Norton renamed file and moved it
to quarantine folder. Could try copying back with
orig name in DOS then rebooting and running
Cleaner but will have to see how it goes. I'm
using Netsurfer to access web right now. I was
actually able to get to Outlook Express thru this
little browser but can't launch from Desktop! Will
let you all know...

 

[ebatson]

Can't install The Cleaner because GUI won't launch. Get msg that AEFAH.EXE is missing. Will try EXEfix08 and expext I'll have to recover and rename file from NAV quarantine folder (must do this in DOS) and try to run fix program.

 

[Rollin' Rog]

The exefix08.com file will usually run from windows even when exes are not running.

In some cases however you may need to run a .inf or .reg file to get the fix to work; these are available on the ONLY IE link at the bottom of the Reticulated Toys page.

 

[ebatson]

Thanks to all, espcially brianF and Rollin' Rog. I was able to run EXEfix08.com and it repaired my system. I had additionally done manual work on the system.ini and win.ini files thanks to info I found at the Reticulated Toys site.

This was a happy ending. After applying the fix I was able to launch Windows apps, get into Norton AntiiVirus and scan the whole PC. I found 3 more sub-seven-22 viruses on the box. They're all history now and the PC's back in business.

Again - thanks a million, couldn't have done it without you all.