windows cannot find (.exe file). make sure you typed....

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

RandallFlagg

Thread Starter
Joined
Sep 2, 2003
Messages
6
Sorry for opening a new thread. That was the request at the page I looked befor.

I get the message "windows cannot find (.exe file). make sure you typed.... ".

I looked on this site and found places that directed to a program called hijackthis!.

I downloaded it and tried all of them but with no success.

I didn't had to delete any of the files mentioned (system32.exe. rundll16.dll and cet.) because I don't have them.

I have NAV corporate edtion with updated defintion.

here is my log:

Logfile of HijackThis v1.96.4
Scan saved at 17:12:42, on 02/09/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\System32\fast.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\System32\Fast.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\ICQ\Icq.exe
D:\Programs\eMule 0.30a - LSD 12a\eMule.0.29c-LSD10c_by_emulepatch.de.vu.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Programs\Hijack This!\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:hello%20Randall%20Flagg.
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\googlenav.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [FastUser] C:\WINDOWS\System32\fast.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [ICQ] C:\Program Files\ICQ\Icq.exe -trayboot
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\googlenav.dll/cmsimilar.html
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O16 - DPF: {346685E3-C383-11CF-A5A4-00AA00A45705} (ActiveX Control) - http://imd.gonext.co.il/gonext/zazabox/pc/SISActiveX.cab
O16 - DPF: {51C98AC0-31D3-4049-B659-24389E0D94E3} (TCM3Control Control) - http://video.icellcom.co.il/TCM3Viewer.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/iw/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37861.6559027778
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FE446C7D-AAEB-44B5-BD3D-8434F853CAA6}: NameServer = 212.117.129.3 212.117.128.6

thanks for any help.
 
Joined
Dec 9, 2000
Messages
45,855
Welcome to TSG Randall.

I don't see anything inherently bad in the Scanlog.

We need to know WHEN you are receiving this error. Is it on startup or when you try to run or download some particular file?

Is there any more to the message, such as the name of the .exe ?
 

RandallFlagg

Thread Starter
Joined
Sep 2, 2003
Messages
6
It doesn't start when I start the computer. after working on it for a while then the error occures.
It happens to all the exe. It changes the assocation of the file and only to .exe files.
I have downloaded a ref file to fix the problem but I have to run it every 10-15 min. after the first time the problem start in the current session.

If you need anything else just tell me.
 

RandallFlagg

Thread Starter
Joined
Sep 2, 2003
Messages
6
here is the reg file I use to fix the problem temp.

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
 
Joined
Dec 9, 2000
Messages
45,855
I'm very familiar with the exe file association fixes, but I've never heard of the problem happening in the way you describe it.

I'm wondering if it could somehow be related to the use of a file sharing program:

D:\Programs\eMule 0.30a - LSD 12a\eMule.0.29c-LSD10c_by_emulepatch.de.vu.exe

Or perhaps an ICQ vulnerability.

You need to pay close attention to any pattern of net usage that might precede it.

Also I find this "homepage" startup a little unusual; is it something you have personally configured?

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about :hello%20Randall%20Flagg.

I really don't know what that is doing. You might want to to check and "fix" it with HijackThis if you don't understand it either.

Also, do you know if C:\WINDOWS\System32\MsgSys.EXE has always been a part of your Running Tasks? There seems to be some puzzlement as to what it belongs to.

http://www.answersthatwork.com/Tasklist_pages/tasklist_m.htm
 

RandallFlagg

Thread Starter
Joined
Sep 2, 2003
Messages
6
1st of all you can try to set your home page to:

about:your text here.

This will make the browser launch faster insted of going to a specific homepage. try it.
you change it through tools-->internet options.

2nd, as I recall this was always was part of the boot but I will disable it for now and check if it helps.

thanks for trying to help me.
 
Joined
Dec 9, 2000
Messages
45,855
I haven't tried my hand at doing this, and might not be able to be of much help in answering questions at this stage, but I understand it is possible to audit registry keys. In this case you would be looking for any attempt to set values. If nothing else you may learn when the change takes place and under what User's authority.

http://www.microsoft.com/technet/tr...chnol/winxppro/proddocs/regedit_audit_key.asp

From other sources I'm told it is wise not to try this with too many keys at once to avoid performance problems. But you might succeed in narrowing the audit to just the exefile key in HKCR

If that doesn't seem like it's going to get you anywhere, something else I would try is to save a copy of the exefile key just before you make the repair when it happens.

I know you won't be able to use regedit.exe to do this, but copy the file to My Documents and rename it regedit.com

You will be able to run it that way. Then you can see what change was actually made to the key. You can save the key and open it in notepad for side by side comparison with the normal key.
 

RandallFlagg

Thread Starter
Joined
Sep 2, 2003
Messages
6
I might have found a solution to the problem. I have found a file that my previuos antivir didn't find that is called mpldzfg.exe.

If you have this file then delete it.
 
Joined
Dec 9, 2000
Messages
45,855
What was the location of the file and do you know how it was getting run? Nothing in the Scanlog points to it that I can see.
 
Joined
Oct 15, 2003
Messages
1
I have just experienced the same problem, and I also have "eMule.0.29c-LSD10c_by_emulepatch.de.vu.exe" on my machine.

I suspect that this could be slightly more than just a coincidence.

I checked the file with trend pc-cillin with a October 14th pattern file and it said that it didn't contain any viruses.

The file wasn't running at the time the problem occurred, but had been running earlier in the day.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top