Desktop

Ask something
Discussion Locked

Possible Virus

0 helpful
13 replies

by klh456

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We think we have a machine that is infected by a virus but McAfee Viruscan does not pick it up when run from the Internet.

When you try to open any .EXE file it says it cannot find the file kupkhiho.exe.

Does anyone have any information or possible solution?

13 replies

by maxwell edison

There has been a change to your registry that causes Windows to look for that file whenever you try to run a .EXE program. The file does not exist on your hard drive (verify that is indeed the case), so any .EXE won't run. To solve it, follow these steps:

Open the Registry Editor (Start - Run - Regedit).

Select the EDIT menu.

Select FIND.

Enter "kupkhiho.exe" (without the quotes) in the FIND WHAT box.

Delete any registry entries that reference that file.

Good luck.

Max

by maxwell edison

.
.
It just occurred to me that "regedit" is a .EXE file, so it may not run either. To solve this, boot up in DOS mode, rename the "regedit.exe" to "regedit.com", and then run regedit from the DOS command prompt.

I've done this before for a case just like this. It works.

Regards,

Max

by maxwell edison

.
.
P.S. I've seen cases like this where a virus program, such as Norton and/or McAfee, will detect this virus, eradicate it, delete that file (kupkhiho.exe) if it's still there, but stop short of removing the problematic lines from the registry.
And it's always a good idea to backup the registry before doing anything with it - just in case.

Regards,

Max

by bohicam1

Sounds like one of the tricks that the sircam virus is doing lately. Any .exe file you open will automatically be rewritten until your entire system is rendered useless. Go to
www.symantec.com for a fix...macafee should have one as well.
When youran mcafee, did you use the latest virus definitions? It is a fairly new virus.
Use the find files utility for a file called sirc32.exe or scam32.exe and that will be your culprit.
Good luck!

Mike

by klh456

We ran with the latest Definitions but not the latest engine. That seemed to be the problem. So we are now in the process of updating all engines!

by mm212

You'll probably have to copy or rename regedit.exe to regedit.com and then run it. Since it's an exe file, you couldn't run it in the current situation.

Once you have regedit running, go to [HKEY_CLASSES_ROOT]/exefile/shell/open/command and change whatever is there (it probably reads "kupkhiho.exe"%1" or something similar) to ["%1"%*] - Include the quotes, but not the brackets.

by johnny51

Everybody sounds like they're on the right track - if I might add something it would be to boot to a C: prompt, change to the windows folder, type "copy regedit.exe regedit.com" without the quotes...

This will allow you to run regedit when you reboot into safe mode. When you get to safe mode, click start run and type in "regedit.com" without the quotes. This will bring up the registry editor where you need to navigate to the key...

HKEY_LOCAL_MACHINE\Software\Classes\exefile\shell\open\command

It's quite a ways down the list but when you get there modify the contents of that key to be exactly...

""%1" %*" with the quotes this time...

Close the regedit, reboot and you should be OK...now gimme my points!

This discussion is closed to new replies.