Program Icons have gone generic

I got your PM, but it would be better to post your results in this thread.

For some reason the screenshots are a bit compressed or something, they aren't very clear. But anyway. Let's get some more file details then.

Inside My Computer, click the Tools menu, and then Folder Options. Then click the View tab. In the list, UNcheck "Hide extensions for known file types". This will let us see the extensions on those files. Then click OK and get out of there.

Next, look through your "generic" icons and list the extensions that they all are. Like are they all one kind? Or lots? My last post would have fixed a problem with EXE, but other associations may have the default program set wrong. This would be like for images or any other kind of document that is supposed to be opened from another app.

So list some extensions, then we'll track one down and see what it looks like.

As a test to see if EXE works right. Click Start-Run and type "notepad.exe". Does it open? Try typing "calc.exe". If those open fine, then EXE file extensions are fine. And it is something else.

Thanks for your reply... all the problem icons are apps only (.exe) everything else appears and functions fine. I did your first .exe procedure that required me to import into the registry but that didn't fix the problem. The notepad and calulator opened fine from "run" as per your tests.

Now what I have discovered is if I open any of the files folders located within my PROGRAMS folder (where I keep all my applications), say Nero, all of the .exe icons are fine and run perfectly. Its like they were protected somehow and eveything else that was "exposed" got changed. And its only this one folder that I keep all my aspps in that is having this problem.

I took a Nero app within the Nero folder and copy/pasted it into my PROGRAMS folder and the icon went generic until the paste proceedure was complete then it changed back to its proper Nero icon. I rebooted and the icon didn't to generic on me, so I have to assume that any new .exe app that I store in my PROGRAMS folder will remain correct... I hope.

I hope I haven't lost you... does any of this help at all???

Thanks again

Do you have TWO programs folders?
The one in your picture seems to be called "PROGRAMS (DO NOT DELETE)". Is there another one as well, which has all GOOD icons?

After you did your copy/paste test, what you're saying now is that you have one EXE file sitting next to another EXE file, but one has a good icon and the other doesn't?
The icon isn't the main issue though, it's when you run one of them, it just pops up the box saying "invalid directory" right? Once we fix that, the icons will probably be restored.

I only have one folder called PROGRAMS (DO NOT DELETE)... its a central place I store all my apps... Your right... its not an icon problem but how that program is starting up... What about the new screen shot I added... under the properties of a bad icon it looks like I see the msdos icon in the top left corner... I don't get that if I click properties of a good icon...

Thanks

Somehow it still seems like a file association problem to me. Though the fact that it is not global to the whole system is vexing.

Those file names are exactly like xxxxx.exe right? Not something like xxxx.exe.c or anything else?

Try this. Click on a bad file just one time so it is highlighted. Then hold the SHIFT key down on the keyboard, and right-click the file. There should be an option called "open with". Click that.
Inside there should show you what the default app to open with, is. What is that app?

If that doesn't lead you anywhere. Right-click a file and click Properties. Then the "compatibility" tab. What settings are selected in there?

Next if that doesn't lead you anywhere. Click Start-Run and "regedit". Once in there, refere to my post earlier about the exefix. Browse to those keys, I think you should be able to follow the file top down. Make sure the values you have in the registry are the ones from that file.
Pay particular attention to this key:

HKEY_CLASSES_ROOT\exefile\shell\open\command
"\"%1\" %*"

This is all it should be, just % signs. The quotes " are also needed exactly as shown. Even the outside ones. There should not be a program in this command, such as "app.exe "%1" or something to that effect.

If all this seems a-ok, then we'll keep going.

Hi Vigilante...
First if all thank you for your continued help with this...

OK, down to business...
I don't get "open with" just "open"...
Under the "compatibility" tab none of the settings are checked...

All the values seen ok except their seems to be some extra lines (I have no idea working with the registry what is and isn't right)

Under [HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00

is InfoTip
TileInfo

also under [HKEY_CLASSES_ROOT\exefile\shellex]

is ContextMenuHandlers and then CmdLineExt is under that

I hope I'm not blah blah blahing here...

I did pay particular attention to the key that you mentioned and it is as you said it should be...

Thanks
Peter

Okay then, we'll assume now that the actual EXE file association is GOOD.

Anybody else feel free to jump in. lol

Well since you said everything got tweaked after installing something. Maybe just go into Control Panel to Add/remove and uninstall it.

After trying to look closely at the files in your screenshot, again I think Techspot compresses them or something because it's all out of focus and I can't really make it out. But the files with the bad icons, you're sure they are EXE files? And not MSI? Because they all look like "installer" programs. Am I right? Are they installers? Or maybe self extracting EXE files from Winzip or WinRAR?

Now that you have Explorer showing file extensions, retake the screenshots so I can see. But I'll take your word

If it is all common to just those files and no other, then what is the common ground? I suppose if you take one of the bad files and copy it somewhere else, it will still be bad?

I've seen viruses mess up things like this too. Do a virus scan from "housecall.trendmicro.com".

I guess there is no "open with" on EXE files. But you should find that item on most other files. You can also see associations by going to Tools-Folder Options-File Types. But that doesn't help here. Unless those EXE files are hiding as something else. Like an MSI Windows Installer file.

I am curious about those files and won't stop till they are back to normal! Maybe you could even E-mail one to me. We'll see what happens when transfered through the air.
If it comes back to normal or maintains its corruption of whatever degree.

One last check off the top of my head, if you right-click the C: drive and choose properties, is the drive checked to be compressed or encrypted? Maybe undo that.
And are you the "owner" of the files? In XP lingo. Is YOUR user the one who created the files? If you are now a different user, then perhaps the "other" user had encrypted them?
Do you have XP Home or Pro? If Pro, check the security settings, that you have access to the files and folders. Though I doubt that has anything to do with it. But I'm running out of ideas right now

I guess I'll just have to actually do some research on this. Oh well. Onwards!

Hey one quick idea. Try renaming a file. Rename it something small. Like if it's "yaddayaddayadda.exe", rename it just "yadda.exe". In other words, use the 8.3 naming convention. No fancy characters, no spaces.
ALSO, copy the file to a directory that also is short. Better yet just copy the new, short named file, to C:. Try to run it from there.

A long shot, but maybe Tweakui or some other "tweak" program, something, messed up the 8.3 name tracking of XP. That is, XP's converting of long names to short names. Because XP is trying to run the app as "progra~1\suchan~1.exe. Maybe it can't "read" the "shorthand" name of using a tilde and a number. And thus says "invalid directory" because it doesn't know with "~1" IS?

SO, rename a file to 8.3 and copy it to C: and see if it works then. IF SO, then we have to fix the 8.3 naming thing. Or whatever is going on. IF NOT, BAHH!

I'm now getting frustrated....

I can't rename any of the .exe programs within PROGRAMS (DO NOT DELETE) folder... I get "cannot rename(program name)...: It is being used by another person or program. Close any programs that might be using the file and try again."

I also couldn't rename the folder PROGRAMS (DO NOT DELETE) either so I tried a reboot. I was then able to rename the PROGRAMS (DO NOT DELETE).. folder. Still can't rename any of the .exe apps within it. Something weird is going on...

I know we'll get through this... lol

I also can't delete any of the .exe applications either

Whats the new name of you Programs folder? Also, do you "install" programs in this folder? Or is it just like a backup folder to keep your downloads and such? Cause if you actualy install programs to this folder, they may not work if you renamed it.

So now your complete path is what? And again, ALL strange behavior in your system is limited now to this one folder and "some" of it's files? Can you rename/delete other files that are not infected?

You didn't say whether you were able to COPY a bad file out of this folder onto C: and work on it from there. You should be able to copy one even if Windows thinks it's in use. And then rename it.

Next I would back off the files for a minute and do some regular system checking.

Run a scan on the HDD (right click C: drive, Properties, Tools, check for errors with both options set)

Run a virus scan online (housecall.trendmicro.com)

Run crapware cleaners and update them:
Adaware
spybot
ewido
bho captor
crap cleaner
Hijackthis (attach a log here after using other tools)
RegSupreme 3.1

You can find all these easily on Google, they will most likely all be the first entry found. They're all free or demo and can be updated and ran.

Let's make sure your system is clean. But I still think it is some kind of registry problem.

And if you can, do you or anyone you know have a disk for Norton System Works 2004 or 2005? If so, pop that disk in and when it comes up, say run tools from CD and then run WinDoctor and fix all it finds. Don't install it, just run WinDoctor off the CD. This will also find errors in the registry and maybe it, and RegSupreme, will find an error and fix it.

With as much stuff as we've tried, I can't help feeling that the fix is so simple we'll feel stupid to not have have seen it! Try to remember, again, what happened just before this. A new app? Uninstall it. New update? Uninstall it. "Fixed something"? Undo the fix. Try to remember. It may be to late to do a "Last Known Good" load of Windows, but that is an option, and a risk.

keep kicking!

OMG... another list of things to do.... kidding... I appreciate that someone cares... lol

OK... here I go...

The new folder is D:\Apps, I only use it for storage

I can delete and rename files that are not infected... basically anything not ending in .exe... Zip, Rar, Iso, Txt... all run perfectly

No I can not copy a bad file and rename it in another directory

I did a HDD scan and everything was OK

I ran all the apps that you told me to run and everything seemed OK... (RegSupreme had about 612 errors but fixed them all). Just had some bad cookies...

I don't have a copy of NSW (go figure I have everything else... Hehehe) but I will try and get a copy.

For some reason I have Adobe stick on my mind... I recently installed Adobe Photoshop CS and Adobe Premiere Elements....

If we, I mean you can't figute this out I think I might have to uninstall each program one by one and see what happens

Thanks again my new friend

Okay, let's see. I doubt PS had anything to do with it. You know, it may be that "something" happened to the files, not sure what. But they may not be salvageable. Since the actual extension of EXE works fine, something may have destroyed these past saving. We may just have to delete them. But before going that route, do all the files "seem" normal besided the icon and and you can't run them? As in, the names are all the same and the file sizes all seem right?

Now let's check the log...

As for running process, I'll comment one by one:

1) C:\Program Files\Executive Software\Diskeeper\DkService.exe
This is just for defragmenting, but there is a chance it could have corrupted files. You don't really have to uninstall it. But maybe remove it from startup and just defrag manually once a month. You DO know how to remove startups right?
Use the program itself firstly, if it has an option to NOT startup. Otherwise, an easy way would be to download AUTORUNS from www.sysinternals.com and use that. It will show more startups then you ever care to know are in your system.

2) C:\Program Files\Dantz\Retrospect\retrorun.exe
This is some kind of backup software you use? I guess it isn't impossible, if the program is trying to "back up" these files, this could be the one that is locking them from being renamed or copied etc...
I would uninstall this app. And of course you can always reinstall it later if you really use it. And get the latest version.

3) C:\Program Files\Computer Lock Up\CompLockUp.exe
I doubt this could corrupt anything. But if you really don't need to secure your machine this much, uninstall it. Juse use a screensaver password.

That's it for processes. Now put a check in a clean these entries in HJT:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.weatheroffice.ec.gc.ca/forecast/city_e.html?on-143&unit=i

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

(IF YOU REMOVE LOCK UP) - O4 - HKCU\..\Run: [Computer Lock Up] C:\Program Files\Computer Lock Up\CompLockUp.exe

(IF YOU REMOVE DISKEEPER) - O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe

(IF YOU REMOVE RETROSPECT) - O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
AND
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\rthlpsvc.exe
-------------------

All in all your log is pretty clean.

Another thought is that something (virus?) DID infect these files, and Norton saw it but couldn't delete for same reason you can't, and thus marked them as non-accessible to prevent them from running? It's a long shot but Norton could have jacked them up. Maybe check the NAV logs or quarantine or something.

Other than all this if it still won't work, we may just have to find a way to get rid of the files and be done with it. If they are "corrupt", and not juse unable to open, then we can't fix them anyway. They need to be removed. Which you can do with a program such as "killbox".

until next time

Don't know if this means anything but I ran Autoruns and under HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved I found with a check mark beside Display Panning CPL Extension File not found: deskpan.dll

Mean anything to you????

Thanks again

icons back

Hello
It looks to me that you have the same problem as I had.
I solved it with this software:
RefreshEm Version 1.0 (freeware)
http://www.downloadjunction.com/product/software/635/
I have no idea what it does but all my icons came back!

Just tried it... RefreshEm Version 1.0 (freeware)... nothing changed

out2late I got the EXE you sent me. It is corrupt over here too. Bad icon etc... though I'm not going to try to run it! Doesn't appear to have a virus (says Panda). I opened it in a hex editor and the header looks okay. Hmmm

Because it is still messed up on my end, we can verify, then, that your registry and installed apps and such are perfectly fine. The corruption is in the files themselves. Which means they likely just need to be erased and be done with it.

When you can't delete them, because Explorer says they are "in use". They aren't really in use at all, they are just corrupt! Explorer somehow can't deal with them. Even on my machine it says they can't be deleted even though I haven't done anything to the file!
------------------

At this point I don't think we should try to fix them. What's done is done. Likely the file headers have been changed or content of the files have changed. Nothing we can do about that.
I would write down, or type up a document of each bad file so you can re-download them again if needs be.

A simple way to delete them is in command line. Click Start-Run and type "cmd" and ENTER. Once in there browse to your folder. Type these commands once it opens:

D: (This changes to your D: drive)

CD \ (This goes to the root of D:, just in case)

CD Apps (This should go into your new APPS folder)

Change the commands as necessary in case the folder/drive names are different etc...

Once you are "in" your apps folder with the bad files, press CTRL-SHIFT-ESC. This opens Task Manager. Next close any open programs you can using normal means.

Next, inside Task Manager, find the process called "explorer.exe" and End Task on that. This will cause your Task Bar and Icons to dissapear. That's normal.

Now you should only have Command Prompt and Task Manager open. Minimize Task Manager for now.
Inside your command prompt we will delete the files. We can do this TWO ways:

1) Just type DEL *.EXE (This will delete ALL EXE files in the folder. It will ask to verify)

2) Type DIR to get a list of files. Then type DEL filename.exe one at a time to delete them one by one. You will have to surround the command with quotes " if the filename has spaces. Like "DEL file name with spaces.exe".

At least, on my machine, this technique let me delete the file. Once Explorer was closed. Don't worry, this procedure sounds long but it's actually quite easy. If, in the command prompt, it still says it can't be deleted. Find and download the program called "killbox". Use that.

If the files are deleted good (no errors), type DIR again to see a listing and check. If all is well, type EXIT and the command prompt will close.

Next go back into Task Manager (or press ctrl-shift-esc again) and click FILE-NEW TASK. Type "explorer" and hit ENTER. This will bring your stuff back. And you can exit Task Manager.

The steps are outlined as so:

1) Close open programs
2) Open command prompt
3) Close EXPLORER process
4) Delete files using command prompt
5) Open EXPLORER
6) Make sure files are gone now
7) If some files still exist, repeat steps and delete file by name
8) If command prompt fails, use KILLBOX

Then re-download the EXE files you need.

One last thought, and this would be for my own research. Download the EXACT file as one of the ones that are corrupt. Send me BOTH the good and the corrupt file. As long as they are supposed to be the same, I can compare the contents and see what has changed. Perhaps it is a simple fix, perhaps it is the same fix for all files. And then again, perhaps the file has been jacked up through and through. If you want you can send me the good and bad files first as a last resort before deleting the files and starting over.

Almost Done!

Also, the "HKLM\Software\Microsoft\Windows\CurrentVersion\She ll Extensions\Approved" entry with "file not found" is normal. And almost always says file not found! So you can keep it or delete it. I've done both and it never seems to make a difference.

To narrow down your startups, click on OPTIONS-HIDE SIGNED MICROSOFT ENTRIES. And then click the REFRESH button. This will eliminate known-good MS ones.

Look for any other entries with "file not found". Usually safe to delete those. ANY entries that point to TEMP directories can be deleted. Look for entries with random looking names such as "293kd.exe" and so forth. Especially if they are in the "windows" or "system32" directories. Post here if you're not sure. Chances are good you are find though.

cheers

Hi, I have looked at the Silent Runner log you sent me (please use this forum not E-mail for sending things and posting

I noticed some things in that log which could be an issue. But since you uninstalled a bunch of programs they may have been removed. Create a fresh SilentRunner log and post it here for us to see.
Also read this thread about how to post your hijackthis log: https://www.techspot.com/vb/topic19133.html

Give us both logs and let's give it one more shot. Thanks.

same problem solved

guyz i follwed the link given by dave

i downloaded the software(refreshEm) and it solved my problem...this is just awesome...cuz i didnt had to read all in this long thread..lol.. thank you dave!!