Norton antivirus problem?

**Aboulaly** · 22-02-09, 01:18 PM

Has any one experienced this problem with Norton, as it detects a w32.Neshuta on your computer, it automatically removes the following registry key HKEY_CLASSES_ROOT\exefile\shell\open\command
causing a problem when you click any application icon it gives you a message that this icon is not associated with any application, make sure you typed the right path, or something along those lines.
and you won't be able to do anything not even a system restore.

if you had or heard of this problem what was the best way to fix it?

**best4less** · 22-02-09, 01:21 PM

Remove Nortons

and use a different program

**Aboulaly** · 22-02-09, 01:25 PM

Originally Posted by best4less

Remove Nortons

and use a different program

That's another issue all together mate LOL

But once this registry key is removed you can't do anything. you can'y remove, install or run any program.

**ssrattus** · 22-02-09, 01:27 PM

See 4. on the restoration of the registry from gives:

MANUAL REMOVAL:

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files detected.
4. Delete any values added to the registry.

Navigate to the subkey and restore value:
HKEY_CLASSES_ROOT\exefile\shell\open\command
Value: "(Default)" = "%1" %*"

5. Exit the Registry Editor and restart the computer.

Norton has similare advice here

1. Click Start > Run.
2. Type regedit
3. Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

4. Navigate to the subkey:

HKEY_CLASSES_ROOT\exefile\shell\open\command

5. In the right pane, restore the value to:

"(Default)" = "%1" %*"

6. Exit the Registry Editor.

**Aboulaly** · 22-02-09, 01:40 PM

Originally Posted by ssrattus

See 4. on the restoration of the registry from gives:

MANUAL REMOVAL:

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files detected.
4. Delete any values added to the registry.

Navigate to the subkey and restore value:
HKEY_CLASSES_ROOT\exefile\shell\open\command
Value: "(Default)" = "%1" %*"

5. Exit the Registry Editor and restart the computer.

Norton has similare advice here

1. Click Start > Run.
2. Type regedit
3. Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

4. Navigate to the subkey:

HKEY_CLASSES_ROOT\exefile\shell\open\command

5. In the right pane, restore the value to:

"(Default)" = "%1" %*"

6. Exit the Registry Editor.

See once that key is removed you can't even go to regedit, but thanks for that link champ, as it showed me another way to correct the registry key if I wasn't able to open the regedit, you have to follow this.

The way I was doing it, I was turning off Norton, restoring the risk from quarantine, then making an exception in Norton for that registry key, it was a pain in the ass to do, but hopefully your link gave me the better quicker way. Cheers champ.