To repair an EXE file association with the ftype command

A friend of the computer virus, I went to see, is a QQ virus, because very long time did not go online to collect virus information, I do not know the characteristics of these viruses. I opened the process manager first, I shut down a few unfamiliar programs, but just turned off one, and then closed the other, and the one that was just closed ran again immediately. No way, I decided to remove the startup item from the registration list, restart the test, as a result, I just removed those startup items, and then refresh the registry, those startup items have been restored, it seems that the general method is not workable, online download kill tool, still can not kill. I know this is because the virus is running, so it cannot be deleted.

Since this computer has only one operating system, there is no way to remove the virus under another system, then how to do? If this is the case, I recommend a method to you.

The first step: enter cmd in start → Run and open the Command Prompt window.

Step Two: Enter ftype exefile=notepad.exe% 1, which means that all EXE files are opened with Notepad. So that the original virus can not be started.

Step Three: Restart your computer, and you'll see a lot of "notepad" open. Of course, this not only has virus files, there are some original system files, such as: Input Method program.

Step Fourth: Right click on any file, select "Open by", then click "Browse", go to Windows\System32, select Cmd.exe, so you can open the Command Prompt window again.

Step Fifth: Run the ftype exefile= "%1"%* to associate all EXE files with the restore. Now run antivirus software or directly back to the registry, you can kill the virus.

Sixth step: In each "Notepad", click on the menu "file → Save as", you can see the path and file name. Find the virus file, manually delete it, but be careful, you must be sure it is a virus to remove. It is recommended that these files be renamed and noted, after restarting, if there is no virus mischief, there is no system problems, and then delete.

Finally, introduce the usage of ftype

In Windows, the Ftype command is used to display and modify open programs that are associated with different file name extensions. Equivalent to modifying some of the contents of the "HKEY_CLASSES_ROOT" item in Registry Editor.

The basic use format for Ftype is: Ftype [File Type [=[open Method/Procedure]]]

For example, the ftype exefile=notepad.exe% 1 In the example above indicates that all files of the file type EXE (exefile as an EXE type file) are opened through the Notepad program, and the following%1 represents the program itself (the one that was double-clicked).

Ftype exefile= "%1"%* means that all EXE files are run directly (EXE can be run directly, so use%1 to represent the program itself), followed by the%* to represent all the parameters after the program command (which is why EXE files can run with parameters).