I was handed a friend's laptop that was experiencing very strange virus-like symptoms. He could log in, but there'd be warnings about un-associated .lnk shortcuts, and the icons showed as generic windows icons. Then nothing would run: trying to start any program would result in a window asking the user to choose a program to associate .exe with. Looked like a virus to me.

I rebooted into Safe Mode, logged in as administrator, chose a Restore point prior to this problem appearing. Then rebooted, logged in as adminstrator, and everything was fine. Updated Windows to the new SP3 service pack. Then, when he logged into his account, no warnings and the icons were fine, but then Ad-Aware popped-up and warned about a bunch (50 or so) registry association changes. After that -- same symptoms as before.

So, after a little Internet search, I repeated the Restore exercise, loaded his registry hive (ntusers) into regedt32, and removed the software\microsoft\windows\currentversion\Run entry for Ad-Aware. Then unloaded the hive, logged out, and he logged into his account. Voila... worked fine. So I uninstalled Ad-Aware 2007 and Ad-Aware SE Professional. (For some reason both were installed.) Now he's in great shape.

Has anyone run into this before? I know I took a brute-force approach to Ad-Aware: but I haven't worked with it before and he didn't know why he needed it. But it leaves me thinking I should tell all my clients and friends to avoid Ad-Aware.

Was it just that he had outdated definitions, or that he had set up Ad-Aware to have too much control?

Thanks... Ken.

It's likely due to the settings of the Ad-Watch feature of the SE Pro: http://securitygarden.blogspot.com/2006/12...nk-and-exe.html

Thanks. Wish I'd found that post at the start of my search.

It's unbelievable to me that a Windows program (aside from a malicious virus) would ever purposely remove the .exe association... What were they thinking? I sincerely hope that the default Ad-Watch setting is NOT "Automatic", and that a BIG warning pops up if someone decides to turn the option on. And I hope there's a high priority bug-fix underway. Cripes.

Again, many thanks for pointing out that SecurityGarden blog. Pretty complicated fix for the average Lavasoft user, I'd bet.

Happy to help mate.

BTW, this problem began in August 2004 when SE was released.