rkill and malwarebytes are always great tools to use and 90% of the time that is also what I use to help eliminate malware infections on a system. However, if this is indeed the virus that hides .exe defaults then these tools will have no use at all. In fact, they won't run even in safe mode most of the time.
I've seen this virus on numerous computers very recently, it seems to be a virus that's been around for a few years now but is just now really becoming rampant. The virus works much the way as your average fake alert smitfraud/virtumonde that advertises "You are infected" blah blah and wants you to buy their protection to remove all these (fake) viruses.
Now, a lot if times protected computers with current antivirus don't even see this message because their anti-virus actually catches it early and can remove it just fine, but that's the problem. When the virus becomes active (or sometimes I've seen it when it is removed by an anti-virus application) then it changes the Default Settings and Programs configuration in the registry so that no .exe file type can operate because effectively the critical Windows file RUN32DLL.EXE has been "lost" to the system through this change in the Default Settings and Programs configuration change.
If you are trying to open programs, including your antivirus program, and are getting an error that RUN32DLL.EXE cannot be found, this is most likely what has happened. Your anti-virus software will not be able to fix it, but fixing the issue is relatively easy it just requires a simple download script which repairs the modified registry lines to return the Default Settings and Programs configuration to normal.
