Avast says that explorer.exe contains a virus, is this true?

[thatscheesy]

For the past few weeks I have never been able to open explorer.exe on its own without avast blocking it. However, I can open up any file just by going through the start menu and not using explorer.exe. Does it actually contain a virus?

Additional info: Malwarebytes AND Avast scan show nothing.

"Infected" file: C:/windows/explorer.exe

Here is my OTL if that helps. If anyone could upload an OTL fix for me if I actually do have a problem that would be great

Do I just need to tell avast that the program is fine?

[thatscheesy]

it says my OTL is too large, sorry

[Michael (alan1998)]

Hello,

upload OTL to WIkisend (Click this). My guess is FP that should've been fixed. OTL will tell us.

[magna86]

...or you can copy the reports to pastebin site and then just copy the URL link here.

[thatscheesy]

Hello,

upload OTL to WIkisend (Click this). My guess is FP that should've been fixed. OTL will tell us.

http://wikisend.com/download/194518/OTL.Txt

here you go

[magna86]

Hi thatscheesy, we will now deploy ComboFix.


1. Please download ComboFix by sUBs from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
Note: ComboFix must be downloaded to your Desktop.

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:

• Right click on the avast! system tray icon () in the lower right corner of the screen and scroll up to avast! shield controls;
  
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.

--------------------------------------------------------------------

3.

• Click Start (or ) then Run.
  On Windows7 or Vista you may use Start Search field if Run is not available.
  
  
• In the line of text type in (Copy) the following:

Code: [Select]

%userprofile%\desktop\ComboFix /KillAll /ClearJavaCache

Note that there is a space between

• then click OK (or press Enter ).

ComboFix will run. Click on I Agree!

- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.

[thatscheesy]

here you go

[magna86]

Hi thatscheesy,

It's time for CFScript. We will now use CF's CFScript to target the malware itself.

Open notepad and copy/paste the text present inside the code box below:

Code: [Select]

KillAll::

FCopy::
c:\windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe|c:\windows\explorer.exe

Save this as CFScript.txt



Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )



---     ---     ---     ---     ---     ---


When CF finish the fixing, malware will be disinfected. I would like to preform the additional check using FRST tool just in case ...


Please download Farbar Recovery Scan Tool () by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:

• Type explorer.exe into the Search: field in FRST then click the Search File(s) button.
  
• FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
  
• Please attach it to your reply.

[thatscheesy]

here is the new ComboFix.txt
http://pastebin.com/pQMttmjR

this is the FRST search.txt
http://pastebin.com/cnhBHVwa

FRST scan
http://pastebin.com/EXP7swzn

[magna86]

Could you please attach logs in forum? Here is how:

http://www.mcshield.net/personal/magna86/Images/avast%20attach%20post.png

[thatscheesy]

Sorry, here they are embedded

Just some additional information: I had changed my start button from the default using a program. After running these few scans/cleaners, the start button has changed to the default. I can now access my explorer.exe as well, did my custom start button have anything to do with the problem? It worked fine for years, and now I can't use the program to change it again.

[magna86]

Hi,

This will target some remains ...




1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Code: [Select]

Start
C:\Program Files (x86)\Pando Networks
C:\Users\Chandler\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx
C:\Users\Chandler\AppData\Local\CRE\pmcmflmkceipgecmhoddphflfndnfbbe.crx
C:\Users\Chandler\jagex_cl_runescape_LIVE.dat
C:\Users\Chandler\jagex_runescape_preferences.dat
C:\Users\Chandler\jagex_runescape_preferences2.dat
C:\Users\Chandler\random.dat
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
CHR HKCU\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\Chandler\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [2013-04-23]
CHR HKCU\...\Chrome\Extension: [pmcmflmkceipgecmhoddphflfndnfbbe] - C:\Users\Chandler\AppData\Local\CRE\pmcmflmkceipgecmhoddphflfndnfbbe.crx [2013-04-23]
CHR HKLM-x32\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\Chandler\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [2014-01-14]
CHR HKLM-x32\...\Chrome\Extension: [pmcmflmkceipgecmhoddphflfndnfbbe] - C:\Users\Chandler\AppData\Local\CRE\pmcmflmkceipgecmhoddphflfndnfbbe.crx [2014-01-14]
REBOOT:
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.