Author Topic: explorer.exe virus  (Read 4496 times)

0 Members and 1 Guest are viewing this topic.

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
explorer.exe virus
« on: October 11, 2012, 08:12:18 PM »
that pesky explorer.exe virus is in one of my computers
everytime i open any internet explorer it freezes and jumps in that .exe as well
ive tried almost every malware/anti virus under the sun
help?  >:(

Offline Pondus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 26518
Re: explorer.exe virus
« Reply #1 on: October 11, 2012, 08:53:15 PM »
follow this guide and attach the logs.....not copy and paste   http://forum.avast.com/index.php?topic=53253.0   

AdwCleaner
Malwarebytes
OTL
aswMBR
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #2 on: October 11, 2012, 09:56:23 PM »
heres the logs
wouldnt let me open aswMBR
thanks!!

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36353
  • Dragons by Sasha
    • Malware fixes
Re: explorer.exe virus
« Reply #3 on: October 11, 2012, 10:03:40 PM »
I see that you have RogueKiller, have you run it yet ?  If so could you attach the logs

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:OTL
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-3033274647-1249332082-2962351127-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-3033274647-1249332082-2962351127-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
[2012/07/17 13:05:37 | 000,000,096 | -H-- | C] () -- C:\ProgramData\-QcjHoexnfYroavr
[2012/07/17 13:05:37 | 000,000,096 | -H-- | C] () -- C:\ProgramData\-QcjHoexnfYroav
[2012/07/17 13:05:26 | 000,000,368 | -H-- | C] () -- C:\ProgramData\QcjHoexnfYroav

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #4 on: October 11, 2012, 10:27:48 PM »
i have yet to run rouge killer, should i do so now?
heres the log for the quick scan
thanks again!!

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36353
  • Dragons by Sasha
    • Malware fixes
Re: explorer.exe virus
« Reply #5 on: October 11, 2012, 11:39:37 PM »
Yes please run RogueKiller as per the instructions in the logs thread

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #6 on: October 11, 2012, 11:52:57 PM »
here ya go, how bad is it?
thanks!

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36353
  • Dragons by Sasha
    • Malware fixes
Re: explorer.exe virus
« Reply #7 on: October 12, 2012, 11:38:29 AM »
OK you have a bad partition that needs removing

Download Tuxbot to your desktop 
Run Tuxboot 
On the first screen in the dropdown box select Gparted Live  - stable   
 
Select USB Drive from the Type drop-down. 
Select the correct USB device from the Drive drop-down. 
Click OK. This will start the process of creating the bootable USB device. 
 
Now boot off of the newly created Gparted USB.   
   
You should be here... Press ENTER   
 
 
 
By default, "do not touch keymap" is highlighted.   
 
 
 
 Leave this setting alone and just press ENTER. 
 
 
 
Choose your language and press ENTER. English is default [33]   
 
At the mode prompt enter 0,  press ENTER   
 
You will now be taken to the main GUI screen below 
 
 
 
According to your logs, the partition that you want to delete is 10 MB 
 
Right click this partition and select delete .   
 
 
 
The Partition has gone   
 
Now select Apply   
 
Now you should be here:   
 
 
 
Select Apply after double checking that the right partition was deleted 
   
 
Is "boot" next to your system drive (100MB)?   
If "boot" is not next to your system drive (100MB) under "Flags", right-mouse click the OS drive while in Gparted and select Manage Flags   
 
 
In the menu that pops up, place a checkmark in boot like the picture below, then close :   
 
   
 
 
Under File select Quit 
 
 
You will see this small Popup   
 
 
 
 
Choose reboot and then press OK. 
 
Reboot to normal windows, if windows gives an error then select startup repair

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #8 on: October 12, 2012, 11:48:52 PM »
so i did everything as you said and the start up repair wasnt able to automatically fix it. it just loops at start up then back to the repair

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36353
  • Dragons by Sasha
    • Malware fixes
Re: explorer.exe virus
« Reply #9 on: October 13, 2012, 01:12:59 PM »
Could you confirm that you set the Active(Boot) partition to the 100MB system partition

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 18866176 | Size: 100 Mo

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #10 on: October 13, 2012, 10:07:14 PM »
yep
the screen looks like this

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36353
  • Dragons by Sasha
    • Malware fixes
Re: explorer.exe virus
« Reply #11 on: October 13, 2012, 10:28:04 PM »
OK that is weird.. Using Gparted set the boot to the main system drive 456Gb

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #12 on: October 14, 2012, 12:41:37 AM »
done
now its saying "BOOTMGR is missing press crt+alt+del to restart"
and thats it

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36353
  • Dragons by Sasha
    • Malware fixes
Re: explorer.exe virus
« Reply #13 on: October 14, 2012, 01:48:32 PM »
Download the following three programmes to your desktop :

 
1.  WiNTBootIc
2.  Windows 7 64bit RC
3.  Farbar Recovery Scan Tool x64

Extract wintoboot to your desktop
Insert a USB drive of at least 1GB
Run Wintoboot



Drag and drop the Windows 7 ISO to the programme in the space indicated
Tick the Format box and accept the warnings
Press Do It

You will see it progressing



It will let you know when it is done
Then copy FRST to the same USB




Insert the USB into the sick computer and start the computer.  First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here

 
When you reboot you will  see this although yours will say windows 7. Click repair my computer

 
Select your operating system

 
Select Command prompt

 
At the command prompt type the following  :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Offline wengweng805

  • Newbie
  • *
  • Posts: 13
Re: explorer.exe virus
« Reply #14 on: October 14, 2012, 06:22:05 PM »
heres the log
thanks!