Author Topic: Explorer.exe Infected  (Read 23858 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #30 on: November 27, 2010, 11:46:20 PM »
Yes it is a false positive that I have reported - disable webshield long enough to download it

Acorogia

  • Guest
Re: Explorer.exe Infected
« Reply #31 on: November 28, 2010, 01:08:54 AM »
Doesnt look like combofix found anything new, but I attached the log just in case.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #32 on: November 28, 2010, 01:29:32 PM »
I will use combofix now to replace your current explorer with a backed up copy from the cache to see if that alleviates the problem

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Quote
KillAll::

Fcopy::
C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe|C:\Windows\explorer.exe


3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below.  This will start ComboFix again.




6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new OTListit log.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89117
  • No support PMs thanks
Re: Explorer.exe Infected
« Reply #33 on: November 28, 2010, 04:13:29 PM »
Yes it is a false positive that I have reported - disable webshield long enough to download it

That FP has been corrected, in VPS update 101118-0.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Acorogia

  • Guest
Re: Explorer.exe Infected
« Reply #34 on: November 29, 2010, 02:46:32 AM »
Logs attached. As of now, now no popups, but CPU and RAM usage still seem high.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #35 on: November 29, 2010, 09:44:22 PM »
Vista utilises as much RAM as possible to save disc swapping - what programme is using the greatest amount of CPU

Acorogia

  • Guest
Re: Explorer.exe Infected
« Reply #36 on: November 30, 2010, 06:14:39 AM »
Unfortunately, the popups remain, I was optimistic at first too...

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #37 on: November 30, 2010, 09:23:57 PM »
OK here is my little spiel for Memtest

The Windows Memory Diagnostics Tool is an easy to create, easy to use application available from Microsoft that is a valuable tool in troubleshooting suspected RAM problems.  Download the tool and save the file to your desktop.  Double click on the downloaded file to open the disk creation application.

When the downloaded file is opened, the creation software will start and you will be presented with a license agreement...accept that and you will see the options to create a bootable floppy diskette or to copy the CD image to a location on your computer as shown below. 



When the "Create Startup Disk..." button is clicked, you will be prompted to select the floppy drive to use to create the disk.  In the majority of cases, there will be only one choice and it will be selected by default as shown in the example below. Insert a diskette into the floppy drive and click on the "Create" button.



When the "Save CD Image to Disk..." button is clicked, you will be prompted to save the CD image to a location on your computer.  Save it to a location you will remember such as your My Documents folder or the desktop.  In the example below, I've created a folder on the desktop named windiag to save the file to.



Once the image has been saved to a location on your computer, you can use your burning software to burn the image to a cd.  If your software doesn't support burning ISO Images or you do not have burning software installed, you can use a tool like ISO Recorder which will add a "Copy Image to CD" option to the right click context menu.  You can simply right click on the saved image and choose that option...the burning tool will open.

Use the disk you create to boot the computer.  The diagnostics will run automatically and will continue to do so until it is terminated.  It should be left to run for a minimum of four complete passes.  If you have the time, an hour or two is better.

If the RAM module(s) is good, each test in each pass will display a green "Succeeded" message in the Pass field as shown in the image below.



If the RAM module(s) is bad, one or more passes will display a red "Failed" message in the Pass field as shown in the image below.



Any failure in any test may indicate a bad module.  If there is more than one module installed on the machine when a failure is indicated,  remove all but one module and begin the test again, testing each module by itself until the failing module is found.

To terminate the diagnostics, remove the disk and press the X key or power the machine off.

Other things to try when faced with suspected memory problems:
  • Set the BIOS Fail Safe Defaults in Setup.
  • Reset the CMOS. (Advanced)
  • Adjust RAM voltage/timing. (Advanced)
Some platforms provide for changes to the RAM settings, some offer limited adjustment, and some will not have the option to change the RAM settings.  Making changes to RAM settings in the BIOS is best left to advanced users.

Acorogia

  • Guest
Re: Explorer.exe Infected
« Reply #38 on: December 02, 2010, 05:24:44 AM »
Sorry for the delay, there was no memory problems, I ran 2 regular passes and 1 advanced pass.  Why do you think there is a problem with my memory?

YoKenny

  • Guest
Re: Explorer.exe Infected
« Reply #39 on: December 02, 2010, 12:52:13 PM »
I see that you now have 20 posts which will permit you to update your profile to include signature information.

Go to PROFILE then Modify Profile then Forum Profile Information then Please select your country: then Signature: and put information about your system just like my signature and DavidR avast! a Technical advisor so that the helpers can offer pertinent advice.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #40 on: December 02, 2010, 07:36:06 PM »
Aye as I can see no apparent malware that would cause explorer to behave like that.  I will have a quick rummage around to see if I can find any other possible causes
 

Acorogia

  • Guest
Re: Explorer.exe Infected
« Reply #41 on: December 02, 2010, 08:10:50 PM »
Thank ya sir.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #42 on: December 02, 2010, 08:25:42 PM »
Are you running any specific programme when explorer crashes ?

Acorogia

  • Guest
Re: Explorer.exe Infected
« Reply #43 on: December 03, 2010, 08:59:38 AM »
Nothing I can think of, sometimes Ill turn on my computer log on and walk away and come back with 10+ ie windows open and Avast notifications.  So unless its something running in the background, there is no smoking gun.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Explorer.exe Infected
« Reply #44 on: December 03, 2010, 09:26:18 PM »
Sorry I thought it was an explorer problem and not internet explorer

Do you use a router ?

Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).