explorer.exe virus

Viruses and worms
1

that pesky explorer.exe virus is in one of my computers
everytime i open any internet explorer it freezes and jumps in that .exe as well
ive tried almost every malware/anti virus under the sun
help? >:(

2

follow this guide and attach the logs…not copy and paste http://forum.avast.com/index.php?topic=53253.0

AdwCleaner
Malwarebytes
OTL
aswMBR

3

heres the logs
wouldnt let me open aswMBR
thanks!!

4

I see that you have RogueKiller, have you run it yet ? If so could you attach the logs

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:OTL
O2 - BHO: (no name) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-3033274647-1249332082-2962351127-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-3033274647-1249332082-2962351127-1000\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
[2012/07/17 13:05:37 | 000,000,096 | -H-- | C] () -- C:\ProgramData\-QcjHoexnfYroavr
[2012/07/17 13:05:37 | 000,000,096 | -H-- | C] () -- C:\ProgramData\-QcjHoexnfYroav
[2012/07/17 13:05:26 | 000,000,368 | -H-- | C] () -- C:\ProgramData\QcjHoexnfYroav

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

5

i have yet to run rouge killer, should i do so now?
heres the log for the quick scan
thanks again!!

6

Yes please run RogueKiller as per the instructions in the logs thread

7

here ya go, how bad is it?
thanks!

8

OK you have a bad partition that needs removing

Download Tuxbot to your desktop
Run Tuxboot
On the first screen in the dropdown box select Gparted Live - stable

https://dl.dropbox.com/u/73555776/Tuxboot.GIF

Select USB Drive from the Type drop-down.
Select the correct USB device from the Drive drop-down.
Click OK. This will start the process of creating the bootable USB device.

Now boot off of the newly created Gparted USB.

You should be here… Press ENTER

https://dl.dropbox.com/u/73555776/Gpart-Start.GIF

By default, “do not touch keymap” is highlighted.

https://dl.dropbox.com/u/73555776/Gpart-keyselect.GIF

Leave this setting alone and just press ENTER.

https://dl.dropbox.com/u/73555776/Gpart-continue.GIF

Choose your language and press ENTER. English is default [33]

At the mode prompt enter 0, press ENTER

You will now be taken to the main GUI screen below

https://dl.dropbox.com/u/73555776/Gpart-partitions.GIF

According to your logs, the partition that you want to delete is 10 MB

Right click this partition and select delete .

https://dl.dropbox.com/u/73555776/GPart-delete.GIF

The Partition has gone

Now select Apply

Now you should be here:

https://dl.dropbox.com/u/73555776/Areyousure.GIF

Select Apply after double checking that the right partition was deleted

Is “boot” next to your system drive (100MB)?
If “boot” is not next to your system drive (100MB) under “Flags”, right-mouse click the OS drive while in Gparted and select Manage Flags

https://dl.dropbox.com/u/73555776/GPart-flags.GIF

In the menu that pops up, place a checkmark in boot like the picture below, then close :

https://dl.dropbox.com/u/73555776/GPart-bootflag.GIF

Under File select Quit

https://dl.dropbox.com/u/73555776/Gpart-quit.GIF

You will see this small Popup

https://dl.dropbox.com/u/73555776/Gpart-reboot.GIF

Choose reboot and then press OK.

Reboot to normal windows, if windows gives an error then select startup repair

9

so i did everything as you said and the start up repair wasnt able to automatically fix it. it just loops at start up then back to the repair

10

Could you confirm that you set the Active(Boot) partition to the 100MB system partition

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 18866176 | Size: 100 Mo

11

yep
the screen looks like this

http://i45.tinypic.com/2rzpi12.jpg

12

OK that is weird… Using Gparted set the boot to the main system drive 456Gb

13

done
now its saying “BOOTMGR is missing press crt+alt+del to restart”
and thats it

14

Download the following three programmes to your desktop :

  1. WiNTBootIc
  2. Windows 7 64bit RC
  3. Farbar Recovery Scan Tool x64

Extract wintoboot to your desktop
Insert a USB drive of at least 1GB
Run Wintoboot

http://dl.dropbox.com/u/73555776/wintoboot.JPG

Drag and drop the Windows 7 ISO to the programme in the space indicated
Tick the Format box and accept the warnings
Press Do It

You will see it progressing

http://dl.dropbox.com/u/73555776/usb%20progress.JPG

It will let you know when it is done
Then copy FRST to the same USB

http://dl.dropbox.com/u/73555776/frstwintoboot.JPG

Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here

When you reboot you will see this although yours will say windows 7. Click repair my computer

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7275.jpg

Select your operating system

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277202.jpg

Select Command prompt

http://i1224.photobucket.com/albums/ee362/Essexboy3/RepairVista_7277.jpg

At the command prompt type the following :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select “Computer” and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

https://dl.dropbox.com/u/73555776/FRST%20Start%20scan.gif

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

15

heres the log
thanks!

16
ATTENTION: Malware custom entry on BCD on drive d: detected. Check for MBR/Partition infection.
Ok looks like the blighter changed the BCD as well as the additional partition

Reboot to the recovery console and select command prompt
Type the following pressing enter after each :

bootrec /FixMbr
bootrec /FixBoot

17

after doing that and restarting without the usb it gives the BOOTMGR is missing error

18

Could you try a further startup repair from the recovery console

19

i believe that did the trick! thank you so much!

20

When you did the first startup repair did you do it from windows or the recovery console ?

Could you attach a fresh OTL log please to ensure that it has all gone