from yesterday I have a lot of notifications/popup from Avast which tell that Avast has blocked explorer.exe to a strange random URL (added attachment). Worse than this Windows Explorer doesn’t work well and blocks from time to time so I’m not able to work properly with my machine. When I kill Explorer.exe same popups come from dllhost.exe. Tried to do a scan with Avast and it found some PUP that I have eliminated but this hasn’t solved the issue.
I am very worried that this can be malware, so any help from you would be very appreciated.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.
thank you very much for your time. About gadgets don’t know really, my machine has Windows Xp Professional Sp3 ITALIAN, maybe I can look for some more information about it.
Yes because I have the problem that Windows Explorer hangs and blocks and tried to install another file manager tool (ExplorerXP, xplorer2 Lite) to move and delete files. Installation was successful but the tools are very slow and sometimes hang too. To perform operations on file system I have to use cmd.exe.
If I kill Explorer.exe using taskmgr.exe the Avast popups come from dllhost.exe. To kill dllhost.exe I have to use Process Explorer and in this case Avast popups stop.
[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
Here is the log, was really fast, there is an unsigned and suspect service “XRNADB” but should be from Xerox for printing and I have effectively a Xerox Workcentre printer. So I chose to skip removal of this particular service.
About Poweliks, yesterday afternoon (when the machine showed signs of malfunction) I ran FixPoweliks32.exe but result has been negative as you may see from log attached.
Did you reboot the system ? As this is my prime candidate
"C:\Documents and Settings\All Users\Dati applicazioni\{8C52DBFA-C81C-41D9-9B03-9572DBCFBF4D}" folder move:
Could not move "C:\Documents and Settings\All Users\Dati applicazioni\{8C52DBFA-C81C-41D9-9B03-9572DBCFBF4D}" => Scheduled to move on reboot.
Sure essexboy, until now it is doing well, and I was trying to understand the mechanics of this nasty piece of software.
I saw that in FRST.txt {8C52DBFA-C81C-41D9-9B03-9572DBCFBF4D} was created yesterday exactly when the machine experienced the first signs of malfunction. So this fits in the accident dynamic.
It would be interesting to have a look to what was in the directory. Was it destroyed?
It’s a copy of msvcp60.dll, very different from the correct system file. I was wondering what was trying to do this software on the internet downloading or uploading information.