Help - Search - Members - Calendar
Full Version: Explorer.exe Continually Turns Itself On And Off.
BleepingComputer.com > Security > Am I infected? What do I do?
   
syroco
Well for about a day now explorer.exe has turned itself on and off repeatedly.

Would love some help with this issue.. very irritating. I can't access my documents, my computer, etc. because it will refresh in about 5 seconds, over and over.


sad.gif
Budapest
Have a look in the Event Viewer for any errors at the time you experience this problem.

To open the Event Viewer go to Start > Control Panel > Administrative Tools > Event Viewer. Alternately, go to Start > Run and type in "eventvwr.msc" (without the quotes) and press Enter.

Check in all the categories.

If you find an error that occurred at the time right-click on it and select properties. Copy the information in the window and post it back here. This will help us diagnose your problem.

How To Use the Event Viewer

Also, try an online malware scan to run out an infection: Trend Micro HouseCall
PoweredByGoogle
Please follow these steps to start you out.

1. Download [AVG 8.0 FREE] and [Spybot] From download.com
2. Remove your anti-virus software
3. install AVG and Spybot
4. Update both
5. Scan with both
6. Remove anything that they find

If explorer crashes and you cant get to anything: Ctrl+Shift+esc go to file > New task (run...) and type in explorer.exe then enter and it should pop up again. I would also try scans in safemode.

I'm sure some other users can help you more but I'm more experienced in working on them myself more then telling other people how to fix the problem so there are a lot of other things I have not included because they would be to hard for me to explain. Good Luck! and post a reply if you need other peoples help

If you really cant do much when your in windows boot in safe mode and follow these steps.

Safemode
A. When you turn on the computer quickly keep tapping F8 untill you hear beeping or see a black screen with options
B. Choose Safemode with networking.
C: When a yes or no comes up say yes
D: When your into safemode start from step one above.
[You may not be able to do some things from safemode"
extremeboy
QUOTE
Please follow these steps to start you out.

1. Download [AVG 8.0 FREE] and [Spybot] From download.com
2. Remove your anti-virus software
3. install AVG and Spybot
4. Update both
5. Scan with both
6. Remove anything that they find

If explorer crashes and you cant get to anything: Ctrl+Shift+esc go to file > New task (run...) and type in explorer.exe then enter and it should pop up again. I would also try scans in safemode.


Also you might want to download AVG 7.5 instead. There are many people having trouble using AVG 8.0 including myself. Here's the link: AVG 7.5

Run some online scans:
http://www.pandasecurity.com/homeusers/solutions/activescan/
http://www.kaspersky.com/virusscanner
http://www.bitdefender.com/scan8/ie.html
http://us.mcafee.com/root/mfs/default.asp

Regards,
Extremeboy
syroco
QUOTE(Budapest @ May 12 2008, 01:39 AM) *
Have a look in the Event Viewer for any errors at the time you experience this problem.

To open the Event Viewer go to Start > Control Panel > Administrative Tools > Event Viewer. Alternately, go to Start > Run and type in "eventvwr.msc" (without the quotes) and press Enter.

Check in all the categories.

If you find an error that occurred at the time right-click on it and select properties. Copy the information in the window and post it back here. This will help us diagnose your problem.

How To Use the Event Viewer

Also, try an online malware scan to run out an infection: Trend Micro HouseCall


Have a few:

VirusScan Enterprise: The update failed; see event log.(from EXPERIENCE IP 192.168.0.2 user Drew running VirusScan Ent. 8.0.0 UPD)

The following boot-start or system-start driver(s) failed to load:
i8042prt

The McAfee Framework Service service terminated unexpectedly. It has done this 1 time(s).

DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811} ****This particular one showed 21 times in the Event Viewer****

The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:
A device attached to the system is not functioning.

The following boot-start or system-start driver(s) failed to load:
AFD
Fips
i8042prt
intelppm
IPSec
MRxSmb
NaiAvTdi1
NetBIOS
NetBT
RasAcd
Rdbss
Tcpip

The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:
A device attached to the system is not functioning.

The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:
A device attached to the system is not functioning.

The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:
A device attached to the system is not functioning.




Budapest
Try running the System File Checker (SFC).

How to Use SFC.EXE to Repair System Files

Did you try the virus scan? If so, what were the results?
syroco
Do you want the spybot and AVG results? Or just AVG?
Budapest
Both if you have them.
syroco
AVG won't work. I try to scan but it just finishes and says Error: 1
Budapest
Try the online scan I recommended earlier.
syroco
I did a Panda online scan and it detected this:
http://www.pandasecurity.com/homeusers/sec...x?idvirus=82040

The online scanner you linked, the Trend Micro HouseCall detected two Hack Tools, but it didn't let me save. I removed them though.

Spybot:


Microsoft.WindowsSecurityCenter.AntiVirusOverride: [SBI $3604910C] Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride

Microsoft.WindowsSecurityCenter.FirewallOverride: [SBI $0C94D702] Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride

Microsoft.WindowsSecurityCenter_disabled: [SBI $2E20C9A9] Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start

AdRevolver: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


AdRevolver: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


AdRevolver: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


AdRevolver: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


AdRevolver: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


AdRevolver: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


HitsLink: Tracking cookie (Opera 7+: Drew) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


Statcounter: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


Zedo: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)


AdRevolver: Tracking cookie (Firefox: default) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.5.2 (build: 20080128) ---

2008-01-28 blindman.exe (1.0.0.7)
2008-01-28 SDDelFile.exe (1.0.2.4)
2008-01-28 SDMain.exe (1.0.0.5)
2007-10-07 SDShred.exe (1.0.1.2)
2008-01-28 SDUpdate.exe (1.0.8.8)
2008-01-28 SDWinSec.exe (1.0.0.11)
2008-01-28 SpybotSD.exe (1.5.2.20)
2008-01-28 TeaTimer.exe (1.5.2.16)
2008-05-12 unins000.exe (51.49.0.0)
2008-01-28 Update.exe (1.4.0.6)
2008-01-28 advcheck.dll (1.5.4.5)
2007-04-02 aports.dll (2.1.0.0)
2007-11-17 DelZip179.dll (1.79.7.4)
2008-01-28 SDFiles.dll (1.5.1.19)
2008-01-28 SDHelper.dll (1.5.0.11)
2008-01-28 Tools.dll (2.1.3.3)
2008-04-16 Includes\Adware.sbi (*)
2008-05-07 Includes\AdwareC.sbi (*)
2008-05-07 Includes\Cookies.sbi (*)
2007-12-26 Includes\Dialer.sbi (*)
2008-05-07 Includes\DialerC.sbi (*)
2008-05-07 Includes\HeavyDuty.sbi (*)
2008-04-30 Includes\Hijackers.sbi (*)
2008-05-07 Includes\HijackersC.sbi (*)
2008-04-30 Includes\Keyloggers.sbi (*)
2008-05-07 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2008-04-22 Includes\Malware.sbi (*)
2008-05-07 Includes\MalwareC.sbi (*)
2008-03-26 Includes\PUPS.sbi (*)
2008-05-07 Includes\PUPSC.sbi (*)
2008-05-07 Includes\Revision.sbi (*)
2008-01-09 Includes\Security.sbi (*)
2008-05-07 Includes\SecurityC.sbi (*)
2008-04-16 Includes\Spybots.sbi (*)
2008-05-07 Includes\SpybotsC.sbi (*)
2008-04-16 Includes\Spyware.sbi (*)
2008-05-07 Includes\SpywareC.sbi (*)
2007-11-06 Includes\Tracks.uti
2008-04-30 Includes\Trojans.sbi (*)
2008-05-07 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

Budapest
Is your computer running better now after the scans or do you still have the same problems?
syroco
QUOTE(Budapest @ May 12 2008, 08:15 PM) *
Is your computer running better now after the scans or do you still have the same problems?


Same problem still. :/
Budapest
Try running SmitFraudFix as described here.
extremeboy
Still the same promblem eh... that's strange...
Why couldn't you scan with AVG 7.5?

Extremeboy
syroco
QUOTE(extremeboy @ May 12 2008, 08:30 PM) *
Still the same promblem eh... that's strange...
Why couldn't you scan with AVG 7.5?

Extremeboy

I would do a scan and it would end instantly with only one result:

Error: 1
extremeboy
Hi,
Incase this becomes a malware promblem Please post it in the "Am I infected" forum.

Extremeboy
extremeboy
For AVG!?
Can you show me a picture of how it looks when you get the error when scanning with AVG
Thanks

Regards,
Extremeboy
syroco
QUOTE(Budapest @ May 12 2008, 08:27 PM) *
Try running SmitFraudFix as described here.



Did it, still have the problem.

Here extremeboy:

http://i14.photobucket.com/albums/a310/Syroco/untitledds.jpg
Budapest
Did you run SFC as I recommended in post #6?
extremeboy
Hi, This promblem may be caused by a malware try posting in the Am I infected forum and people there will tell you what to do and hoe to approach this.
I did some research on your topic and I found a link that might help you: http://answers.yahoo.com/question/index?qi...31234737AAdm6U7
Read it and see if it helps you.

Regards,
Extremeboy
syroco
QUOTE(Budapest @ May 12 2008, 08:52 PM) *
Did you run SFC as I recommended in post #6?


yep, I tried
extremeboy
Hi, I see the error...
I'll get back to you as soon as possible tommorrow. I will try a few things and get back to you.
Also for your next reply can you show me what the error message is for? So can you show me what was behind that error message that you showed me. The title was AVG test centre.
What budapest said "Did you run SFC as I recommended in post #6?"
Do it and tell us what happens.

Regards,
Extremeboy
syroco
QUOTE(extremeboy @ May 12 2008, 09:00 PM) *
Hi, I see the error...
I'll get back to you as soon as possible tommorrow. I will try a few things and get back to you.
Also for your next reply can you show me what the error message is for? So can you show me what was behind that error message that you showed me. The title was AVG test centre.
What budapest said "Did you run SFC as I recommended in post #6?"
Do it and tell us what happens.

Regards,
Extremeboy


The error says it can't open my C:\ drive
usasma
I'm moving this to the Am I Infected forum as suggested by extremeboy...
Tolan
the explorer going on and off is a symptom of Vundo

Tryhttp://www.superantispyware.com/


SAV sound it for me and said it got rid of it but it would re-appear within a few minutes
ruby1
QUOTE
Please follow these steps to start you out.

1. Download [AVG 8.0 FREE] and [Spybot] From download.com
2. Remove your anti-virus software
3. install AVG and Spybot
4. Update both
5. Scan with both
6. Remove anything that they find


one notes you have been asked to do this . BUT

QUOTE
The McAfee Framework Service service terminated unexpectedly


IS this macaffee antivirus program installed?


QUOTE
I'm moving this to the Am I Infected forum
from which section ( ?os )

suggest be VERY cautious WITH avg 8.0 version and go for the 7.5 version pro temp assuming you have NO other antivirus program on board

can you please list the protection programs you DO have on board in case you now have clashes?
syroco
QUOTE(ruby1 @ May 13 2008, 03:15 PM) *
QUOTE
Please follow these steps to start you out.

1. Download [AVG 8.0 FREE] and [Spybot] From download.com
2. Remove your anti-virus software
3. install AVG and Spybot
4. Update both
5. Scan with both
6. Remove anything that they find


one notes you have been asked to do this . BUT

QUOTE
The McAfee Framework Service service terminated unexpectedly


IS this macaffee antivirus program installed?


QUOTE
I'm moving this to the Am I Infected forum
from which section ( ?os )

suggest be VERY cautious WITH avg 8.0 version and go for the 7.5 version pro temp assuming you have NO other antivirus program on board

can you please list the protection programs you DO have on board in case you now have clashes?



I have no other anti spywares installed. I uninstalled McAfee.
Budapest
You're probably sick of scanning your machine by now, but here's another scan you can try:

Malwarebytes Anti-Malware

Download the free version.
syroco
QUOTE(Budapest @ May 13 2008, 05:05 PM) *
You're probably sick of scanning your machine by now, but here's another scan you can try:

Malwarebytes Anti-Malware

Download the free version.


Malwarebytes' Anti-Malware 1.12
Database version: 745

Scan type: Full Scan (C:\|)
Objects scanned: 49613
Time elapsed: 7 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Budapest
Maybe you want to try the suggestions here.
syroco
Yeah, I'm Drew who responded to that blog yesterday.

I did what he said, and I even went into safe mode, was only able to delete one of the drivers, with the other 2 still remaining (windows couldn't find them, odd?)
syroco
Also, Windows keeps telling me I need to insert my Windows XP SP2 disc. (just recently started to do this.)

It's saying it has to replace several infected or bad files.


Problem is, I don't have my Windows XP SP2 disc. I have no idea where it is, looked all over. I think I lost it. (Yeah, I know.)


Is there anything I can do?
boopme
Take a look here
How to obtain Windows XP Setup boot disks

What version of IE is it?
Look at this for help in repairing IE 6 & 7,plus SP2
How to reinstall or repair Internet Explorer in Windows XP
syroco
QUOTE(boopme @ May 13 2008, 08:42 PM) *
Take a look here
How to obtain Windows XP Setup boot disks

What version of IE is it?
Look at this for help in repairing IE 6 & 7,plus SP2
How to reinstall or repair Internet Explorer in Windows XP


It's not IE. It's Explorer.exe (taskbar, desktop, my computer/my documents= explorer)

Anyways guys, thank you for the help, but.. I have switched to Linux. Currently running Ubuntu/Beryl and loving it. Already have everything I need (<3 WINE), and just well situated.


XP and just Windows in general has given me so many problems I'm fed up with up, for now:)
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.