Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

explorer.exe missing


  • Please log in to reply
4 replies to this topic

#1 budgie wardle

budgie wardle

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 30 April 2005 - 01:52 PM

Hi, I was wondering if anyone could help with this little situation I've got myself into!
A pc running XP Home which I've been working on has a StartPage trojan infection which is cleaned by Norton antivirus upon scanning but replicates itself on reboot.
Earlier today I scanned the pc with the eTrust antivirus web scanner which detected the following infected files;

Eb(1).txt
Dc2.exe
bhoass.dll
BHOASSUI.exe
explorer32.dbg
iexplorer_dbg.exe
stlbd.dll
MSIMN32.exe
TASKMGRU.exe

None of these files could be cured and in my overzealousness I chose to delete them.
The following files could not be deleted;

bhoass.dll
MSIMN32.exe
TASKMGRU.exe

Now when I boot the pc and login, the explorer.exe process does not run and can't be found when I try to start it manually, resulting in a pretty desktop wallpaper but no icons, start button or system tray.

When I look in the windows folder using the cmd prompt, explorer.exe appears to still be there.

Do I have any choice other than a windows reinstall?

Thanks in advance for any help/suggestions

BC AdBot (Login to Remove)

 


#2 windowsxp550

windowsxp550

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Location:Maplewood, Minnesota
  • Local time:12:43 AM

Posted 30 April 2005 - 02:53 PM

Do a sfc /scannow

Click start then run and type: sfc /scannow

That will start the windows system file checker which will go through your system files and repair/replace system files that are missing or corrupt.

you will need your windows disk to do this...
Free PC Help: At FixMyXP.com, our Speciality is Windows XP.
Got An XP Problem or Question? Get expert help, all free Check it out!
Click Here to go to FixMyXP's Windows XP Help Forum

#3 budgie wardle

budgie wardle
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 30 April 2005 - 03:42 PM

Hi windowsxp550 and thanks for your reply.

I tried a SFC/scannow earlier in the day but to no avail, it doesn't detect any problems.

#4 xposemncz

xposemncz

  • Members
  • 24 posts
  • OFFLINE
  •  
  • Location:Earth
  • Local time:12:43 AM

Posted 18 May 2005 - 12:44 PM

Hello budgie,

Please follow the instructions below to clean this infection.

1) From Task Manager click on File-> New Task(Run) and in the Run box type
C:\Windows\System32\restore\rstrui.exe
This will open system restore on your computer using which restore your computer to yesterday (or any available previous date).

2) Now start your computer in safe mode by tapping F8 key while rebooting.

3) Open Task Manager and Stop the Processes MSIMN32.EXE, TASKMGRU.exe by Right Cliking them and clicking End Process Tree.

4) In Safe Mode open Notepad and Copy Paste the following code as it is and save it as "change.reg" on your computer desktop, change the file type to All files while saving this file.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe]

5) Now do a file search for the following files and delete them:
C:\WINDOWS\iexplore_dbg.exe
C:\WINDOWS\bhoass.dll
C:\WINDOWS\BHOASSUI.exe
C:\WINDOWS\explorer32dbg.exe
C:\WINDOWS\system32\MSIMN32.EXE
C:\WINDOWS\system32\TASKMGRU.EXE


6) Now Double Click on the change.reg file and merge it into registry.

Restart your computer and this will fix the issue.

If you need further assistance please use our HijackThis Logs and Analysis forum and post the Hijack this Log so that Our HJT Team can help you.

Regards,
XposeMncz. :thumbsup:
XposeMncz.com

#5 budgie wardle

budgie wardle
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:05:43 AM

Posted 20 May 2005 - 05:03 AM

Thanks for the advice. I did pretty much get to the same end result once I had worked out it was those darn iexplorer_dbg and explorer32dbg files which were causing the problem.
A really good piece of advice for anyone reading this post who may be suffering the woes of malware;

If you're not 100% sure what you're doing, post a HijackThis log and let the experts have a look, it may save you a lot of time and heartache!

Edited by budgie wardle, 20 May 2005 - 05:04 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users