Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

TR/Patched.Gen virus and loss of Windows Explorer on Windows XP Pro SP3


  • Please log in to reply
1 reply to this topic

#1 maryba

maryba

  • Members
  • 120 posts
  • OFFLINE
  •  
  • Local time:07:55 AM

Posted 25 June 2012 - 07:15 PM

Summary
Two problems:
1) After an Avira detection of TR/Patched.Gen and reporting that Explorer.exe and winlogon.exe were infected and quarantined (by me),
2) Windows Explorer no longer functions.

Sequence of events
Within a minute of opening a website, Avira (free edition) did a popup alert to say "TR/Patched.Gen" detected. I took the "Deny" option and within seconds, another popup occurred, this time saying 2 detects of the same item. Did a Deny again and again another popup saying the same thing except 4 detects. Repeated several more times with varying counts of the same item. I did the deny option every time. In meantime, Avira's system scan had started and eventually stopped with a summary showing Explorer.exe and winlogon.exe as being "infected" (my terminology). I took the option to quarantine them.

Before the Avira system scan had ended, I had started a Malwarebytes QuickScan. But since it was going so slowly and because it dawned on me that I shouldn't be running both Avira's and MB's scans at the same time, I cancelled MB. And I then did as described above with the Avira scan.

Avira recommended a restart so I took that option. When Windows restarted, it wouldn't display the Task Bar or Start button. No keyboard or mouse function seemed available so couldn't start Windows Explorer. When I restarted in Safe Mode, I got past the login screen but still could not start Explorer. I couldn't find explorer.exe in the Windows folder (had restarted in Safe Mode with DOS prompt) so pasted a copy from another computer's XP Pro installation. On restart, the TaskBar and a session of Explorer showed up and both were usable. I ran a MB scan and found no detections.

On next OS restart, after Desktop showed, I only got a "Windows Explorer has encountered a problem and needs to close..." popup. Same results after several retries. I finally tried TaskManager and found that I can start and run a wide variety of programs with no problems, so far. Also have full network and internet function. Can do any file management functions but only in DOS (cmd/CLI). But, at least, no further Avira detections.

Any help would be appreciated.


Mike

Edit: Moved topic from XP to the more appropriate forum. ~ Animal

BC AdBot (Login to Remove)

 


#2 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:08:55 AM

Posted 25 June 2012 - 10:02 PM

Read the guide here on preparing logs

http://www.bleepingcomputer.com/forums/topic34773.html

and create a topic here

http://www.bleepingcomputer.com/forums/forum22.html

Good luck




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users