Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Total Newbie To Bleeping Computer Needs Help Please


  • Please log in to reply
11 replies to this topic

#1 Morgane

Morgane

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:49 PM

Posted 14 March 2006 - 10:56 AM

Hiya All :thumbsup: ,

I have been having this problem for a couple of weeks now. Everytime I shutdown my PC I get a pop-up saying explorer.exe is not responding and will shut down with a progress bar. This takes about a minute and then I get a pop-up window saying that it's not responding with the option of pressing End Now. This then shuts down the PC.

Is this a serious problem? A virus?

Could somebody please tell me how to solve this?

Many thanks in advance!

Best regards,

Morgane

PS. I have McAffee Firewall with Antivirus and AdAware and Spybot which I use regularly. I had a Virus (trojan, I think) called oleupdate (maskerading as Windowsupdate) a month ago, but got rid of it by deleting it in safe mode (following the instructions from this site).

BC AdBot (Login to Remove)

 


#2 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:03:49 PM

Posted 14 March 2006 - 12:13 PM

Are you experiencing any other buggy behaviour from this computer?

Is it running slower than before?

Update Spybot and run it in safemode and see if it finds anything. Report back.
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#3 Morgane

Morgane
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:49 PM

Posted 14 March 2006 - 02:04 PM

Hi Albert,

Many thanks for your quick reply!

Yes the PC is running slower than before.

I ran Spybot in Safemode and it only (?) found 3 entries of DSO Exploit. This comes up every scan no matter how often Spybot fixes it, interestingly though it only found 3 entries instead of the usual 5.

I also ran AdAware in Safemode and it only (?) found 11 tracking cookies.

Do you know anything else I could try?

Many thanks in advance!

Best regards,

Morgane

#4 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:03:49 PM

Posted 14 March 2006 - 02:07 PM

I think your computer is showing signs of being infected. I would like to refer you to the Highjack This (HJT) forum here at BleepingComputer.com:

First: Read the Preparation Guide found HERE. It is very important that you follow ALL of the instructions found within. (There are many important steps in this guide that may clean your computer.)

Second: Post your system information along with a brief description of the problems you are having, and your HJT log in the HJT forum found HERE.

NOTE: Please, after you post your HJT log DO NOT make another post in the HJT forum until it has been responded to by a member of the HJT Team. The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post there will be 1 reply. The team member glancing over the replies might think someone is already helping you out and will not respond. So, just make your post and let it sit there until a team member responds. The volunteers who work that forum are very busy, so please be patient and wait. It can sometimes take a few days for a response. If after 5 days you still have gotten no response, then post a link to your HJT log HERE.

Third: If, after finishing your work with the folks at the HJT forum you have issues with XP related to the removal of the infection, then come back in here and let us help you get your computer back to normal.

You are in good hands! Good luck!
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#5 Herk

Herk

  • Members
  • 1,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:S.E. Idaho, USA
  • Local time:03:49 PM

Posted 14 March 2006 - 02:37 PM

Are you using the latest version of Spybot? DSO exploit was a false positive and referred to a problem that was actually with Microsoft. Check out this info at PCHell.

#6 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:03:49 PM

Posted 14 March 2006 - 02:42 PM

Are you using the latest version of Spybot? DSO exploit was a false positive and referred to a problem that was actually with Microsoft. Check out this info at PCHell.

You are correct, Herk. My instructions were to Update Spybot, and so I figured the user had done so. Also, a HJT log would reveal how updated XP and IE are (as IE updates could be related to this issue as well). And a log would reveal any other reasons why the computer could be working slow, in case the DSO exploits were false positives. At least this was the logic behind my recommending a log be produced at this point.

Edited by Albert Frankenstein, 14 March 2006 - 02:47 PM.

ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#7 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:02:49 PM

Posted 14 March 2006 - 05:04 PM

Something is causing explore.exe to hang on shutdown.

A HJT log would be helpful if the cause was malware, which it probably is.

#8 Morgane

Morgane
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:49 PM

Posted 15 March 2006 - 11:16 AM

Many thanks to Herk and Albert Frankenstein!!! :thumbsup:

I have Spybot 1.3 and will upgrade to 1.4 (didn't know there was one)

I have logged a HijackThis log yesterday.

Kind regards,

Morgane

#9 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:03:49 PM

Posted 15 March 2006 - 11:21 AM

I have Spybot 1.3 and will upgrade to 1.4 (didn't know there was one)

I could have explained this better. I said 'update', I meant 'upgrade and update', and I could have included a link. Some bugs have been worked out in the new version. DSO exploits were showing up that weren't neccessarily harmful. They will not show up in the latest version.
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#10 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:03:49 PM

Posted 15 March 2006 - 04:23 PM

Many thanks to Herk and Albert Frankenstein!!! :thumbsup:

I have Spybot 1.3 and will upgrade to 1.4 (didn't know there was one)

I have logged a HijackThis log yesterday.

Kind regards,

Morgane

You are almost certainly infected. Just hang tight and someone will help you in the HJT forum!
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#11 Morgane

Morgane
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:49 PM

Posted 20 March 2006 - 11:24 AM

A big ThankYou to You All !! :thumbsup:

I've finally got my PC to work at almost normal speed again!! HURRA! On a friend's recommendation I installed AntivirAntivir which promptly found 3 trojans (TR/Agent.uy.1)! One was in Internet Files and 2 were in System Volume. I had my doubts that the ZoneAlarm antivirus wasn't up to much...

Explorer.exe is still doing it's not responding thing at the end of every shut down/reboot and on a spur I did a search and found that there are 2 such files, one in C:/Windows and one in C:/Windows/Prefetch which looks like this: EXPLORER.EXE-082F38A9.pf. Would that have anything to do with my problem??

I have read that it's a good idea to empty the prefetch folder regularly, what do you think?

Many thanks in advance!

Kind greetings,

Morgane

#12 Herk

Herk

  • Members
  • 1,609 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:S.E. Idaho, USA
  • Local time:03:49 PM

Posted 20 March 2006 - 12:09 PM

Emptying some or all of the prefetch folder can possibly help speed things up a bit. I don't have any slowdowns and this isn't something I do, but you can check your prefetch folder to see what it's fetching. You should never turn off your prefetch folder. (It is possible to do so if you have plenty of memory, say to defrag, but if you don't have plenty of memory, you can render your system inoperable.)

For more on how the prefetch folder works, go here.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users