virus in explore.exe

[fred hoffman]

I received notices from Norton Antivirus 2002 that
C:\DOCUMENTS AND SETTINGS\ALL USERS\DOCUMENTS\EXPLORE.EXE
is infected by the w32.Spybot.worm virus, that it was
unable to repair the file, and that access to the file
was denied. The Norton website provides a procedure for
removing the virus, but it involves deleting the infected
file. I have been unable to view the file or
the "Documents" folder in Windows explorer, so I am
stymied in removing the virus. Moreover, after receiving
the warning notices I ran a comprehensive scan of all
files which found no infected files. I have set folder
options to display system files and hidden files and
directories. Is there some way to display the
explorer.exe file? Any other suggestions for dealing
with the problem?

 

[Crusty \(-: Old B@stard :-\)]

Seeing as how that file is not on my computer, and my computer is running
just fine, I believe that the file, explore.exe, IS, IN FACT, the virus!

 

[Jeff]

www.pacs-portal.co.uk/startup_pages/startup_all.php

type in explorer.exe and it will explain what that file
is from.

 

[Donald Link]

Actually you need to drop the "r" explore.exe and it is a virus.

 

[Donald Link]

Not sure if the information was given. but what virus checker are you using
and is it up to date.

 

[Sharon F]

If I had a file on my computer that was a known virus, I would be
updating my antivirus and using it to clean up the mess ASAP. The longer
this exists on the system, the more damage it can do. Possible damaging
program and Windows files to the point that all will need to be
reinstalled.

Some viruses will disable your antivirus program. If you find that is
the case here, visit one of the online antivirus check. Trend Micro has
one. A search with google.com will bring up a link for you rather
quickly.

You might also want to look up that virus at one of the antivirus sites.
Symantec (www.symantec.com) has good descriptions that will include any
extra steps that need to be performed manually.

Sharon F
MS MVP [Shell/User]

 

[Kirk]

I have run into the exact same situation as above (i.e. same
notification, unable to locate using virus scan). Symantec's site was
not helpful (http://www.symantec.com/avcenter/venc/data/w32.spybot.worm.html),
as none of their prescribed procedures found anything (no suspicious
files or registry keys).

I don't know about this thread's originator, but I am using Norton AV
2002 (with the latest updated virus definitions). While Norton
notified me that this "C:\explore\explore.exe" file contained the
virus, this folder, nor the file exist. Furthermore, after doing a
complete hard drive scan, no viruses were found.

I would just ignore this, as sometimes as soon as NAV finds a virus it
deletes the file, but this is the third separate occasion this has
happened to me. So obviously, I still have a problem.

I would greatly appreciate any further specific instructions for how
to deal with this problem. Thanx!

 

[Sharon F]

I have run into the exact same situation as above (i.e. same
notification, unable to locate using virus scan). Symantec's site was
not helpful (http://www.symantec.com/avcenter/venc/data/w32.spybot.worm.html),
as none of their prescribed procedures found anything (no suspicious
files or registry keys).

I don't know about this thread's originator, but I am using Norton AV
2002 (with the latest updated virus definitions). While Norton
notified me that this "C:\explore\explore.exe" file contained the
virus, this folder, nor the file exist. Furthermore, after doing a
complete hard drive scan, no viruses were found.

I would just ignore this, as sometimes as soon as NAV finds a virus it
deletes the file, but this is the third separate occasion this has
happened to me. So obviously, I still have a problem.

I would greatly appreciate any further specific instructions for how
to deal with this problem. Thanx!

Suggestions:

-- It's possible the explore.exe file is only present periodically. It
may not be the main file for the virus. Don't get so focused on that
name that you are missing other clues. NETBUS is not the only nasty that
masquerades with this name and new strains of viruses are discovered on
a daily basis.

- Use Folder Options> View to "show all files" and to not "hide system
protected files." Then follow that path or search for that particular
filename. If/when you find the file, you may want to submit it to your
antivirus program's tech support so that it can be analyzed.

- Use a different antivirus program. You can usually have more than one
installed. Run one for your autoprotect and main virus protection.
Disable that program to doublecheck the files again with the second
program -- OR -- visit one of the online scanners that is not sponsored
by the same vendor that distributes the antivirus program you are
currently using.

Sharon F
MS MVP [Shell/User]

 

[Kirk]

If I had a file on my computer that was a known virus, I would be
updating my antivirus and using it to clean up the mess ASAP. The longer
this exists on the system, the more damage it can do. Possible damaging
program and Windows files to the point that all will need to be
reinstalled.

Uh, did you read my earlier posting? I am trying to "clean up the
mess ASAP".

You might also want to look up that virus at one of the antivirus sites.
Symantec (www.symantec.com) has good descriptions that will include any
extra steps that need to be performed manually.

This seemed to work. I used Symantec's online check and it found 45
files infected by viruses, and almost all of them were in a system
subfolder like this:

C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\~$scued
document 4.eml is infected with W32.Nimda.enc

I manually deleted these files, rescanned [online] and they seem to be
gone for the moment. Which brings up an interesting point: Why do I
spend $25 a year on virus update definitions when it can't detect
infected files that this [FREE] online service can? Just a rant...

Thanx to everyone who posted possible solutions.

 

[Kirk]

Yes, I did read it. In the portion that you quoted of my message was a
description of how I would approach the same situation. Sorry if you
took that part personally. It wasn't meant that way.

Sorry if I took it that way. This virus thing has been getting me on
somewhat of a "short fuse".

As for your question about the effectiveness of your antivirus program,
it's probably fine.

Thanx for your explanation. Glad to see my money spent (on virus
detection software) wasn't completely wasted.

 

[Sharon F]

Sorry if I took it that way. This virus thing has been getting me on
somewhat of a "short fuse".


Thanx for your explanation. Glad to see my money spent (on virus
detection software) wasn't completely wasted.

You're very welcome, Kirk. I'm glad to hear that you've made progress on
that infestation. Hopefully you're in the clear now.

Sharon F
MS MVP [Shell/User]