My explorer.exe is modified and random webpages pop up. Help please!

[leo.hou]

I downloaded a memory testing software but clearly the file isn't what
is should be. My windows starts itself twice after I ran the downloaded
file.

Then I got webpage pop ups from my default browser (maxthon) ragularly.
So I turned kaspersky internet security to the highest security level
and it instantly reports that explorer.exe and iexplorer.exe is
modified.

I tried to update it with IE6.0 Service Pack1 but failed because "the
current version is higher". I check the help/about and my version is
"ie6 sp2". Is there really a SP2? or the hijacker just modified it to
SP2 so that I cannot install SP1?

Could anyone help me please?

Thanks a lot!


Leo

 

[Pennywise]

I downloaded a memory testing software but clearly the file isn't what
is should be. My windows starts itself twice after I ran the downloaded
file.

Then I got webpage pop ups from my default browser (maxthon) ragularly.
So I turned kaspersky internet security to the highest security level
and it instantly reports that explorer.exe and iexplorer.exe is
modified.

I tried to update it with IE6.0 Service Pack1 but failed because "the
current version is higher". I check the help/about and my version is
"ie6 sp2". Is there really a SP2? or the hijacker just modified it to
SP2 so that I cannot install SP1?

Could anyone help me please?

http://someonewhocares.org/hosts/hosts
Save this web page as HOSTS
Place this HOSTS file in your
WINDOWS\system32\drivers\etc
There will be a HOSTS file there already Rename it HOSTS_ORG first.

Who knows what your problem is, this will block most if not all pop
ups.

 

[leo.hou]

Thanks for the hosts

In short, my problem is how to restore explorer.exe

 

[Pennywise]

Thanks for the hosts

In short, my problem is how to restore explorer.exe

You installed it, the name of the program would of help'd

And you need to slipstream your XP CD before you can repair anything
http://www.winsupersite.com/showcase/windowsxp_sp2_slipstream.asp
and http://tinyurl.com/5bobl

but then you didn't mention if you've upgraded to SP2 ...

The HOSTS file was the only option with the info

 

[Malke]

I downloaded a memory testing software but clearly the file isn't what
is should be. My windows starts itself twice after I ran the
downloaded file.

Then I got webpage pop ups from my default browser (maxthon)
ragularly. So I turned kaspersky internet security to the highest
security level and it instantly reports that explorer.exe and
iexplorer.exe is modified.

I tried to update it with IE6.0 Service Pack1 but failed because "the
current version is higher". I check the help/about and my version is
"ie6 sp2". Is there really a SP2? or the hijacker just modified it to
SP2 so that I cannot install SP1?

You apparently got infested with something. Go through these general
malware removal steps systematically -

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Do all prep/finishing work and follow instructions to do all scans in
Safe Mode.

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the link above (not here, please).

If the procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a professional
computer repair shop (not your local version of BigStoreUSA).

Malke

 

[Plato]

I downloaded a memory testing software but clearly the file isn't what
is should be. My windows starts itself twice after I ran the downloaded
file.

NEVER use ram testing software while in windows. Ram is ALWAYS TESTED
after booting to some form of dos.