B
Bob I
Perhaps you may read this first.
http://www.google.com/search?hl=en&q=Updater.exe&btnG=Google+Search&aq=f&oq=
http://www.google.com/search?hl=en&q=Updater.exe&btnG=Google+Search&aq=f&oq=
C
Carey Frisch [MVP]
Automatic Updates and WindowsUpdate Reset tool
http://www.codeplex.com/aureset
--
Carey Frisch
Microsoft MVP
Windows Desktop Experience
---------------------------------------------------------------------
Hi I'm your average person with an above average problem. See a couple days
ago I got on my desktop and found that it is missing the Updater.exe file for
windows. This means that it can no longer receive updates from microsoft,
which is extremely vital. I looked around for it in Microsoft, but,
unfortunately, they have no where to download the file or anyway to restore
it. Anyone have any ideas? Thanks!
~Brad
http://www.codeplex.com/aureset
--
Carey Frisch
Microsoft MVP
Windows Desktop Experience
---------------------------------------------------------------------
Hi I'm your average person with an above average problem. See a couple days
ago I got on my desktop and found that it is missing the Updater.exe file for
windows. This means that it can no longer receive updates from microsoft,
which is extremely vital. I looked around for it in Microsoft, but,
unfortunately, they have no where to download the file or anyway to restore
it. Anyone have any ideas? Thanks!
~Brad
S
stoner1961
will this give me back my display controls for changing my screensavers.
right now i have a rectanglar box telling me i have a virus.
right now i have a rectanglar box telling me i have a virus.
M
Malke
stoner1961 said:
No. Assuming that you are not the Original Poster (and next time please make
a new post including all your pertinent information instead of sticking
your issue into someone else's thread - this is not said to hurt your
feelings but rather to help us help you), you are infected with malware
which you need to clean up.
Your system is infected with a rogue antivirus program. It is called "rogue"
because it pretends to be A Good Guy but is really Evil. Do not pay them!
Because you didn't give me the name of the program that is trying to get you
to buy it, I can't point you to specific removal steps. Look for them here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html
Malwarebytes malware removal guides - http://tinyurl.com/5xrpft
If you are infected with XP Antivirus or Antivirus 209/10, here are removal
steps:
http://www.bleepingcomputer.com/malware-removal/uninstall-antivirus-2009
http://www.bleepingcomputer.com/forums/topic154529.html (earlier versions)
Removal instructions for Antivirus 2010:
http://www.malwarebytes.org/forums/index.php?showtopic=6703
Removal instructions for Antivirus 2009:
http://www.malwarebytes.org/forums/index.php?showtopic=5178
These may work for you and all may be well. However, in many cases the
computer will also be infected with Zlob and/or Vundo trojans and protected
by a rootkit. These machines are extremely difficult to clean.
If your machine is one of these cases, either get guided help at one of the
specialty forums below OR back up your data and do a clean install of
Windows. It is your choice. If you are unsure how to back up your data or
how to do a clean install, you can take your machine to a local computer
professional. I don't recommend using BigComputerStore/GeekSquad types of
places.
PLEASE DO NOT POST LOGS IN THE MS NEWSGROUPS.
http://aumha.org/downloads/hijackthis.zip
http://aumha.net/ - Click on the HijackThis forum. Read the announcement and
the stickies *first*.
http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/
http://www.thespykiller.co.uk/index.php?board=3.0
http://forums.subratam.org/index.php?showforum=7
Malke
H
hunterjeff
hi my name is jeff my problem is my desktop background turn into black it
happen when i up dated my windows xp2 , the question hope you can find a
solution that will enable my pc back to normal again, thanks and god bless....
happen when i up dated my windows xp2 , the question hope you can find a
solution that will enable my pc back to normal again, thanks and god bless....
raparten said:
M
MollyinTexas
I lost my icons and start button and have been trying everything under the
sun to no avail. I did what "Yai Dee" said to do and IT
WORKED!!!!!!!!!!!!!!!!!!!
THANK YOU YAI DEE!!!!!!!!!!!!!!!
)
sun to no avail. I did what "Yai Dee" said to do and IT
WORKED!!!!!!!!!!!!!!!!!!!
THANK YOU YAI DEE!!!!!!!!!!!!!!!
)Yai Dee said:Download super anti spyware, install, update and remove all the spyware it
found. Then restart, again update and again run and remove all the spyware it
finds. Your problem will be fixed.
subsonika said:I have exactly the same for 2 days. it must be a virus that makes explorer
exe vanish! help please
Julsie said:
T
TIMMY
I'M HAVING THE SAME EXACT PROBLEM...CAN SOMEONE ASSIST ME A.S.A.P.
raparten said:
G
gfishin
MollyinTexas said:I lost my icons and start button and have been trying everything under the
sun to no avail. I did what "Yai Dee" said to do and IT
WORKED!!!!!!!!!!!!!!!!!!!
THANK YOU YAI DEE!!!!!!!!!!!!!!!
Yai Dee said:Download super anti spyware, install, update and remove all the spyware it
found. Then restart, again update and again run and remove all the spyware it
finds. Your problem will be fixed.
subsonika said:I have exactly the same for 2 days. it must be a virus that makes explorer
exe vanish! help please
:
I am having the same problem. I can't do a system restore from safe mode
either. Anyone know the dos command? Also, seems to be a lot of programs
running in the background.
:
Yes, typing explorer.exe helps for like 15 secs, then everything disappears,
and it disappears from the task manager.
PA Bear- No? What is Kaspersky Anti-Virus? I did do a Macafee, and Spy
Bot Search and Destroy?
:
Open tas manager then click on "file" in the upper lt. corner select "new
task" type in explorer.exe then hit ok, does your desktop reappear?
P.S. I noticed that you are running AOL well it's not called AOHELL for
nothing.
--
Mike Pawlak
:
I am having a terrible time with my win. xp home edition right now. It
started a couple of days ago, all of a sudden the task bar, icons on the
desktop, and start menu disappeared. I had been working in the task
manager, deleting some processes... I was doing as the Sims 2 Holiday Edition
manual said, as it also said everything would return to normal after i
restarted my computer. well since then, one of 2 things have been happening.
Either everything flashes [appears for like 15 secs then disappears for
couple secs, comes back, disppears, comes back....] or all i have is the
desktop wall paper. I have been trying to fix this for a couple of days and
i don't know what to do. explorer.exe was missing from the list of processes
in the taskmanager so i added it and then everything came back. but then
like 10 secs later it disappeared again. I can use most of my programs
through the task manager. I did a Hijack This, as i have seen a lot of
people with this problem do. Here is the log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:25:52 PM, on 12/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device
Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system\winmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\imapi.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://rd.yahoo.com/customize/yessentials_cq/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows
Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {FC0F30CD-E949-4148-884E-DC0F3D32EA46} - (no
file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no
file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} -
c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: GoodSearch Toolbar - {4E7BD74F-2B8D-469E-95BA-ED6DB186BE32} -
C:\PROGRA~1\GOODSE~1\GOODSE~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} -
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\MCUPDA~1.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe"
/checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program
Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software
Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common
Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: Event Reminder.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program
Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program
Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program
Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program
Files\Quicken\bagent.exe
O8 - Extra context menu item: &Search -
http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxdm006YYUS
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
- C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} -
C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) -
http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -
http://wdownload.weatherbug.com/minibug/tricklers/AWS/MiniBugTransporter.cab?
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) -
C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} -
http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) -
http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control)
- http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating
System Class) -
http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader
Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1191693363343
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) -
http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {78AEEDE8-7345-4FB5-A8FE-4BFF16EF25FC} (McAfee Virtual Technician
Control Class) - http://mvt.mcafee.com/mvt/bin/3,0,1,0/mvt.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) -
http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) -
http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} -
http://gameadvisor.futuremark.com/global/msc37.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4784/mcfscan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program
Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common
Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour
Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. -
C:\Program Files\Common Files\Macrovision Shared\FLEXnet
Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program
Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc -
c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. -
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc -
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee,
Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee
Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation -
C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America
Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WRC (Windows Redundancy Check) - Unknown owner -
C:\WINDOWS\repair\services.exe (file missing)
O23 - Service: Windows Messenger Service (WINMGR) - Unknown owner -
C:\WINDOWS\system\winmgr.exe
O24 - Desktop Component 0: (no name) - (no file)
--
End of file - 11379 bytes
I am not very savvy when it comes to this stuff so any help would be greatly
appreciated.
Thanks.
D
DaveB
I am having the same problem. I am able to login successfully, get to the
wallpaper background, displays trying to access my wireliss account, all OK,
except I do not have any icons, taskbar, etc. What I do show is a pop up
stating that Windows Explorer was having difficulties and needed to close. I
can bring up the Task Manger, but when I go to File and start new task, it
comes back a pop up similar to the Windows Explorer pop up, and eventually
closes. I never get a chance to start explorer.
Any ideas and any help would be greatly appreciated!
Dave
wallpaper background, displays trying to access my wireliss account, all OK,
except I do not have any icons, taskbar, etc. What I do show is a pop up
stating that Windows Explorer was having difficulties and needed to close. I
can bring up the Task Manger, but when I go to File and start new task, it
comes back a pop up similar to the Windows Explorer pop up, and eventually
closes. I never get a chance to start explorer.
Any ideas and any help would be greatly appreciated!
Dave
TIMMY said:
J
Jose
I would say your system is infected and you have several options.
Reinstalling or a Repair install of XP is not on my list.
You need to get a clean copy of explorer running so you can then do
whatever you have to do to get uninfected. You will not get far if
explorer.exe will not run properly.
If you can get to Task Manager, clicking File, Run and entering
explorer.exe is a good idea if - explorer.exe is not already running
and explorer.exe is not one of the infected files, but if I was
malicious software, explorer.exe would be a fine target. Usually I
would suggest that first, but now I am seeing where explorer.exe is
the problem so trying to start it from TM will not help. So, replace
explorer.exe.
From TM click File, New Task, Browse and maneuver to c:\windows and
locate explorer.exe so you know where it is.
You can't replace explorer.exe if it is running, so if TM shows
explorer.exe is a running process, end the process and make sure it
does not magically start again.
From the TM browse window maneuver to c:\windows and delete
explorer.exe (or if you are afraid to do that, rename it). Since it
is a protected Windows file, Windows File Protection will quickly and
silently replace it with a copy from your dllcache folder. Hopefully,
that one is okay. You can refresh your browsing display to see it
replaced in a few seconds.
If you can't delete explorer.exe from TM, open a new command window
task (File, New Task, cmd.exe) and delete explorer from c:\windows
that way. It will be replaced if WFP is working. It must not be
running or you can't delete it.
Now try to start explorer from TM and report back the results.
If you look later you will see a message like this in the Event Log:
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Description:
File replacement was attempted on the protected system file c:\windows
\explorer.exe. This file was restored to the original version to
maintain system stability. The file version of the system file is
6.0.2900.5512.
P
PaulM
Try this script: FixShell, you can download it here:
http://www.paulsxp.com/forum/viewtopic.php?f=11&t=21
--
Paul's XP and Vista Tweaks
--------------------------------------------
www.paulsxp.com
--------------------------------------------
www.paulsxp.com/forum
-------------------------------------------
http://www.paulsxp.com/forum/viewtopic.php?f=11&t=21
--
Paul's XP and Vista Tweaks
--------------------------------------------
www.paulsxp.com
--------------------------------------------
www.paulsxp.com/forum
-------------------------------------------
DaveB said:
D
DaveB
I worked on this over the weekend, but sorry to say, with no success.
TaskManager is hosed somewhat also, as it will not allow me to open a file.
Is there an easy way to access a command prompt without going back and forth
to safe mode (constant rebooting)? Since I cannot see any icons or task bar
to be able to access START, it is rough.
Any other ideas?
TaskManager is hosed somewhat also, as it will not allow me to open a file.
Is there an easy way to access a command prompt without going back and forth
to safe mode (constant rebooting)? Since I cannot see any icons or task bar
to be able to access START, it is rough.
Any other ideas?
E
Elmo
DaveB said:
If it is an infection:
Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem:
http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/
Download the executable rather than the .iso image, if one is
available.. it prompts you to insert a CD and burns the file, no problem.
Then run these:
Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
SuperAntispyware
http://www.superantispyware.com/superantispywarefreevspro.html
D
DaveB
I downloaded the script file and renamed it to a .exe file to make it an
executable. It ran, but it was taking abnormally long and the cursor was
moving all over the place while it was 'running'. You had mentioned that it
should only take 10-12 seconds to run. I had to run it from Safe Mode with
Command prompt, since I have no access to get the command prompt while logged
in. No task bar, no icons, and Task Manager will not allow me to start a new
task without aborting TM.
Is there any way to get to the command prompt without having to go into Safe
Mode? I continuosly have to reboot everytime I make a change.
Thanks!
executable. It ran, but it was taking abnormally long and the cursor was
moving all over the place while it was 'running'. You had mentioned that it
should only take 10-12 seconds to run. I had to run it from Safe Mode with
Command prompt, since I have no access to get the command prompt while logged
in. No task bar, no icons, and Task Manager will not allow me to start a new
task without aborting TM.
Is there any way to get to the command prompt without having to go into Safe
Mode? I continuosly have to reboot everytime I make a change.
Thanks!
PaulM said:
J
Jose
What does "task manager is hosed somewhat" mean?
You don't need to open any files or start a new task using TM. You
need to Browse.
From TM click File, New Task, Browse. Can you browse to c:\windows or
not? Click through any complaining messages.
You need to replace your explorer.exe - not try to run anything right
now.
P
PaulM
You can not rename a vbscript file to an exe file and run it!!
You must run it as a vbs file.
--
Paul's XP and Vista Tweaks
--------------------------------------------
www.paulsxp.com
--------------------------------------------
www.paulsxp.com/forum
-------------------------------------------
You must run it as a vbs file.
--
Paul's XP and Vista Tweaks
--------------------------------------------
www.paulsxp.com
--------------------------------------------
www.paulsxp.com/forum
-------------------------------------------
DaveB said: