virus in explore.exe

[Jeff]

www.pacs-portal.co.uk/startup_pages/startup_all.php

type in explorer.exe and it will explain what that file
is from.

[Donald Link]

Actually you need to drop the "r" explore.exe and it is a virus.




"Jeff" > wrote in message
...
>
> www.pacs-portal.co.uk/startup_pages/startup_all.php
>
> type in explorer.exe and it will explain what that file
> is from.

[Fred Hoffman]

Thanks. The site suggested by Jeff identifies
explore.exe as a virus, as you both suggest. But how do
I remove it if I can't view it in any window?
>-----Original Message-----
>Actually you need to drop the "r" explore.exe and it is
a virus.
>
>
>
>
>"Jeff" > wrote in message
...
>>
>> www.pacs-portal.co.uk/startup_pages/startup_all.php
>>
>> type in explorer.exe and it will explain what that file
>> is from.
>
>
>.
>

[Sharon F]

If I had a file on my computer that was a known virus, I would be
updating my antivirus and using it to clean up the mess ASAP. The longer
this exists on the system, the more damage it can do. Possible damaging
program and Windows files to the point that all will need to be
reinstalled.

Some viruses will disable your antivirus program. If you find that is
the case here, visit one of the online antivirus check. Trend Micro has
one. A search with google.com will bring up a link for you rather
quickly.

You might also want to look up that virus at one of the antivirus sites.
Symantec (www.symantec.com) has good descriptions that will include any
extra steps that need to be performed manually.

Sharon F
MS MVP [Shell/User]


On Wed, 2 Jul 2003 15:11:40 -0700, "Fred Hoffman" >
wrote:

>Thanks. The site suggested by Jeff identifies
>explore.exe as a virus, as you both suggest. But how do
>I remove it if I can't view it in any window?
>>-----Original Message-----
>>Actually you need to drop the "r" explore.exe and it is
>a virus.
>>
>>
>>
>>
>>"Jeff" > wrote in message
...
>>>
>>> www.pacs-portal.co.uk/startup_pages/startup_all.php
>>>
>>> type in explorer.exe and it will explain what that file
>>> is from.
>>
>>
>>.
>>

[Donald Link]

Not sure if the information was given. but what virus checker are you using
and is it up to date.




"Fred Hoffman" > wrote in message
...
> Thanks. The site suggested by Jeff identifies
> explore.exe as a virus, as you both suggest. But how do
> I remove it if I can't view it in any window?
> >-----Original Message-----
> >Actually you need to drop the "r" explore.exe and it is
> a virus.
> >
> >
> >
> >
> >"Jeff" > wrote in message
> ...
> >>
> >> www.pacs-portal.co.uk/startup_pages/startup_all.php
> >>
> >> type in explorer.exe and it will explain what that file
> >> is from.
> >
> >
> >.
> >

[Kirk]

I have run into the exact same situation as above (i.e. same
notification, unable to locate using virus scan). Symantec's site was
not helpful (http://www.symantec.com/avcenter/venc/data/w32.spybot.worm.html),
as none of their prescribed procedures found anything (no suspicious
files or registry keys).

I don't know about this thread's originator, but I am using Norton AV
2002 (with the latest updated virus definitions). While Norton
notified me that this "C:\explore\explore.exe" file contained the
virus, this folder, nor the file exist. Furthermore, after doing a
complete hard drive scan, no viruses were found.

I would just ignore this, as sometimes as soon as NAV finds a virus it
deletes the file, but this is the third separate occasion this has
happened to me. So obviously, I still have a problem.

I would greatly appreciate any further specific instructions for how
to deal with this problem. Thanx!

[Sharon F]

On 6 Jul 2003 17:07:25 -0700, (Kirk) wrote:

>I have run into the exact same situation as above (i.e. same
>notification, unable to locate using virus scan). Symantec's site was
>not helpful (http://www.symantec.com/avcenter/venc/data/w32.spybot.worm.html),
>as none of their prescribed procedures found anything (no suspicious
>files or registry keys).
>
>I don't know about this thread's originator, but I am using Norton AV
>2002 (with the latest updated virus definitions). While Norton
>notified me that this "C:\explore\explore.exe" file contained the
>virus, this folder, nor the file exist. Furthermore, after doing a
>complete hard drive scan, no viruses were found.
>
>I would just ignore this, as sometimes as soon as NAV finds a virus it
>deletes the file, but this is the third separate occasion this has
>happened to me. So obviously, I still have a problem.
>
>I would greatly appreciate any further specific instructions for how
>to deal with this problem. Thanx!

Suggestions:

-- It's possible the explore.exe file is only present periodically. It
may not be the main file for the virus. Don't get so focused on that
name that you are missing other clues. NETBUS is not the only nasty that
masquerades with this name and new strains of viruses are discovered on
a daily basis.

- Use Folder Options> View to "show all files" and to not "hide system
protected files." Then follow that path or search for that particular
filename. If/when you find the file, you may want to submit it to your
antivirus program's tech support so that it can be analyzed.

- Use a different antivirus program. You can usually have more than one
installed. Run one for your autoprotect and main virus protection.
Disable that program to doublecheck the files again with the second
program -- OR -- visit one of the online scanners that is not sponsored
by the same vendor that distributes the antivirus program you are
currently using.

Sharon F
MS MVP [Shell/User]

[Donald Link]

Have you scanned your registery.



"Kirk" > wrote in message
om...
> I have run into the exact same situation as above (i.e. same
> notification, unable to locate using virus scan). Symantec's site was
> not helpful
(http://www.symantec.com/avcenter/venc/data/w32.spybot.worm.html),
> as none of their prescribed procedures found anything (no suspicious
> files or registry keys).
>
> I don't know about this thread's originator, but I am using Norton AV
> 2002 (with the latest updated virus definitions). While Norton
> notified me that this "C:\explore\explore.exe" file contained the
> virus, this folder, nor the file exist. Furthermore, after doing a
> complete hard drive scan, no viruses were found.
>
> I would just ignore this, as sometimes as soon as NAV finds a virus it
> deletes the file, but this is the third separate occasion this has
> happened to me. So obviously, I still have a problem.
>
> I would greatly appreciate any further specific instructions for how
> to deal with this problem. Thanx!

[Kirk]

Sharon F > wrote in message >...
> If I had a file on my computer that was a known virus, I would be
> updating my antivirus and using it to clean up the mess ASAP. The longer
> this exists on the system, the more damage it can do. Possible damaging
> program and Windows files to the point that all will need to be
> reinstalled.

Uh, did you read my earlier posting? I am trying to "clean up the
mess ASAP".

>
> You might also want to look up that virus at one of the antivirus sites.
> Symantec (www.symantec.com) has good descriptions that will include any
> extra steps that need to be performed manually.
>
This seemed to work. I used Symantec's online check and it found 45
files infected by viruses, and almost all of them were in a system
subfolder like this:

C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\~$scued
document 4.eml is infected with W32.Nimda.enc

I manually deleted these files, rescanned [online] and they seem to be
gone for the moment. Which brings up an interesting point: Why do I
spend $25 a year on virus update definitions when it can't detect
infected files that this [FREE] online service can? Just a rant...

Thanx to everyone who posted possible solutions.

[Sharon F]

On 7 Jul 2003 18:49:43 -0700, (Kirk) wrote:

>Sharon F > wrote in message >...
>> If I had a file on my computer that was a known virus, I would be
>> updating my antivirus and using it to clean up the mess ASAP. The longer
>> this exists on the system, the more damage it can do. Possible damaging
>> program and Windows files to the point that all will need to be
>> reinstalled.
>
>Uh, did you read my earlier posting? I am trying to "clean up the
>mess ASAP".
>> You might also want to look up that virus at one of the antivirus sites.
>> Symantec (www.symantec.com) has good descriptions that will include any
>> extra steps that need to be performed manually.
>>
>This seemed to work. I used Symantec's online check and it found 45
>files infected by viruses, and almost all of them were in a system
>subfolder like this:
>
>C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\~$scued
>document 4.eml is infected with W32.Nimda.enc
>
>I manually deleted these files, rescanned [online] and they seem to be
>gone for the moment. Which brings up an interesting point: Why do I
>spend $25 a year on virus update definitions when it can't detect
>infected files that this [FREE] online service can? Just a rant...
>
>Thanx to everyone who posted possible solutions.

Yes, I did read it. In the portion that you quoted of my message was a
description of how I would approach the same situation. Sorry if you
took that part personally. It wasn't meant that way.

As for your question about the effectiveness of your antivirus program,
it's probably fine. If you browse around at one of the independent sites
that evaluate these programs on a regular basis, you will see just about
the same 3 names towards the top and even then the ratings will shift
from month to month. Unfortunately there isn't one program that can do
it all and all of the time.

When a user hits a sticky virus or just wants to double check that their
a/v program has cleaned up properly - additonal tools can be used such
as downloadable utilities designed to clean up a particular virus or a
second virus scanner - installed or online. If a second a/v program is
installed, choose to auto protect with one. Keep the second as "backup."

Also, some viruses will disable any resident antivirus programs. It's
very nice and convenient to have those free antivirus services available
online "just in case."

Sharon F
MS MVP [Shell/User]

[Kirk]

Sharon F > wrote in message >...
>
> Yes, I did read it. In the portion that you quoted of my message was a
> description of how I would approach the same situation. Sorry if you
> took that part personally. It wasn't meant that way.
>
Sorry if I took it that way. This virus thing has been getting me on
somewhat of a "short fuse".

> As for your question about the effectiveness of your antivirus program,
> it's probably fine.

Thanx for your explanation. Glad to see my money spent (on virus
detection software) wasn't completely wasted.

[Sharon F]

On 9 Jul 2003 05:36:03 -0700, (Kirk) wrote:

>Sharon F > wrote in message >...
>>
>> Yes, I did read it. In the portion that you quoted of my message was a
>> description of how I would approach the same situation. Sorry if you
>> took that part personally. It wasn't meant that way.
>>
>Sorry if I took it that way. This virus thing has been getting me on
>somewhat of a "short fuse".
>
>> As for your question about the effectiveness of your antivirus program,
>> it's probably fine.
>
>Thanx for your explanation. Glad to see my money spent (on virus
>detection software) wasn't completely wasted.

You're very welcome, Kirk. I'm glad to hear that you've made progress on
that infestation. Hopefully you're in the clear now.

Sharon F
MS MVP [Shell/User]