explorer keeps crashing! help!

[gunnerforlife]

its clean according to virus total
do you want me to upload screenshots?

[CBMatt]

No, that's alright.  I was just curious because I can't find anything at all about that file.  VirusTotal isn't 100%, but it's usually quite reliable.  Thanks for doing the scan.

I think I'll hand the mic back over to oddjob.  Don't worry, you're in good hands with him.

[gunnerforlife]

right, thanks  

[oddjob]

its going to take 4-6 minutes for the scan.

HOW LONG?

I assume you managed to follow my earlier advice, deleted that other file in your temp folder AND you managed to use Ccleaner. PLEASE CONFIRM WHAT ACTION YOU TOOK.

***********************

Make sure you have exposed all Hidden Files & Folders.
 
To enable the viewing of Hidden files follow these steps:
 
   1. Close all programs so that you are at your desktop.
   2. Double-click on the My Computer icon.
   3. Select the Tools menu and click Folder Options.
   4. After the new window appears select the View tab.
   5. Put a checkmark in the checkbox labeled Display the contents of system folders.
   6. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
   7. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
   8. Remove the checkmark from the checkbox labeled Hide protected operating system files.
   9. Press the Apply button and then the OK button and close My Computer.
 
***********************

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

• Save it to your desktop.
  
• Please double-click Killbox.exe to run it.
  
• Select:
  • Delete on Reboot
  • then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  
  C:\WINDOWS\TEMP\QI65B2.EXE
  
  
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
  
  
• Click the red-and-white Delete File button.  Click Yes at the Delete on Reboot prompt.  Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

***********************

Go to this folder and delete everything in it BUT DO NOT delete the folder itself...

C:\WINDOWS\TEMP

***********************

Empty your recycle bin.


Reboot your computer and post a new hijackthis log here. Please tell us what's happening now.



OJ

[gunnerforlife]

i didnt see the killbox part
ive already deleted the file   now what?

[gunnerforlife]

its not letting me download killbox, says i dont have permission to do that action

[gunnerforlife]

umm....is it ok if i come back tomorrow? im v sleepy and i have school tomorrow

[gunnerforlife]

update: explorer still crashes when i try to play a video file.....ive deleted the process but it reappears every time i reboot,  :-?
according to totalvirus the file is clean (screenshots above this post)

[oddjob]

For the time being stay away form using anything that causes explorer.exe to crash.

There is a file on your system that renames itself on reboot. We are trying to hit a moving target.

Boot your system in Normal Mode BUT DO NOT REBOOT IT TILL MY NEXT REPLY.


Please download ComboFix by sUBs:

NOTE:  In the event you already have ComboFix, this is a new version that I need you to download.

• Save it to your desktop.
• Double-click combofix.exe and follow the prompts.
  
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**************

Perform an online scan with Internet Explorer with Panda ActiveScan here ....

http://www.pandasoftware.com/products/activescan.htm

Click on the "Free To Use ActiveScan" located on the top right hand corner [list=1]

• Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
• Enter your e-mail address, country, and state & click Scan Now  * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer

• Let it fix anything it offers to fix; If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on See report then click Save report[/color]
  * You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
  * Turn off the real time scanner of any existing antivirus program while performing the online scan
  
  
  Paste the Panda Scan report here together with a new HijackThis log and an update on how is working now.
  
  
  Remember ... do NOT reboot yet.
  
  
  OJ

[gunnerforlife]

ive attached the logs, acc to active scan i have 41 forms of spyware on computer.

[oddjob]

Hi

Thanks for those reports. the mystery file is still remaining/reloading, as you can see. As PAS is reporting so many infections we will try two general/Trojan cleaners.

Make sure you have exposed all Hidden Files & Folders.
 
To enable the viewing of Hidden files follow these steps:
 
   1. Close all programs so that you are at your desktop.
   2. Double-click on the My Computer icon.
   3. Select the Tools menu and click Folder Options.
   4. After the new window appears select the View tab.
   5. Put a checkmark in the checkbox labeled Display the contents of system folders.
   6. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
   7. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
   8. Remove the checkmark from the checkbox labeled Hide protected operating system files.
   9. Press the Apply button and then the OK button and close My Computer.
 
***********************

Go back to my earlier post about Killbox. Get it from this link instead ....

http://www.majorgeeks.com/Pocket_KillBox_d4709.html

Now work through the procedure as I explained before BUT, this time, the file name has changed to ...

C:\WINDOWS\TEMP\LC3D79.EXE

Hopefully this will allow you to kill off the file.

***********************

If you are on Windows 2000 or XP

Download Ewido/AVG Anti Spyware from here ….

http://www.ewido.net/en/

It has a fully working 30 day trial period.

Install it and update it to the latest definitions.


NOW REBOOT to safe mode. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

Reboot to normal mode and use the computer as you would usually do.

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

***********************

Now download TrojanHunter from here ....

http://www.misec.net/

Again, this is a fully working trial version.

Install it and update it to the latest definitions.

Scan your system with it. Let it fix anything it wants to.


Re-hide system files & folders by taking the reverse procedure to that at the start of this post when you exposed them.


Please post back the reports and a fresh HJT log.


OJ

[gunnerforlife]

hi there,
killbox didnt delete the file, its reappeared once again.....
do you want me to carry out the rest of the steps?
thanks

[oddjob]

Yes please.

[gunnerforlife]

also, avg isnt updating, says it cant connect to the server, maybe their server is down?

[gunnerforlife]

im downloading the definitions manually