944,122 Members | Top Members by Rank

Ad:
Oct 26th, 2007
0

Explorer.exe Keeps Restarting

Expand Post »
Titles pretty much tells the problem. Working on a Windows Server 2003 platform and when in safe mode, computer works fine. When I reboot into normal operation mode the Explorer.exe keeps restarting itself. I have tried several spyware searches to include spybot, adaware, and used Norton Antivirus search as well. The initial spybot and adaware search found several problem and cleared them (supposedly), but the explorer.exe is still restarting itself. Any help you may be able to provide would help out tremendously. Thank you for your time. Here is a log file of a scan done in safe mode.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:36:37 AM, on 10/26/2007
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
F:\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by MARDET Athens
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=www-proxy-penb.cnet.navy.mil:8080;https=ssl-proxy-penb.cnet.navy.mil:8080;ftp=ftp-proxy-penb.cnet.navy.mil:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.cnet.navy.mil;*.excel.navy.mil;*.blueangels.navy.mil;*.navylearning.navy.mil;*.njrotc.navy.mil;*.nrotc.navy.mil;*.sta21.navy.mil;*.training.navy.mil;172.16.*;172.16.27.18;<local>
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\WINDOWS\nssfrch.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [ShutdownEventCheck] %systemroot%\system32\dumprep 0 -s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1178807854595
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178807941502
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MARDET.ALTIS.com
O17 - HKLM\Software\..\Telephony: DomainName = MARDET.ALTIS.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{EEF5A05E-A86F-4246-A7F2-54604C7F222A}: NameServer = 192.168.32.16,160.125.112.26,160.125.112.25
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MARDET.ALTIS.com
O18 - Protocol: hpapp - {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Program Files\Compaq\hpadu\Bin\hpapp.dll
O21 - SSODL: bxsbang - {150EC5D9-D67D-41D7-B51D-82C1AA6A2345} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {32AD0887-2E57-455C-B546-09C5CC658B75} - C:\WINDOWS\ocgrep.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: HP ProLiant Remote Monitor Service (CpqRcmc) - Hewlett-Packard Company - C:\WINDOWS\system32\cpqrcmc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel Alert Handler - Intel® Corporation - C:\WINDOWS\system32\ams_ii\hndlrsvc.exe
O23 - Service: Intel Alert Originator - Intel® Corporation - C:\WINDOWS\system32\ams_ii\iao.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: Symantec System Center Discovery Service (NSCTOP) - Symantec Corporation - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXE
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: HP ProLiant System Shutdown Service (sysdown) - Compaq Computer Corporation - C:\WINDOWS\system32\sysdown.exe
O23 - Service: HP System Management Homepage (SysMgmtHp) - Hewlett-Packard Company - C:\hp\hpsmh\bin\smhstart.exe

--
End of file - 5469 bytes
Similar Threads
Reputation Points: 10
Solved Threads: 0
Newbie Poster
tealnb is offline Offline
2 posts
since Oct 2007
Oct 26th, 2007
0

Re: Explorer.exe Keeps Restarting

O21 - SSODL: bxsbang - {150EC5D9-D67D-41D7-B51D-82C1AA6A2345} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {32AD0887-2E57-455C-B546-09C5CC658B75} - C:\WINDOWS\ocgrep.dll

I taher think these are the baddies. Can you delete them in safe mode?

The Registry entries can be removed by a registry cleaner after you've deleted these files.

I hope it's as simple as that.

Before you delete them, have a thought as to how they might have got there and let us have those thoughts.

I hope the Navy is safe!
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007
Oct 26th, 2007
0

Re: Explorer.exe Keeps Restarting

Thank you very much. That worked. Have a nice day
Reputation Points: 10
Solved Threads: 0
Newbie Poster
tealnb is offline Offline
2 posts
since Oct 2007
Oct 26th, 2007
0

Re: Explorer.exe Keeps Restarting

Glad it's OK. Do please mark the thread as SOLVED.
Sponsor
Reputation Points: 47
Solved Threads: 144
Posting Virtuoso
Suspishio is offline Offline
1,729 posts
since Aug 2007

This thread is solved

Either the thread starter or a moderator has marked this thread as solved. You can most likely trust the responses and answers given. There is most likely no reason for any further responses to be posted here. If you have a related question, please start a new thread in this forum instead.

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: Help with Various Trojans
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Display Properties, being silly





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC