Member Avatar for Mrosuper

I have been supporting a doctor with his old Dell Inspiron 600m laptop. He installed, unfortunately the new "TweeterDeck ", I need to check the spelling, any way, shortly after doing so he got two unidentified Trojans, Mcafee Stinger used to clean them off. No name given in the log, just that they were both cleaned-deleted off. Well it seems that the payload was taking control and or changing access rights to explorer.exe and blocks the removal or reinstallation or replacement of the Mcafee Security Center suite. I have just spent 10 hours over the last two months, because he working on books. I need to do all my work on the system during his office hours, and so my resources are limited. The Task manager to start explorer.exe used to work and then I would clean up the registry entries, but after these two Trojan(s); I get an Access Denied or file not found, even though I can see the explorer.exe in the C:\windows dir.

URGENT ... Help with this sticky one would be very much appriciated.

  • 2 Contributors
  • 1 Reply
  • 219 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Rik_

Dani AI

Generated

Quick, practical plan for (and thanks to @Rik for the Malwarebytes suggestion). First: work offline and back up the doctor’s user data before changing system files or permissions. Run Malwarebytes with updated definitions in Safe Mode (as @Rik suggested) — if it removes items but Explorer still won't start, the problem is usually permissions/ownership or a file handle, not a missing binary.

Try repairing system files and, if necessary, restoring explorer.exe from the XP CD. From an elevated prompt run sfc /scannow (XP may prompt for the install CD). If SFC cannot run or the file is locked, boot the XP CD to the Recovery Console, use MAP to find the CD drive, then expand the compressed copy from the i386 folder, for example:

expand D:\i386\explorer.ex_ C:\Windows\explorer.exe

If Recovery Console refuses to copy, the RC SET options can relax restrictions but must be enabled via the Recovery Console policy; use those only temporarily and with caution. (learn.microsoft.com)

If permissions were altered by the trojan, reset ownership/ACLs. For XP Home the SubInACL tool is commonly used; create a small script that grants Administrators and SYSTEM full rights across the registry and system drive, then reboot. XP Professional can also use secedit to reapply the default security template. Back up the registry and data before running either method. Example lines:

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f
subinacl /subdirectories %SystemDrive% /grant=administrators=f
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose

Run these as Administrator and be patient — they take time. (learn.microsoft.com)

Use Sysinternals to find what’s locking explorer and to remove malicious startup entries: Process Explorer (Find Handle or DLL) will show handles to explorer.exe you can close, and Autoruns will show Winlogon/Run/Services entries to disable. If the machine remains unstable, consider a repair install or a clean reinstall after a full backup. Preserve notes on any changes you try so you can undo them if needed. (learn.microsoft.com)

If you want, post the exact error messages or the output from sfc/SubInACL logs and any locked-handle names seen in Process Explorer for targeted follow-up.

Member Avatar for Rik_

Throw Mbam at it.

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebyt...are_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Make sure that you restart the computer.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.