re: ''eplorer'' virus? trojan? Not according to Norton
Thursday, July 24, 2003 at 6:12 pm
Windows 98 Annoyances Discussion Forum
Posted by Helen~
(2547 messages posted)
Hi Dustin,
I did a google search for eplorer.exe and it is a trojan. The entry is the third
one in the list and gives some removal suggestions. Sorry I don't know how to send
it as a link. Good luck!
Helen
On Thursday, July 24, 2003 at 5:38 pm, dustin wrote:
>Logfile of HijackThis v1.95.1
>Scan saved at 8:36:39 PM, on 7/24/03
>Platform: Windows 98 SE (Win9x 4.10.2222A)
>MSIE: Internet Explorer v6.00 (6.00.2600.0000)
>
>Running processes:
>C:\WINDOWS\SYSTEM\KERNEL32.DLL
>C:\WINDOWS\SYSTEM\MSGSRV32.EXE
>C:\WINDOWS\SYSTEM\MPREXE.EXE
>C:\WINDOWS\SYSTEM\mmtask.tsk
>C:\WINDOWS\EXPLORER.EXE
>C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\TYPE32.EXE
>C:\WINDOWS\SYSTEM\EPLORER.EXE
>C:\WINDOWS\START MENU\PROGRAMS\STARTUP\3CMLNKW.EXE
>C:\WINDOWS\START MENU\PROGRAMS\STARTUP\SYSTRAY.EXE
>C:\WINDOWS\SYSTEM\WMIEXE.EXE
>C:\WINDOWS\SYSTEM\PDESK.EXE
>C:\WINDOWS\SYSTEM\DDHELP.EXE
>C:\PROGRAM FILES\EARTHLINK TOTALACCESS\TASKPANL.EXE
>C:\WINDOWS\SYSTEM\TAPISRV.EXE
>C:\WINDOWS\SYSTEM\RNAAPP.EXE
>C:\PROGRAM FILES\EARTHLINK TOTALACCESS\FASTLANE\ARUPLD32.EXE
>C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
>C:\WINDOWS\SYSTEM\SPOOL32.EXE
>C:\WINDOWS\SYSTEM\LEXBCES.EXE
>C:\WINDOWS\SYSTEM\RPCSS.EXE
>C:\WINDOWS\SYSTEM\LEXPPS.EXE
>C:\PROGRAM FILES\ANALOGX\MAXMEM\MAXMEM.EXE
>C:\WINDOWS\NOTEPAD.EXE
>C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE
>
>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://tm.ask.com/r?t=c&s=a&sv=0&id=10990&u=http://www.ask.com/index.asp?origin=7051
>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
>R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
>R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie/button/search.html
>R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
>O2 - BHO: (no name) - {8EDAB5C0-B061-11d1-801D-204C4F4F5020} - (no file)
>O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\PROGRAM
>FILES\EARTHLINK POP-UP BLOCKER\PNEL.DLL
>O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
>O3 - Toolbar: (no name) - {09445DC0-42DD-11D7-ACE9-444553540000} - (no file)
>O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\PROGRAM
>FILES\EARTHLINK POP-UP BLOCKER\PNEL.DLL
>O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
>O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
>O4 - HKLM\..\Run: [Winsock2 driver] EPLORER.EXE
>O4 - Startup: 3CMLNKW.EXE
>O4 - Startup: SYSTRAY.EXE
>O4 - Startup: Event Planner Reminders Tray Icon.lnk = C:\SIERRA\Planner\PLNRnote.exe
>O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
>O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
>O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
>O9 - Extra button: Related (HKLM)
>O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
>O9 - Extra button: AIM (HKLM)
>O14 - IERESET.INF: START_PAGE_URL=http://start.earthlink.net
>O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
>O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
>O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information
>Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
>O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
>http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
>O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/930260cd062fd5/housecall.antivirus.com/housecall/xscan53.cab
>O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37638.1084837963
>O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
>
>
>There it is. I also noticed that there is nothing refering to Norton & all my shortcuts
>and such for it have dissappeared as though it has been uninstalled!!! While waiting
>for your reply I tried msconfig which does the same as regedit & msinfo will run
>but all of the "tools" do the same thing too. This one seems to be a doozy!!!
>
>
|
All messages in this thread [show all]
 | | |  | re: ''eplorer'' virus? trojan? Not according to Norton (Helen~: Thu, Jul 24, 2003, 6:12 pm) |
| |
| |
Return to the Windows 98 Discussion Forum
|
|
