explorer.exe connecting to virus.dload.ws (74.52.177.2)

- Collapse -

Give MBAM a try...

by Marianna Schmudlach Sep 19, 2008 4:01AM PDT

Please download Malwarebytes Anti-Malware or alternate download link

* Make sure you are connected to the Internet.
* Double-click on Download_mbam-setup.exe to install the application.
* When the installation begins, follow the prompts and do not make any changes to default settings.
* When installation has finished, make sure you leave both of these checked:
* - Update Malwarebytes' Anti-Malware
* - Launch Malwarebytes' Anti-Malware
* Then click Finish.
* MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
* If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

* On the Scanner tab:
* - Make sure the "Perform Quick Acan" option is selected.
* - Then click on the Scan button.
* The next screen will ask you to select the drives to scan. Leave all the drives selected and click on the Start Scan button.
* The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
* When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
* Click OK to close the message box and continue with the removal process.
* Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
* Make sure that everything is checked, and click Remove Selected.
* When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
* The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

* -- Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

**If you encounter this message:"c:\program files\malwarebytes' Anti-Malware\mbamext.dll Unable to register the dll/ocx: RegSvr32 failed with exit code 0x5" Click on ignore mbamext.dll

did it help?

- Collapse -

That line [RESTORE\S-1-2-5-XXXXXXXXXX}

by DCL3-22522136767888884502658755989879 Sep 19, 2008 7:34AM PDT

Is System Restore. You will have to go into Control Panel, System Restore to turn it off and that is in your WINXP. I have the home edition of WINXP. After running your scans, you can turn it on and if you have Ad-Aware 2008, then you can set a Restore Point from that. Darrell

- Collapse -

That is not the REAL RESTORE location

by normandy36 Sep 20, 2008 8:30AM PDT

The xp restore location is in the system volume information folder..
winme has a _restore folder. my restore is off. I did however manage to block execution of it by deleting the files and adding folders named lovely.exe, bob.exe, sys32.exe then adding folders under them and adding a S H R text file in each folder.

Now when I start the C:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013 opens and shows the folders that I created and it can no longer re-create the file lovely.exe in there.

It also no longer attempts to contact virus.dnld.ws

I still have the puzzle of how it got there in the first place and what exactly causes the execution of that location (that now just opens the folder).

Thank you for any help.

I know that this can't just be happening to me.

- Collapse -

I have the same problem!

by colinger2008 Nov 18, 2008 11:02AM PST

Please forgive me as I am a rookie. I have Avanquest Fix-It Utitlities 8 that has created checkpoints. If I go back to an earlier checkpoint prior to receiving this bob.exe, will this eliminate the problem?
I'm not computer savy enough to follow your steps and creating that file you mentioned as I don't understand it.
Please any help is appreciated.

- Collapse -

MBAM also takes you to the exact locaton of the file

by dawillie Sep 21, 2008 6:57AM PDT

I forget the name of the tab but is available after scan is complete.

I clicked on it, identified the file, right clicked on it> properties> verified that is was the file in question, then right clicked on it and 'erased' it using my Eraser v 5.6.

Option 2 was to use 'move on boot' but luckily Eraser did the trick.

Hope this helps.

- Collapse -

Something important to consider...

by Carol~ Sep 19, 2008 11:38AM PDT

normanday..

I see someone has suggested you run a HJT log, at the other forum you posted at this morning. Should you choose to send him your log via private message, as he also suggested/offered, I would sincerely hope you make sure he's trained and qualified to analyze HJT logs. And not only HJT, but other tools which may be necessary, to insure that you are completely clean. Only as an example, scroll down this page to where you see the two "Win32:Agent-XKO" entries highlighted in yellow, with "Backdoor.Hamweq.B" next to each. If you spend some time on the page, you'll see where one of tools suggested is SDFix . I don't know for a fact, if the SDFix is the proper tool, but I do know putting these tools in the hands of an unqualified person, could cause you more problems then you bargained for.

I may have over-looked it, but I'm unable to find a section of the forum, which is designated for the sole purpose of analyzing HJT logs. There are quite a few forums, which do just that. Day in and day out. You can find some listed here. (We don't analyze them here) I'm not saying he's unqualified, but I do question someone who says he 'repairs an odd PC now and then'. PLEASE be careful, with whatever you should decide to do.

ONLY.. something to consider..
Carol

- Collapse -

next time

by hemidog 990 Sep 22, 2008 5:10AM PDT

if people with virus/spyware would just remenber one thing safety.live.com this is microsoft's online scanner they may let the harmless slide never the serious

- Collapse -

Virus Connecting

by GEO2003 Sep 22, 2008 5:48AM PDT

if your boot sector and registy, and file table have been compromised by the infection propagating to other places on your pc.
When you re-install explorer, the other portions of the file reactivate to have explorer connect again.

If you can find an Antivirus such as AVAST that will let you run a scan at boot time.
It may be able to clean it since it does have a rootkit sinsing utility built in.
You should run your antivirus in safe mode so that files and folders are not locked by windows.

if you are able to clean it which apparently you have a really bad infection, then great.

if not because it is well hidden and already change its name several times to confuse antivirus you may end up having to format and reinstall your operating system.

Sorry body, sometimes everything fails and that's the only choice.

if you get to this point remember to do a full formatting not a quick format.

Then change to AVAST HOME FREE EDITION as it is a very capable free Antivirus/Antispyware/Antirootkit application.

all you need to do is register with your email address to get your key and to renew it yearly.

It is a well written application for xp and vista and does an excellent job.

Bottom line is that you have to realize that what you have right now fail you if you got infected so seriously.

it is time for a change, i 100 percent recomend avast.

Geo

- Collapse -

bob.exe

by DandyPR Oct 6, 2008 12:52PM PDT

The steps i take to eliminate this virus was

1. Boot the system with Linux (Ubuntu)
2. Eliminate the directory c:\restore\bla bla bla..........
3. Clean my Mass Storage device the same way
4. Reboot the system
5. Erase every record in the register where bob.exe exist.

Dont even try erasing it in Safe Mode, it can be erase with windows.

- Collapse -

undeletable Restore folder on C: & USB

by wickhead75 Oct 19, 2008 2:44PM PDT

I think I have encounter the same problem. I found a hidden folder on c: named RESTORE and on my usb flash drive an autorun.inf file and a copy of the same RESTORE folder. Whenever i delete both files on my USB,it keeps coming back after i click refresh. I use an updated Avira Antivirus,an updated Malwarebytes,I use Hijack,and also tried Smart virus remover but no virus or malwares found or detected. I try to put my flash drive on other pc and the same thing happens,it created automatically a folder on c: named RESTORE. I open the autorun file at it shows me this:
[autorun]
open=RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\bob.exe
icon=%SystemRoot%\system32\SHELL32.dll,4
action=Open folder to view files
shell\open=Open
shell\open\command=RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\bob.exe
shell\open\default=1

I also do search for a bob.exe on my computer but no trace of that file was found.I also try turning off system restore on windows but it didn't fix my problem.

HOW I FIX IT?
Everytime I encounter problems with malwares,spywares & viruses, my last resort is to use my Bart PE bootable disc. Again using this bootable windows bartpe disc i fix my problem.This is how to do it:
(Note:insert your nfected flash drive before doing this)
1.Insert Bart PE Disc.Reboot your system and configure your CMOS setup boot priority to first boot on CD/DVD drive.
2.You will see BartPe will initialize.Click on start menu and select A43 File Managemnt menu.
3.This is similsr to my computer or windows explorer.just open c: and delete RESTORE folder on C:.Open your usb drive and delete both autorun.inf and folder RESTORE.
4.Your done!!! goodbye to autorun.inf and RESTORE folder.

Hope this helps....
Anyway this is the link for bartpe,so you can make one and use http://www.nu2.nu/pebuilder/#download

CNET Forums

Other Forums

Forum Info