explorer.exe not executing

Please help!

This is another abnormal functioning in a series of others.

Today when i booted my PC, the Welcome screen took a little longer to disappear and then, on the desktop there was nothing, absolutely nothing.

I'm using WinXP SP2, its never happened before.

I opened msconfig, to see two new processes,
process command
1) owjokuch rundll32.exe "C:\WINDOWS\system32\owjokuch.dll",s
2) wmjgenhj rundll32.exe "C:\WINDOWS\system32\wmjgenhj.dll",b

i disabled them, and after rebooting, i got the same problem.

Then, i tried starting the explorer.exe from the task manager. It starts, only to get terminated automatically.

HOW??

Now, I see that even the folders or drives are not opening in GUI.

I can access them on DOS only.

Hmmmm,

I would say that you have polymorphic malware onboard.

Try booting into safe mode and running the latest version of your anti-malware applications. Make a note of what they detect, we might need that information later;)

I would strongly recommend saving any personal data files to external media at this stage.

Try logging on in "safe mode with network support" and running the PC-Cillin and Panda online checks.

Good Luck!

:)

Remember: You will need to disable the saved configurations first, then make a manual one when you have cleaned your PC.

I think that you got some work in you computer that infected most of files.
Burn som antivirus on the CD and run it from it.
sophos has "sav32cli" that you can put on CD
http://www.sophos.com/support/knowle...cle/13251.html
and Dr.Web has CureIt
http://freedrweb.com/cureit/ -

Use other computer to download and burn files on CD.

thanx!

But, my novice bro called up someone, who took 200/- to reinstall the OS!!

So, lets forget that and carry on...

That was probably the best solution.

It sounds rather like vundo/virtumonde as this trojan goes for explorer.exe and uses random filenames.

I would hazard a guess that it is either a badly coded variant or a screwed up installation. The reason I say that is the usual function of that family of malware is to serve up adware. Obviously it cannot do that if you can't get your PC to work properly.

:)

You need to ask yourself how you got it, as it certainly did not blow in with the wind............. it is a classic trojan for the most part.

I don't know how it came, I was just doing my stuff... And the system hanged for some time, and then it happened.

I think its like some time bomb.

It was a dll which used rundll32.exe to execute.

I must have downloaded some software which activated them..

Well,

If you have software you saved from the system or anything you downloaded onto external media I would scan it very carefully before trying to use it, or you will just go back to square 1.

if it ever happens again and you don't have a desktop or it errors on boot (including safemode) try combofix

http://www.bleepingcomputer.com/comb...o-use-combofix

just tested it on a customers computer 3 seconds ago ;)

Quote:

---

Originally Posted by ech0

if it ever happens again and you don't have a desktop or it errors on boot (including safemode) try combofix

http://www.bleepingcomputer.com/comb...o-use-combofix

just tested it on a customers computer 3 seconds ago ;)

---

thanx! :eek:

Trend Micro, McAfee, and FProt all have command-line scanners that are on multiple boot CD's (illegally) free for downloading and burning. All that's necessary is checking to see if they have current definitions loaded.* If you run them in a physical environment prior to booting into Windows, you can run all 3 simultaneously with no issues.

* if definitions are not up to date, I believe you can download the references from the respective sites for free and swap out the files on the image using UltraISO or the like.

The reason that you failed to remove them from msconfig is probably that those two processes are still running while you do that; and they replace that startup registries immediately when you disable it.

All you need to do is restart in safemode and use msconfig to remove the startup process :
1) owjokuch rundll32.exe "C:\WINDOWS\system32\owjokuch.dll",s
2) wmjgenhj rundll32.exe "C:\WINDOWS\system32\wmjgenhj.dll",b
after that, reboot and they should be gone. Next, do a antivirus scan on your pc or manually delete those two files.

Hope it helps.

I've had the same problems at several of our remote sites. You won't be able to disable them from startup and you can't remove them in safemode. The problem is that it's set to run at startup and then it hooks explorer.exe and lsass.exe. When one process is killed, the other memory resident copies replace it. Here's the easiest way I found to kill it:

-download IceSword from http://www.antirootkit.com/software/IceSword.htm
-using the IceSword file browser, locate those dll files in the sys32 folder
-right-click the dll file and use the "force delete" option. You will most likely have lots of similarly named dll files from approximately the same date range. Study these closely and delete any of them that are malware
-reboot. You will get some "file not found" errors since these dll files are still in startup
-disable these files from startup and reboot again
-profit?

alternatively if you are able to scan please use an onlien scanning tool from trend or panda

www.activescan.com

:) :) in safe mode you can do it

Upstairs of CIder , the antivirus software which you interoduced is free??

Yes the online scan will let you know if you are infected and where.

PM me if you need a trial to disinfect.