W2K: Hidden "Explorer.exe" file ... do I have a virus???

[gsaldivar]

Yesterday I kept getting strange "C++ Runtime" errors occuring in "explorer.exe", immediately after booting my computer and opening up Internet Explorer.

I checked on my computer, and guess what... there is a hidden 32k Explorer.exe file located at: C:\WINNT\explorer\Explorer.exe.

WTF??

I ran a full system scan with Norton Antivirus (latest definitions as of 12/19) and it didn't find anything.

Do I have some kind of a worm or virus?

 

[Slatz]

"C:\WINNT\explorer\Explorer.exe. "

I didn't even know that folder existed let alone the file that goes with it. No where to be found on any of my systems. Certainly a strange one.

 

[jbod]

I believe I read somewhere that this is a virus.

I can't find it on my system either.

I also can't find it on the Antivirus sites. But I am almost positive it is a virus.

Peace!

 

[Dunbar]

Open up the task manager and look at the processes. There should be a IEXPLORER.exe and explorer.exe running (with a browswer open,) I believe the virus replaces the lower case "L" in explorer.exe with a lower case "I." So there would be two explorer.exe's running but the virus would have the "I" where the "L" is.

 

[Ark]

I think one of Backdoor.subseven viruses creates similar folder and replaces Explorer.EXE and iexplore.exe

 

[MrWhiteUK]

This is going round several forums at the mo, a lot of people beleive it's from Download.com (program called limeware?) Do a search over at the arstechnica.com NT forum.

 

[CTho9305]

http://www.europe.f-secure.com/v-descs/dlder.shtml

 

[Ark]

Norton Antivirus added this virus only last night. Get Dec. 29 definition.


<< Norton AntiVirus Defs created December 29 and released December 29
Norton AntiVirus Corp. Edition Defs Version: 31229b
Norton AntiVirus Corp. Edition Sequence Number: 14138
Total Viruses Detected: 58387

New viruses added for this release:
W32.DlDer.Trojan Category 1
W32.Gizer@mm Category 1
W32.Maldal.D@mm
W95.Axiety.2471 Category 1
W97M.Yapp Category 1
X97M.Laroux.gen Category 1
>>

 

[Dreadogg]

I was infected Norton quaritined it though. should I take anymore percautions?

 

[gsaldivar]

I've started a new thread for this issue.

Please post in the new thread instead of this one.

 

[Ark]

Maybe it should go to general hardware for better exposure.