Printable View
Does anybody know how to fix this problem. I have been searching this site and have found a few threads, but no real solution to it.
Everytime I reboot, my dial-up connection pops up and Norton Firewall says that explorer.exe is trying to connect to the internet. If I cancel the dial-up it keeps popping up. I have had to select "Never Dial A Connection" in the properties. This is a real pain 'cause I have to manually start my dialup when I want to go on the internet.
Please help.
Hi jordanf1 - well, yes with Zone Alarm but your question is a first with Norton.
If you feel comfortable working in the Registry, try this. Go to Start > Run and type regedit. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ and look for an existing Value, called "BrowseNewProcess". The Value Data needs to be set to "Yes".
If "BrowseNewProcess" does not exist, you will need to create it (see below).
Registry Settings
User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess]
Value Name: BrowseNewProcess
Data Type: REG_SZ (String Value)
Value Data: Yes
Exit the Registry and reboot. Dont forget to back up your Registry before making any changes. Hope this helps. Cheers AM
I looked in the registry and the value "BrowseNewProcess" is there and the data says "yes".
I only installed Norton yesterday, but have been having the connect pop-up problem since last week.
Any suggestions?
Ummmm....I'm a little confused now.
If you only installed Norton yesterday, what was telling you that "explorer.exe is trying to connect to the internet"?Quote:
Everytime I reboot, my dial-up connection pops up and Norton Firewall says that explorer.exe is trying to connect to the internet.
Sorry, I should've explained it better.
Last week my dial-up connection starts popping up everytime I reboot my computer and windows has loaded. When I press cancel it pops up again and again. I had no idea at the time what was causing this.
Yesterday, when I installed Norton, I got the message about windows explorer, so I am assuming that this is the cause of the above problem.
Well, that puts a slightly different aspect on your problem. I dont know what OS you have but I think it would be a good idea to look at your startups. Go to Start > Run and type
msinfo32
On the left side, select software environment and then Startup Programs.
Then go to Edit > Select All
And then Edit > Copy
Then paste the list back into this thread.
My OS is Windows ME. Here is the info as requested:
*StateMgr c:\windows\system\restore\statemgr.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
AVG_CC c:\progra~1\grisoft\avg6\avgcc32.exe /startup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Avgserv9.exe c:\progra~1\grisoft\avg6\avgserv9.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
KERNEL32 kernel32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KERNEL32 kernel32.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile rundll32.exe powrprof.dll,loadcurrentpwrscheme All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadQM loadqm.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Office c:\progra~1\micros~3\office\osa9.exe -b -l .DEFAULT Startup
PCHealth c:\windows\pchealth\support\pchschd.exe -s All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ScanRegistry c:\windows\scanregw.exe /autorun All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SiS KHooker c:\program files\sis630_v1.05\utility\3d\khooker.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SiS Tray All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SSDPSRV c:\windows\system\ssdpsrv.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SystemTray systray.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tweak UI rundll32.exe tweakui.cpl,tweakmeup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VidSvr All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
I'm afraid the news is not good jordanf1. You have kernel32.exe in your startups and kernel32.exe is not a Microsoft file. The Microsoft file is kernel32.dll
KERNEL32 kernel32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run
KERNEL32 kernel32.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersi
on\RunServices
You may have Badtrans (see if this rings any bells) or there are a couple of backdoor trojans that also load this file. I cannot see your Norton firewall loading either (I presume that you have it configured to load at Startup). It is possible that AVG and your firewall have been disabled, depending on what infection you have. Go here and run the free online scan then report back. We need to know what virus you have before going any further.
I see that VidSvr is also loading. Are you running and using a WebTV application?
I did the online scan which came up with TROJ_CYBERJACK.A as soon as I pressed scan. The scanner did not pick up any viruses in any files. I find it weird that AVG did not pick this up. I got an update today and did a scan.
I have Norton set to run at system startup.
Web TV was installed with Windows, but I am not using it.
Thank you so much for helping me.
If possible, when I get rid of the virus I would like to deselect some of those startup items using msconfig. I am not too sure which ones though, if you could let me know I would appreciate it.
Hi jordanf1 - most AV's are not very good at picking up trojans however this one is not destructive so all we have to do is get rid of it. BTW It has been renamed BKDR_CYBERJACK.A. As you are running WinMe, you will have to disable your System Restore first otherwise, down the track you could restore it. Instructions here
Firstly, go to Start > Search/Find and search for all instances of kernel32.exe. When you find the file/s delete them. Also look for files named BKDR_CYBERJACK.A*.* If you find any delete them.
Back up your Registry first - instructions here. OK now run regedit and drill down to:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run
If there is any reference to kernel32.exe after the Run, delete it (just the kernel.32.exe)
Do the same with:
HKLM\Software\Microsoft\Windows\CurrentVersi
on\RunServices
Also run a search in the Registry for BKDR_CYBERJACK.A and if you find any references remove them.
OK.. when you have done that, go back to HouseCall and see if you are now clean.
I'm off to bed now but I will check back in the morning. if you are not sure about anything in the Registry, leave it and post what you see and I will advise you tomorrow.
I'm happy to help and look at your startups for you once we get rid of this trojan. See you tomorrow :)
Jordan, I just found an example of what the registry key will look like - see below:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run = “KERNEL32”
This is what you delete = “KERNEL32”
That same in:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices
ok thanks, just doing it all now. I'll let you know how it goes.
:D The Trojan is dead!
Didn't find any files to delete when I searched, only the windows kernel32.dll and another one called kernel32.000. Have deleted registry entries, except one that I wasn't sure:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU Name = 002 Data = kernel32.*
The above was right next to kernel32.exe and BKDR_CYBERJACK.A references. Should I delete this one too?
Anyway, I did the online virus scan which didn't pick up anything. I rebooted and my dial-up connection is ok now. But I am still getting the alert from Norton about explorer.exe?????
Also, while searching the registry, I stumbled across this entry in the run- key:
"C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.mp3dancer.com!StatsMP3Dancer
What is this, and can I remove it?
Thanks again for your help, I can breathe a sigh of relief now. Please let me know if there is anything else I need to do or if you can help with the explorer.exe thing.
Cheers
Jordanf1
Jordan Clink on my link below and read my article I have referenced a product called
pest patrol
which will help you remove that Backdoor Trojan.
Dont delete upd.exe reference until you sure about what it is.
Ian
Hi again Jordon - great news!
OK - kernel32.dll is a valid windows file and should be on your system.
kernel32.000 is kernel32.exe however it has been renamed by HouseCall and is now harmless, you may delete it if you wish.
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU Name = 002 Data = kernel32.*
This is where your search history (MRU = most recently used) is stored in the registry - nothing to worry about.
You are now trojan free - yes! :)
Re: "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.mp3dancer.com!StatsMP3Dancer
It looks like you also have some spyware on your PC. Have you downloaded and installed this program from Totem? MP3 Dancer.
It might be a good idea to run AdAware and check your PC for Spyware. There is every possibility that this type of crud could be causing the explorer issue. Go here, download and install AdAware and RefUpdate. Make sure that you read all the instructions first. You should know however, that some programs that are riddled with Spyware will either be removed from your system or will not function afterwards. The most notorious being Gator and KaZaa (if you are running KaZaa, there are spyware free alternatives, just let me know and I'll post them). Make sure that you configure AdAware to make a backup. While you are doing this, I will have a look at your startups and post back.