Printable View
Does anybody know how to fix this problem. I have been searching this site and have found a few threads, but no real solution to it.
Everytime I reboot, my dial-up connection pops up and Norton Firewall says that explorer.exe is trying to connect to the internet. If I cancel the dial-up it keeps popping up. I have had to select "Never Dial A Connection" in the properties. This is a real pain 'cause I have to manually start my dialup when I want to go on the internet.
Please help.
Hi jordanf1 - well, yes with Zone Alarm but your question is a first with Norton.
If you feel comfortable working in the Registry, try this. Go to Start > Run and type regedit. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ and look for an existing Value, called "BrowseNewProcess". The Value Data needs to be set to "Yes".
If "BrowseNewProcess" does not exist, you will need to create it (see below).
Registry Settings
User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess]
Value Name: BrowseNewProcess
Data Type: REG_SZ (String Value)
Value Data: Yes
Exit the Registry and reboot. Dont forget to back up your Registry before making any changes. Hope this helps. Cheers AM
I looked in the registry and the value "BrowseNewProcess" is there and the data says "yes".
I only installed Norton yesterday, but have been having the connect pop-up problem since last week.
Any suggestions?
Ummmm....I'm a little confused now.
If you only installed Norton yesterday, what was telling you that "explorer.exe is trying to connect to the internet"?Quote:
Everytime I reboot, my dial-up connection pops up and Norton Firewall says that explorer.exe is trying to connect to the internet.
Sorry, I should've explained it better.
Last week my dial-up connection starts popping up everytime I reboot my computer and windows has loaded. When I press cancel it pops up again and again. I had no idea at the time what was causing this.
Yesterday, when I installed Norton, I got the message about windows explorer, so I am assuming that this is the cause of the above problem.
Well, that puts a slightly different aspect on your problem. I dont know what OS you have but I think it would be a good idea to look at your startups. Go to Start > Run and type
msinfo32
On the left side, select software environment and then Startup Programs.
Then go to Edit > Select All
And then Edit > Copy
Then paste the list back into this thread.
My OS is Windows ME. Here is the info as requested:
*StateMgr c:\windows\system\restore\statemgr.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
AVG_CC c:\progra~1\grisoft\avg6\avgcc32.exe /startup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Avgserv9.exe c:\progra~1\grisoft\avg6\avgserv9.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
KERNEL32 kernel32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KERNEL32 kernel32.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile rundll32.exe powrprof.dll,loadcurrentpwrscheme All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadQM loadqm.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Office c:\progra~1\micros~3\office\osa9.exe -b -l .DEFAULT Startup
PCHealth c:\windows\pchealth\support\pchschd.exe -s All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ScanRegistry c:\windows\scanregw.exe /autorun All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SiS KHooker c:\program files\sis630_v1.05\utility\3d\khooker.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SiS Tray All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SSDPSRV c:\windows\system\ssdpsrv.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SystemTray systray.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tweak UI rundll32.exe tweakui.cpl,tweakmeup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VidSvr All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
I'm afraid the news is not good jordanf1. You have kernel32.exe in your startups and kernel32.exe is not a Microsoft file. The Microsoft file is kernel32.dll
KERNEL32 kernel32.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run
KERNEL32 kernel32.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersi
on\RunServices
You may have Badtrans (see if this rings any bells) or there are a couple of backdoor trojans that also load this file. I cannot see your Norton firewall loading either (I presume that you have it configured to load at Startup). It is possible that AVG and your firewall have been disabled, depending on what infection you have. Go here and run the free online scan then report back. We need to know what virus you have before going any further.
I see that VidSvr is also loading. Are you running and using a WebTV application?
I did the online scan which came up with TROJ_CYBERJACK.A as soon as I pressed scan. The scanner did not pick up any viruses in any files. I find it weird that AVG did not pick this up. I got an update today and did a scan.
I have Norton set to run at system startup.
Web TV was installed with Windows, but I am not using it.
Thank you so much for helping me.
If possible, when I get rid of the virus I would like to deselect some of those startup items using msconfig. I am not too sure which ones though, if you could let me know I would appreciate it.
Hi jordanf1 - most AV's are not very good at picking up trojans however this one is not destructive so all we have to do is get rid of it. BTW It has been renamed BKDR_CYBERJACK.A. As you are running WinMe, you will have to disable your System Restore first otherwise, down the track you could restore it. Instructions here
Firstly, go to Start > Search/Find and search for all instances of kernel32.exe. When you find the file/s delete them. Also look for files named BKDR_CYBERJACK.A*.* If you find any delete them.
Back up your Registry first - instructions here. OK now run regedit and drill down to:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run
If there is any reference to kernel32.exe after the Run, delete it (just the kernel.32.exe)
Do the same with:
HKLM\Software\Microsoft\Windows\CurrentVersi
on\RunServices
Also run a search in the Registry for BKDR_CYBERJACK.A and if you find any references remove them.
OK.. when you have done that, go back to HouseCall and see if you are now clean.
I'm off to bed now but I will check back in the morning. if you are not sure about anything in the Registry, leave it and post what you see and I will advise you tomorrow.
I'm happy to help and look at your startups for you once we get rid of this trojan. See you tomorrow :)
Jordan, I just found an example of what the registry key will look like - see below:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run = “KERNEL32”
This is what you delete = “KERNEL32”
That same in:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunServices
ok thanks, just doing it all now. I'll let you know how it goes.
:D The Trojan is dead!
Didn't find any files to delete when I searched, only the windows kernel32.dll and another one called kernel32.000. Have deleted registry entries, except one that I wasn't sure:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU Name = 002 Data = kernel32.*
The above was right next to kernel32.exe and BKDR_CYBERJACK.A references. Should I delete this one too?
Anyway, I did the online virus scan which didn't pick up anything. I rebooted and my dial-up connection is ok now. But I am still getting the alert from Norton about explorer.exe?????
Also, while searching the registry, I stumbled across this entry in the run- key:
"C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.mp3dancer.com!StatsMP3Dancer
What is this, and can I remove it?
Thanks again for your help, I can breathe a sigh of relief now. Please let me know if there is anything else I need to do or if you can help with the explorer.exe thing.
Cheers
Jordanf1
Jordan Clink on my link below and read my article I have referenced a product called
pest patrol
which will help you remove that Backdoor Trojan.
Dont delete upd.exe reference until you sure about what it is.
Ian
Hi again Jordon - great news!
OK - kernel32.dll is a valid windows file and should be on your system.
kernel32.000 is kernel32.exe however it has been renamed by HouseCall and is now harmless, you may delete it if you wish.
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU Name = 002 Data = kernel32.*
This is where your search history (MRU = most recently used) is stored in the registry - nothing to worry about.
You are now trojan free - yes! :)
Re: "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.mp3dancer.com!StatsMP3Dancer
It looks like you also have some spyware on your PC. Have you downloaded and installed this program from Totem? MP3 Dancer.
It might be a good idea to run AdAware and check your PC for Spyware. There is every possibility that this type of crud could be causing the explorer issue. Go here, download and install AdAware and RefUpdate. Make sure that you read all the instructions first. You should know however, that some programs that are riddled with Spyware will either be removed from your system or will not function afterwards. The most notorious being Gator and KaZaa (if you are running KaZaa, there are spyware free alternatives, just let me know and I'll post them). Make sure that you configure AdAware to make a backup. While you are doing this, I will have a look at your startups and post back.
*StateMgr c:\windows\system\restore\statemgr.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Needed - required for Restore functionality
AVG_CC c:\progra~1\grisoft\avg6\avgcc32.exe /startup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Needed - this is your AV
Avgserv9.exe c:\progra~1\grisoft\avg6\avgserv9.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
As above
LoadPowerProfile rundll32.exe powrprof.dll,loadcurrentpwrscheme All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
This is required if you are using Power Management (accessed through Start|Settings|Control Panel|Power).
LoadQM loadqm.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run
Not needed - Loads the MSN Explorer Query Manager
Microsoft Office c:\progra~1\micros~3\office\osa9.exe -b -l .DEFAULT Startup
Optional - this a utility for Microsoft Office (Some users report that unchecking this item can cause difficulty. Bear this in mind if you uncheck it and performance is degraded)
PCHealth c:\windows\pchealth\support\pchschd.exe -s All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Needed - required for Restore functionality
ScanRegistry c:\windows\scanregw.exe /autorun All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Needed - scans your Registry at StartUp and makes backups.
SiS KHooker c:\program files\sis630_v1.05\utility\3d\khooker.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Probably not needed - SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of SiS VGA cards. I have heard that it can contribute to StartUp problems.
SiS Tray All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
As above
SSDPSRV c:\windows\system\ssdpsrv.exe All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Depends - This file is part of Windows Millennium Edition but is not installed by default. This program only gets installed if you choose to install the "Universal Plug and Play" sub-component of the Communications component in "Add/Remove Programs \ Windows Setup" however some manufacturers pre-install it. It is subject to a security vulnerability - see here andhere unless you have installed the patch. My recommendation is that if you are using standard Plug and Play devices, you do not need this program. You can de-install it by un-selecting "Universal Plug and Play" in "Add/Remove Programs \ Windows Setup tab \ Communications".
SystemTray systray.exe All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Needed - This program runs the Windows System Tray, which is that part of the Task Bar where the time is displayed.
Tweak UI rundll32.exe tweakui.cpl,tweakmeup All Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Needed - Some users will need to have this loaded at startup to enable some of its options.
VidSvr All Users HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Not required - Web TV channel guide
BTW I remember that I didnt see your firewall loading. Double check and make sure that its checked in your StartUps.
Hi there.
I ran ad-aware which removed heaps of spyware, but it didn't pick up anything relating to MP3 Dancer. I uninstalled that program ages ago. Do you think it's ok to remove that registry entry and the files in the totem shared dir?
I have also uninstalled Kazaa. I would appreciate if you could let me know of an alternative. I have previously tried Morpheus and WinMX. Morpheus isn't very good since it changed and I didn't like WinMX very much.
I uninstalled Web TV and the Plug and Play, rebooted and didn't get the explorer.exe alert. Yaaay!!!
I changed my startup which now runs the following:
*StateMgr
AVG_CC
Avgserv9.exe
LoadPowerProfile
Microsoft Office
PCHealth
ScanRegistry
SystemTray
TaskMonitor
Tweak UI
Do I need the TaskMonitor one? I also unchecked one called bpcpost.exe in c:\windows\system. Not sure what that one is.
Norton isn't showing up in the startup and I double-checked that the "Run at System Startup" is enabled in the options menu. It loads up when I reboot and is sitting in the system tray.
Will hear from you later.
Hi Jordan - well, we are nearly there :)
Yes - go ahead and remove the registy entry and files associated with MP3 Dancer - I would bet my bottom dollar that its spyware. Unfortunately, AdAware cannot pick up everything but it does a terrific job for a freebie.
Here is a spyware free alternative to KaZaa - KaZaa Lite. There are a couple of things that you have to do after you install it though. Firstly, it downloads a dummy copy of cydoor, a file named cd_clint.dll so when you run AdAware again, you have to configure it to ignore this file. Secondly, go to C:\Windows and find your hosts file (not hosts.sam just hosts). Open it with Notepad or Wordpad and copy the below information into it.
127.0.0.1 wwww.brilliantdigital.com
127.0.0.1 desktop.kazaa.com
127.0.0.1 shop.kazaa.com
127.0.0.1 wwww.bonzi.com
127.0.0.1 wwww.b3d.com
it should now look something like this:
127.0.0.1 localhost
127.0.0.1 wwww.brilliantdigital.com
127.0.0.1 desktop.kazaa.com
127.0.0.1 shop.kazaa.com
127.0.0.1 wwww.bonzi.com
127.0.0.1 wwww.b3d.com
.*EDIT* this darn board automatically turned everything with www in front of it into a link so I have added an extra w - you will have to remove it. I really dont want people accidentally clicking on those links.
There may also be other entries in there depending on your restricted site settings in IE.
This last part is known as the "Super Trick". Be sure to do this before you start KaZaa Lite. Also, as with any download, scan it for viruses before you install it.
Last but not least - you dont need Task Monitor in your Startups.
BTW - nearly forgot about Norton, as long as its showing in your system tray and it is alerting you, its OK. Its probably running either in running tasks or services
Hi AnnMarie,
Thanks for all your help, I really appreciate everything you've done for me. I feel a lot better now, knowing my computer is ok, and I bet it does too!!:)
It was my pleasure Jordan - just dont forget to run scandisk and defrag after getting rid of all that junk :D