About 30 minutes ago, after installing some Windows Updates (no critical ones, just Direct X, Media Player 9) and Winamp 5 (along with visualization plug-ins for it that I downloaded off of winamp.com), I got a a message from Kerio Personal Firewall saying "Replacing Application: Windows Explorer, Permit or Deny". This was at the XP log-on screen.

Immediately I thought it might be a Trojan, so I hit Deny, but then Windows wouldn't load, it would only show my desktop background.

So I rebooted and hit Permit, everything loaded and I logged on here.

Does anyone know what could have caused this?

I'm running The Cleaner right now to look for Trojans.

Just out of curiosity, how come it shows up as my real name (Tim Kendall) instead of my user/log-in name Mystik_TK?

Sounds like Kerio just doing it's job .

It realised changes had been made to your program & was asking you if this was so/ok .

Yeah, but I'm wondering why Explorer was being replaced in the first place.

I'm also a bit concerned about it showing my real name in the first post instead of Mystik_TK. Could that be hacker-related?

Run a virus check from 1 or all of these .
Online Virus check ( free )

http://www3.ca.com/virusinfo/virusscan.aspx

http://housecall.antivirus.com/
http://www.coledata.com/virusalert.htm
http://www.cybertechhelp.com/html/misc/av.php
http://www.pandasoftware.es/activescan/activescan-com.asp
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/
http://www.stop-sign.com/

(stops laughing)

Yes, remember Windows Media Player is part of XP, it's not some software you just install and remove. It's integral, so yes windows exploerer may have had some core files changed (like being able to play media from the search bar...) as a result.

Since you fixed it, great don't break it again. As for your name, well I think you probably just misconfigured something.

I really can't see anyone hacker or otherwise simply changing your name on a forum...but then I could be wrong.

J.
j e r u v y a t y a h o o d o t c o m

I've already run a scan with NAV and The Cleaner. Zip. Same goes for Spybot.

I figured as much as far as WMP goes.

Makes sense as in previous formats, I installed all of my Updates before installing my firewall.

As for my name changing, I didn't configure anything at all, so that still baffles me and if an admin or anyone else has an explanation, please let me know. I have Obsessive Compulsive Disorder, so I'm always worrying and paranoid like this. LOL.

PS: No need to laugh, we all make mistakes. Lol.

Kerio is very good at recognising any changes to programs that wish for an outgoing connection etc. Because there was a change made (WMP) it asked you if this was really the program making the request or if it was something else. As stated previously Kerio was just doing its job.
BTW Explorer wasn't replaced but just changed.

D4

YES! Replace it, that is replace IE. See
http://www.tbtf.com/resource/ie4-virus.html