Computing.Net > Forums > Windows XP > Very Annoying Possible Virus Proble

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Very Annoying Possible Virus Proble

Reply to Message Icon

Name: bgreman
Date: June 3, 2003 at 12:03:26 Pacific
OS: Win XP Home 2002
CPU/Ram: PIV 1.59 Ghz, 512 MB RAM
Comment:

I've got an issue with my computer.

WHat happened is I started my computer up one day, and after selecting a logon, the normal startup went through, and then all of a sudden, the desktop icons and taskbar disappeared, leaving only a screen with my desktop background image (similar to when Explorer crashes). I was able to bring up the Task Manager, but it only stays up for about 30 seconds before closing itself. I restarted the computer, and this time ran the task manager as soon as I was logged on to see if perhaps a startup program was to blame. Indeed, I found a program entitled xbind.exe was running, which then caused a series of other programs to run, namely temp.exe and several programs with names of the form ~D(letter)(2-digit number).exe . THe xbind program itself was easy enough to find, as it was sitting right at the bottom of c:\ . IT proved much more difficult to remove however, as every time I deleted it, it magically reappeared in c:\ .

To make matters worse, there is other behavior present:

Behaviors:

DOS programs (and command.exe) close themselves after about 30 seconds. Cmd.exe is not subject to this self-closure.
The Task Manager closes itself after about 30 seconds.
Anti-viral programs close themselves after running for about 30 seconds.
Any browser window concerning an anti-virus closes itself after about 30 seconds.

Oddly enough, yesterday I deleted the xbind.exe program and it DIDN'T recreate itself. However, the above mentioned behavior still exists.

There was also one time when I did manage to run both the free online mcafee scan that came with my computer and the Grisoft AVG antivirus program I downloaded. NEither detected a virus. Neither did the Panda ActiveScan.

Sometimes, when the desktop and taskbar are gone, and I try to run C:\ from the New Task option of the Task Manager, the desktop and taskbar restore themselves after an error message which I neglected to write down.

This problem seems to be only an annoyance at this point, but it is frustrating that I cannot run the dos programs.

Any help would be greatly appreciated.

BTW, the icon for the xbind.exe program appeared to be a little hatted man holding a whip and standing next to a chair. Thank you.




Sponsored Link
Ads by Google

Response Number 1
Name: ok
Date: June 3, 2003 at 12:51:31 Pacific
Reply:

temp.exe
Remote Access / Destructive trojan / Virus dropper It copies itself to c:\recycled to avoid detection by some antivirus programs.
-Try trojan remover free thirty day trial,
from http://www.simplysup.com


0

Response Number 2
Name: Travis
Date: June 3, 2003 at 21:28:15 Pacific
Reply:

Hi all.

Ive been battling with this problem myself for a while as well. Ive learned some things that I wanted to share. Strangely, I found some virused files, too (vbs files), but they did not recreate themselves, and the problems persisted, just as in your case.

The symptoms are: No icons, no taskbar, no right-clicking the desktop, must use Task Manager to navigate, explorer.exe not working

Possibly unrelated issue: realsched.exe and iexplore.exe hogging CPU (%100)

I dont have the solution, but I have some workarounds which may help the more savvy visitors to reach the solution. They may also save your sanity till a cure is found.

CLUE 1:
I believe this is a virus or small malicious code. I discovered that reinstalling my NVIDIA graphic drivers corrected the problem on the next reboot EVERY TIME. I keep a fresh copy in my desktop folder. My graphics drivers are a pretty hefty file (18.4Mb), so an array of .dlls are refreshed by this action.

CLUE 2:
When the computer reboots after the drivers are installed, the computer is error-free, however, I notice a program running at startup. Sometimes I catch it and halt it. It is called "keyboard hotkey" or mhotkey.exe in taskman. I think this is the offending program, but Im not sure. This was my workaround for a few days. YMMV.

CLUE 3:
When the desktop icons and taskbar are missing again, I noticed a faster workaround. From this fresh boot, I access the taskmanager and end the explorer.exe process. I force it again, by clicking on New(Run) and typing C: >Enter. Presto! My stuff returns! (I also neglected to write the error message that caused me to take action on my running explorer.exe.)

Someone try these workarounds and let me know if it helps! Can someone diagnose the problem for me? I'd like to quit dealing with it.

-Travis


0

Response Number 3
Name: Travis
Date: June 3, 2003 at 21:51:10 Pacific
Reply:

I forgot to mention:
All instances of explorer.exe show as being created in 2002. However, a file named EXPLORER.EXE-082F38A9.pf in the \Windows\Prefetch directory shows as being created at my last reboot.

I have no idea what a prefetch file is. Should I kill that file? Oh well...more research.

-Travis


0

Response Number 4
Name: bgreman
Date: June 7, 2003 at 15:50:04 Pacific
Reply:

FOUND!
the infected file is winjava.exe in the path WINDOWS\Java\apps\
VirScan it and kill it. BANG!


0

Sponsored Link
Ads by Google
Reply to Message Icon

Related Posts

See More







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows XP Forum Home


Sponsored links

Ads by Google


Results for: Very Annoying Possible Virus Proble

VERY Annoying, suspected Virus www.computing.net/answers/windows-xp/very-annoying-suspected-virus/106788.html

Possible Virus? www.computing.net/answers/windows-xp/possible-virus/146609.html

Possible virus www.computing.net/answers/windows-xp/possible-virus/124436.html