Is this a virus? (explorer.exe.tmp)

Discussion in 'Windows 8' started by gonz621, May 12, 2014.

  1. gonz621

    gonz621 MDL Junior Member

    Nov 15, 2012
    85
    11
    0
    #1 gonz621, May 12, 2014
    Last edited: May 12, 2014
    I am just wondering if this file is clean or not.
    t1.JPG t2.JPG t3.JPG
     
  2. s1ave77

    s1ave77 Has left at his own request

    Aug 15, 2012
    16,104
    24,381
    340
    #2 s1ave77, May 12, 2014
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Leslie_Coffelt

    Leslie_Coffelt MDL Member

    Feb 6, 2014
    135
    37
    10
    #3 Leslie_Coffelt, May 12, 2014
  4. eydee

    eydee Guest

    #4 eydee, May 12, 2014
    Too small to be real and has no digital signature. It probably is a virus because why would anyone give such a name to their program and hide it in appdata/roaming out of good intentions...
     
  5. pisthai

    pisthai Imperfect Human

    Jul 29, 2009
    7,221
    2,273
    240
    #5 pisthai, May 12, 2014
    I would suggest to directly delete that file if you didn't have an extra machine (which isn't connected to any network!) for to test or follow at least the advice of s1ave77!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. EFA11

    EFA11 Avatar Guru

    Oct 7, 2010
    8,719
    6,741
    270
    #6 EFA11, May 12, 2014
    I would think its a virus. Heck look at all the blue smuggies in the pictures!
     
  7. gonz621

    gonz621 MDL Junior Member

    Nov 15, 2012
    85
    11
    0
    #7 gonz621, May 12, 2014 (OP)
    So here is the result from virustotal.
    t4.JPG
     
  8. Leslie_Coffelt

    Leslie_Coffelt MDL Member

    Feb 6, 2014
    135
    37
    10
    #8 Leslie_Coffelt, May 12, 2014
    Anyone paranoid enough to state: "This virus is so well constructed that it is undetectable!" ? :)
     
  9. gonz621

    gonz621 MDL Junior Member

    Nov 15, 2012
    85
    11
    0
    #9 gonz621, May 12, 2014 (OP)
    I have installed Unhackme and it detected explorer.exe.tmp as malicious. Deleting it now using unhackme.
    r1.JPG
     
  10. EFA11

    EFA11 Avatar Guru

    Oct 7, 2010
    8,719
    6,741
    270
    #10 EFA11, May 12, 2014
    curious what it did to explorer.exe then, if anything

    should have looked at your picture first. so the explorer.exe.tmp was probably your original exe and the current was infected, hence scanned the wrong file.
     
  11. eydee

    eydee Guest

    #11 eydee, May 12, 2014
    Impossible, explorer.exe is almost 1MB even under windows xp. It contains a lot of bitmaps, and code of course. The file on the pic is 20KB. Also there is no digital signature. It cannot be the original renamed.

    Virustotal probably didn't detect it because it's something new. Antivirus software can only detect what is in its database.
     
  12. gonz621

    gonz621 MDL Junior Member

    Nov 15, 2012
    85
    11
    0
    #12 gonz621, May 12, 2014
    Last edited: May 12, 2014
    (OP)
    Look here I have deleted the file already r2.JPG yet Unhackme still detected it r3.JPG . Seems I can't just get rid of it.
     
  13. Evides

    Evides MDL Member

    Apr 6, 2014
    114
    24
    10
    #13 Evides, May 12, 2014
    Start PC in safe mode and try to remove manually... tried that?
     
  14. Asam

    Asam MDL Novice

    Jan 8, 2014
    2
    0
    0
    #14 Asam, May 12, 2014
    Install Malwarebytes and Make a Full Scan.
    Also Check Your Startup Items and Disable you don't need.
     
  15. gonz621

    gonz621 MDL Junior Member

    Nov 15, 2012
    85
    11
    0
    #15 gonz621, May 12, 2014 (OP)
    Well try on that tomorrow. I have checked my laptop now and there is no explorer.exe.tmp present in the Roaming folder. So the desktop is sure to be infected.
     
  16. Leslie_Coffelt

    Leslie_Coffelt MDL Member

    Feb 6, 2014
    135
    37
    10
    #16 Leslie_Coffelt, May 12, 2014
    Last edited: May 12, 2014
    I have numerous "explorer.exe" - different sizes and locations. The first two listed here are in C:\Windows and C:\Windows\SysWOW64 - how do we know which "explorer.exe" the OP is referring to? (Sorry if I missed it).

    (At least I have no "explorer.exe.tmp" file).
     

    Attached Files:

  17. Evides

    Evides MDL Member

    Apr 6, 2014
    114
    24
    10
    #17 Evides, May 12, 2014
    Last edited: May 12, 2014
    Because it's in his 'C:\users\appdata\roaming' folder..?
    And it's not supposed to be there.
     
  18. murphy78

    murphy78 MDL DISM Enthusiast

    Nov 18, 2012
    7,391
    11,617
    240
    #18 murphy78, May 12, 2014
    It might be a multi-file crypted exe with the tmp just being the injector and another file being a payload.
    If I were you I would definitely backup important files and then start to try to remove it.
     
  19. my2cents

    my2cents Guest

    #19 my2cents, May 12, 2014
    Good luck with your continuing efforts; however, please remember the easiest part is getting rid of the malware but the hardest part (of making your PC whole again) is attempting the subsequent repair of all the damage left behind. From my experience, some of those nasties will literally destroy your registry beyond repair so hope for the best and be prepared for the worst.
     
  20. Ming_the_Merciless

    Ming_the_Merciless MDL Member

    Feb 7, 2014
    138
    49
    10
    #20 Ming_the_Merciless, May 12, 2014
    As a prudent Windows operator, am I expected to roam around my roaming folder, or is that what a good antivirus does? I see "LiveSupport.exe.log" and "regsrv32.exe.log" text files, dated 11/14/2013. That's good, right?