Backdoor.Oblivion is in my iexplorer.exe???? 1

[Thyezer]

NAV 2003 has found this instance of a virus. Backdoor.Oblivion was found in IExplorer.exe (in my windows/system32 file). It can't remove, quarantine, or delete the file? Any ideas how to get it out of this system folder? Do I need to replace my iexplorer file?

I am having to shut my NAV off just to send this as I am constantly getting this VIRUS ALERT everytime I access anything on this computer....

Thanks

 

[carrr]

Pretty straightforward///

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.oblivion.html

 

[Thyezer]

I have tried this already. It didn't stop it. It still is popping up and I can't find anything in my registry regarding it. Is there anything else I can try?

 

[carrr]

Well, do this. You don't say what OS you're running, but I'm not sure it's relevant yet.
Go to start, FIND...type in iexplore.exe (like I typed it here, not like you typed it in your first post). You should find iexplore.exe on your C: drive under Program Files\Internet Explorer, no?
You should not have an iexplore.exe in your system32 directory. This is what the virus put there. Want to test it out? Change the .exe to something like .dud on the system32 version of iexplore.exe. See how things run. I believe that that's your "hive" and until that file is dealt with, you're going to get this headache.

 

[Thyezer]

I am Running XP pro.
I am finding a iexplore.exe in:
Windows/prefetch (deleted it)
Windows/System 32 (Can't Delete)
Norton Protected Recycle Bin
Program Files/Internet Explorer

I tried renaming the file in System 32 , it wouldn't let me.

Any more suggestions????

 

[manarth]

you can't delete the file because it's in use....

boot to safe mode or boot to a dos prompt, go to the windows/system32 dir and delete away!

you may also need to turn off system restore - windows always knows best, so it may decide to restore the "system file" that you've just deleted

<marc> i wonder what will happen if i press this...[ul][li]please give feedback on what works / what doesn't[/li][li]need some help? how to get a better answer: faq581-3339[/li][/ul]

 

[carrr]

manarth is correct...on both counts.

 

[Thyezer]

Thanks Manarth THAT DID IT!!!!
I appreciate your help.

 

[Thyezer]

I now am having a problem again!!!!
When I start up my computer...there is a message (error) that states that the iexplorer.exe program cannot be found. My cursor has a mind of it's own too. It drifts around the screen and I catch glimpses of being able to actually control it. My NAV is closing itself and when I run it manually...it doens't allow me to select AUTO-PROTECT...it also is saying that my email protection isn't working anymore.

I have no idea where to look....I check my SYSTEM RESTORE and it now says that I don't have any restore points!!!!!

I am running in SAfE MODE and still getting this problem...NAV won't scan in Safe Mode though!

Please help!!!!

Thanks

 

[carrr]

Try this fix:

Click Start/Run, type MSCONFIG in the 'Open' box and press enter.
When the System Configuration Utility opens, click the 'System.ini' tab. When it opens in the window, click the + box to the left of the first entry [boot].
Once expanded, check the line shell=Explorer.exe. If there is an entry after this listing, highlight the line, click the 'Edit' button and delete it.
Next click the 'Win.ini' tab and expand the [windows] entry as before.
Check the lines load= and run=, there shouldn't be a listing there after the = sign on either line. If Iexplorer in listed, edit the line to read run= and save the changes.&quot;

 

[Thyezer]

I am using XP pro and when I goto MSCONFIG...I don't have the options you have listed carr? I have the TABS at the top that read SYSTEM.ini WIN.ini BOOT.ini, but I cannot go any further with what you have written as it is not available.

I did find in STARTUP (MSCONFIG) that there were 2 items listed as iexplore that were there. I unchecked them as I couldn't delete them (NO OPTION). I am still getting this cursor problem...but it went away for a while after I unchecked the 2 items in STARTUP...

I am now mastering how to navigate my pc without a mouse!!!! wohooooo!!! I hope someone can bring me back down to Earth!!!

 

[carrr]

Hmmm...don't use XP...didn't foresee that problem.
Try this. Go into regedit (after doing a backup, of course....) and surf to the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Delete the entries for iexplore.exe if found....

 

[Thyezer]

I didn't find those entries.....
My NAV 2003 is up and running again??? and it doesn't find any virus when I scan. I am still getting the cursor problem and cannot identify it???? I have gone over everyones suggestions and tried them all 2- 3 times...

I am grateful for all suggestions...but, anymore ideas???

Thanks