Weird Defense block entry.. pls help analyze

[BrownChiLD]

Hi guys…

I just installed Comodo suite last night and im enjoying the detailed logs it presents… it’s really nice…

however i noticed a strange log
screenshot here:
http://d.pr/USRP

basically it shoes a blocked entry for:
C:\Windows\System32\explorer.exe
SandBoxed as Partially Limitted
Time: 12/17/2010 @ 9:54 AM

What’s strange is that

1. This is a freshly setup system, w/ applications installed already but each app i double cheked to be clean

2. during this time as logged, the whole morning infact, i wasnt doing anything but sorting pics via Picasa, synching my phone photos w/ Nokia OviSuite and uplodin files via windroplr … and scanning documents from my HP Scanner… background processes are all normal… startup entries are ok … i wasnt installing anything or doing anything new …

3. when i looked for this file it wasnt in the System32 folder (i know the legit explorer is supposed to be in C:/Windows , not in system32… but i cant find the file and comodo cant also… like it’s gone/deleted… I checked comodo quarantine, … nothign at all…

Could this be a bug or somethin of comodo? or could it be just a child processes of one of the other legit apps such as Nokia Ovi Suite, HP Scanning software perhaps?

[HeffeD]

Sounds like you have a virus. You’ll want to follow the steps outlined in this thread.

How to Know If Your Computer Is Infected

[BrownChiLD]

@HeffeD post:2

Sounds like you have a virus. You’ll want to follow the steps outlined in this thread.

How to Know If Your Computer Is Infected

that’s the thing though, this is a freshly deployed system, i dont see any suspicious processes, and Comodo AV full scan comes out clean…

[HeffeD]

Looking at your running processes isn’t a great way to judge if your system is infected.

If you feel you’re clean, then that’s fine. You were just asking for help and posted evidence of a possible infection, so I pointed you in the right direction. What you do from here is up to you.

[Citizen_K]

The normal explorer.exe is in x:\Windows\ and not in x:\Windows\system32. I would think you are infected.

[BrownChiLD]

thanks for all the replies…

i ran my PC through Cloud Scanner and though it raised around 5 Unknown software , i can confirm that all of em are fine as they are the software i developmed myself as well as software that came from the developers themselves like MyNotesKeeper and the likes… so no there arent any threats… but i just keep getting this System32/explorer.exe entry atleast 2 times /day… but there’s no traces of the exe file when i go look for it… im almost convinced this is a COmodo bug… perhaps?

[MOVEAX]

just do a virustotal of the files.
or share it to me in private message.

[HeffeD]

@BrownChiLD post:6

im almost convinced this is a COmodo bug… perhaps?

No, this is malware behavior.

Run through the steps in that thread I already linked you to.

[Citizen_K]

Please test your computer for malware and submit it to Virus Total to get the opinion of other scanners about this file.

[BrownChiLD]

i’ve ran through all the steps , specially comodo cloud scan. there is ZERO threats found in my PC

and i’d like to submit, analyse that System/32/explorer.exe file , but it’s just not in the system… it’s not in the folder… nada…

but at least twice / day i get flagged for this… like just recently:

http://cl.ly/3jZi/Screen_shot_2010-12-22_at_3.06.09_PM.png

annoying really…

[HeffeD]

It’s definitely on your system, or it wouldn’t keep getting blocked or sandboxed. Does it show up on your unrecognized files list? Defense+ → Unrecognized Files

And this may sound like a silly question, but I need to ask it just to make sure so please don’t take offense… When you say it’s not in your system32 folder, do you have your folder options set to show hidden files? And have you tried doing a drive search for explorer.exe to see if it turns up anywhere other than \Windows?

[HeffeD]

@Valentin N

I think some people have problems with the trusted vendors list. Look at my signature to solve loss of trusted vendor list.

Illegitimate software disguising itself as explorer.exe in a non-standard folder is definitely not going to be on the trusted vendor list.

[MOVEAX]

Edited by jay2007tech**

Luc[y],

I’m sorry for misreading it, what I wrote would only apply to the microsoft one

[jay2007tech]

***edit by jay2007tech

My post is totally wrong

[MOVEAX]

this explorer.exe is a infection, just make a quick scan with malwarebytes, it will be instantly flagged as heur.shuriken.

[jay2007tech]

this explorer.exe is a infection, just make a quick scan with malwarebytes, it will be instantly flagged as heur.shuriken.

[s]explorer.exe CAN't be deleted, only cured[/s] Only the microsoft explorer.exe can be deleted, only cured

The fake one CAN be deleted

*edited by jay2007tech

[MOVEAX]

oh i see, yes … i hope running dr web cureit will fix it.

[HeffeD]

@Luc[y

link=topic=66479.msg469622#msg469622 date=1293045981]
Edited by jay2007tech**

Luc[y],

You can’t DELETE explorer.exe from c:\windows\system32 folder

=======================================
To prove it to yourself

1. Open “Task Manager”
2. Click on “proccess” tab
3. Click on “explorer.exe”
4. Right click on it
5. click on “End Process”
   Now your screen goes blank except for the task manager

After you see my point, To get it back

1. In task manager, click on “File”
2. Click on “New task”
3. Type in “explorer.exe”
4. Click on OK

We aren’t talking about the valid explorer.exe that lives in C:\Windows\ though… This is something calling itself explorer.exe in the system32 folder. That is somewhere it should never be, and indicates an infection.

[jay2007tech]

I’m an idiot,
explorer.exe is located in the winodws folder, NOT in SYSTEM32

It is infected, it’s not windows
C:\Windows\System32\explorer.exe

Luc[y] ,
Would you be able to put your scipt back on here

We aren't talking about the valid explorer.exe that lives in C:\Windows\ though... This is something calling itself explorer.exe in the system32 folder. That is somewhere it should never be, and indicates an infection.

I agree

[arjunpa]

Can you find the fake explorer.exe in the ‘View Active Process’ under Defense Plus tab? If u can just terminate and block it. Use ‘View full path’ to find the fake one.