Explorer.exe won´t start after Virus

Cleaning another computrer virus for a colleuge - another virus, another unique symptom.

After getting hit by a virus through a malicious web site (one of those fake anti-virus types) this little netbook wouldn´t boot completely into Windows 7. Everything started except explorer.exe Here is how we fixed it...

First to find the problem we tried to boot the machine into safe mode. Regardless of attempting either a normal boot or any of the special start-up options explorer still didn´t start. Even attempting to start it manually through task manager (accessed via ctrl+alt+delete) didn´t work. It was clear explorer.exe had become corrupted and needed to be restored

To do that we started Task manager, enabled processes for all users (placing task manager into elevated mode) and then started an elevated cmd prompt from the run command (there is an option to start with administrator rights if the task manager is already elevated) From there we entered the following:



Which starts the Windows System File Checker. Thankfully this detected issues with several system files and restored them. After a reboot we got back to explorer - but it was immediately clear the virus was still at work and active popping up fake virus alerts with any program that attempted to start.

Now that we had a somewhat functional desktop we could install software again - so we started our standard removal barrage - first the reboot back into safe mode - disabling most of the virus, and networking so it couldn´t get out again. TFC (Temp File Cleaner) dumped about 350MB of temp files (we always start there) then it was on to anti-malwarebytes and a super antispyware scan - everything finding various corrupt files. We even completed a Microsoft Malicious Software Removal scan (just for good measure) Finally we manually checked through the registry for any startup entries that looked unusual and removed those as well as start menu items.

Once all scans started coming up clean (about 4 reboots into safe-mode later) it seemed safe to attempt going back into a normal startup. That was successful, so we proceeded to install spybot and immunize the system as well as updated anything that was out of date (flash, virus definitions etc...)

This system had been running Sophos anti-virus, the first time I had come across it. Looking up some ratings online it seems it is rated about the same as AVG, which, in the past has proven to be ineffective as an anti-virus solution. Managed to locate a great resource for getting test results on anti-virus products though: Anti-virus comparatives

---