Win32/Beavis.4350 destroyed explorer.exe

porty · 02-25-2005, 03:30 PM

Ran across a bug yesterday that I'd not seen before - Win32/Beavis.4350. It was proving EXTREMELY difficult to remove from my customer's ME machine but the situation got suddenly worse when I deleted explorer.exe from C:\Windows\System\SFP\Archive.

On the next boot, a message said - 'Can't find explorer.exe - reinstall Windows'

This was obviously hokum - explorer.exe was still where it was supposed to be, in C:\Windows (I was able to boot into Safe mode to find this out), so it appears this Beavis bug corrupts explorer.exe in such a way that Windows can't see it. It also follows that the version I deleted from the Archive folder must have been controlling the boot. Hmm..very tricky.

So, my questions are these:
1. Does anyone have any information on this bug? I don't think it's really new but there's not much on the net about fixes for this version - not as of yesterday, anyway.
2. If push comes to shove, how can I replace explorer.exe with clean WinME version\s? I'm a tech but I don't deal much with ME these days - mainly XP with the occasional 98 case.

However, on reflection, I don't know that simply replacing explorer.exe will be the whole answer, not as long as there's some other hidden file which will probably just infect a clean version.

Comments would be appreciated.
TX

porty · 02-25-2005, 05:33 PM

Looks like I might have found a fix myself, well part of it, anyway.

I found the instructions to create an ME emergency boot disk here:
»support.microsoft.com/default.aspx?sci..

Then I found the instructions for extracting a fresh explorer.exe here:
»support.microsoft.com/default.aspx?sci..

So now I'm back to booting normally.

Also, it looks like Kaspersky AV Personal 5 is capable of fixing the problem, so I'm off to try that.

Cheers.

02-25-2005, 03:30 PM	#1 (permalink)
porty Registered User Join Date: Feb 2005 Posts: 14 OS: XPP	Win32/Beavis.4350 destroyed explorer.exe Ran across a bug yesterday that I'd not seen before - Win32/Beavis.4350. It was proving EXTREMELY difficult to remove from my customer's ME machine but the situation got suddenly worse when I deleted explorer.exe from C:\Windows\System\SFP\Archive. On the next boot, a message said - 'Can't find explorer.exe - reinstall Windows' This was obviously hokum - explorer.exe was still where it was supposed to be, in C:\Windows (I was able to boot into Safe mode to find this out), so it appears this Beavis bug corrupts explorer.exe in such a way that Windows can't see it. It also follows that the version I deleted from the Archive folder must have been controlling the boot. Hmm..very tricky. So, my questions are these: 1. Does anyone have any information on this bug? I don't think it's really new but there's not much on the net about fixes for this version - not as of yesterday, anyway. 2. If push comes to shove, how can I replace explorer.exe with clean WinME version\s? I'm a tech but I don't deal much with ME these days - mainly XP with the occasional 98 case. However, on reflection, I don't know that simply replacing explorer.exe will be the whole answer, not as long as there's some other hidden file which will probably just infect a clean version. Comments would be appreciated. TX

02-25-2005, 05:33 PM	#2 (permalink)
porty Registered User Join Date: Feb 2005 Posts: 14 OS: XPP	Looks like I might have found a fix myself, well part of it, anyway. I found the instructions to create an ME emergency boot disk here: »support.microsoft.com/default.aspx?sci.. Then I found the instructions for extracting a fresh explorer.exe here: »support.microsoft.com/default.aspx?sci.. So now I'm back to booting normally. Also, it looks like Kaspersky AV Personal 5 is capable of fixing the problem, so I'm off to try that. Cheers.