Errant explorer

[John's News 2]

Installed firewall, and alerts pick up what seems to be a second, or
mis-directed loading of explorer.exe.
Thus, I may have inadvertently mis-directed this with Norton
Systemworks, trying to correct some of the error links picked up by Norton.
(to quickly to accept)

I get this Launch Path C:\winnt\Service Pack Files\i386\explorer.exe
which seems to be trying to Launch vju9.exe

1. Should this be trying to launch explorer.exe from i386, or somewhere
else,
I believe that by my denying the start from this location, that explorer
loads from wherever it should start.
2. If it needs correcting where can I find the place to correct this.

3. And I am denying the start of the vju9.exe which Windows Explorer is
trying to Launch. Searching the computer does not locate vju9.exe, so I
would assume Its trying to go out on the internet to run this file.

What help (advice) can you give me to correct this problem.
W2000 updated.....
John

 

[Andy]

I have done a search on VJU9.EXE and this is a virus! see the link below for
more information and how to remove this trojan from your system.

Thanks
Andy

http://forums.techguy.org/showthread.php?threadid=171157&a80954376b9e753d3befa2a0fcc0fc98

 

[John's News 2]

Thanks, I could not get the TDS 3 program to remove the "main" caught line Shivers.acid... ..Rat.Rat or something like that which was trying to run the ... Explorer.exe out of the i386 service pack.

TDS 3 did remove from the Winnt\system32\ several files with the rat.rot association i.e. fua4.exe, okx7.exe, moyv4l.exe, msbb.exe, goytu3, bnqv5t, exz14v.exe, vju9.exe, 32yf8.exe.

Finally, I went to the register HKEY_LOCAL_MACHINE | SOFTWARE, and on the top line found the offending line.
Also, Explorer:REG_SZ: C\WINNT\Service Pack File\i386\explorer.exe.
and the line Run C:\WINDOWS\System32\Vju9.exe
I removed all these and everything seems to be running normal.
I was so anxious to get these files off my machine I may not have written all the text down correctly.
I had previously searched the register for these files, but it did not find the words.
Thanks again

john z

I have done a search on VJU9.EXE and this is a virus! see the link below for
more information and how to remove this trojan from your system.

Thanks
Andy

http://forums.techguy.org/showthread.php?threadid=171157&a80954376b9e753d3befa2a0fcc0fc98