Page 1 of 2 12 LastLast
Results 1 to 15 of 18
  1. #1
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    explorer.exe Attempting To Access Internet

    Can anyone shed some light as to why I would have several entries in my ZA log over an 8 second time frame for explorer.exe and / or C:WINDOWSexplorer.exe attempting to access the internet ?? Some list no destination IP and under Direction list (data) while others list 239.255.255.250.1900 as the IP and either (data) or Outgoing (connect) as the Direction. Some are Blocked while others list nothing as the action taken. Ive added a screenshot of the relevant entries.
    Attached Images Attached Images
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  2. #2
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: explorer.exe Attempting To Access Internet

    The ones that are let through are listed as C:WindowsExplorer.exe and the ones that are blocked as explorer.exe (without a path).
    Could you check whether there are instances of explorer.exe in unexpected locations on your hard disk? I found a mention of a Trojan that installs C:WindowsExplorerExplorer.exe (note the Explorer folder under Windows). You can probably ignore copies in C:Windows$NtServicePackUninstall$, C:ServicePackFilesI386 and in KBnnnnnnn folders..

  3. #3
    Plutonium Lounger
    Join Date
    Oct 2001
    Location
    Lexington, Kentucky, USA
    Posts
    12,107
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: explorer.exe Attempting To Access Internet

    I went to GRC.COM to check his port finder and 1037 and 1038 are unknown as various Google hits also say. Port 1900 is used by UPnP devices (it seems) to talk to one another or broadcast messages. That doesn't help at all I know, but I really don't know nuthin' ...

    Have you ever run Gibson's Shields Up to check all your ports' stealth status? ( Home of Gibson Research Corporation )

  4. #4
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    I did a search of my C drive and came up with nothing, so I drilled down to C:WINDOWS and there were two instances there. None found elsewhere.

    One was explorer.exe and the other was a folder named explorer. Both were created on Sept. 2, 2002. The explorer.exe was modified last year on June 13th early AM and I seem to recall having some problems with my system around that time, just before I moved, and may have restored an image to get things right. The folder explorer was accessed on May 20, 2003, which seems to be about the time I rebuilt the installation after a HD failure a month after I got the PC.

    Clicking on each one produced a different, but no unexpected result. The explorer.exe opened Windows Explorer to the custom setting I created to go straight to my C drive, while clicking on explorer, the folder, opens Windows Explorer to My documents. The properties on this one list it as Windows Explorer Command under File Type, which leads me to believe that it is a system file. Both are visible when hidden system files are displayed or not.

    I'm feeling better about this, but still don't know why either would be trying to access the internet.
    Attached Images Attached Images
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  5. #5
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts

    Re: explorer.exe Attempting To Access Internet

    What are your settings about finding network devices? Do you have any file sharing setup?

    Joe
    Joe

  6. #6
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    Al, I appreciate you chiming in, even if you "really don't know nuthin' ". Every little bit helps ya know. <img src=/S/smile.gif border=0 alt=smile width=15 height=15> I have been to Gibson's site several years ago and had my ports checked. I was deemed hidden and good to go. Can't hurt to check it again though. Thanks for mentioning it. I'll post back with results after I get scanned.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  7. #7
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    Thanks for the reply Joe. Where would I find those settings ?? I'm on a stand alone system and am not familiar with network settings.

    As far as i know, I do not share files, excepting when I upload them to Photobucket or other web based sharing service. No one has direct, unquestioned access to my PC.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  8. #8
    Plutonium Lounger
    Join Date
    Mar 2002
    Posts
    84,353
    Thanks
    0
    Thanked 29 Times in 29 Posts

    Re: explorer.exe Attempting To Access Internet

    What happens if you rename the file explorer.exe in C:WindowsExplorer to (say) explorer.old ?

  9. #9
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts

    Re: explorer.exe Attempting To Access Internet

    Windows Explorer - Tools | Folder Options | View | "Automatically search for network folders and printers". You have run the usual malware scans? Also, you might want to read some of the links at why explorer.exe connect to internet - Live Search.

    Joe
    Joe

  10. #10
    Plutonium Lounger
    Join Date
    Oct 2001
    Location
    Lexington, Kentucky, USA
    Posts
    12,107
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: explorer.exe Attempting To Access Internet

    But Doc, three of those are mixed - the EXE and the folder version - and are trying to contact via that port 1900. I don't know about the other ones on other ports, but it would be my guess that in that short period of time, one or more of your "devices" was calling out a message of some kind because one of them even has the IP number that Gibson says is used for such messages. I think you're right in assuming that you've not been "attacked" but you might want to check things like your printer, scanner, and whatever to see if they're all up to snuff.

  11. #11
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    The only thing I see is that the shortcut in Start>All Programs>Accessories takes me to My Documents while the one in C:WINDOWS takes me to the C drive with the tree expanded. <img src=/S/shrug.gif border=0 alt=shrug width=39 height=15> But checking back in C:WINDOWS after opening these folders, there is a new instance of explorer.exe and I cannot rename the one I renamed back to explorer.exe. The new one has the same icon as the one I renamed, so I suppose it's a Windows created .exe file that is part of the system. I suppose all is OK, but I think I will block the internet access for these items for awhile.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  12. #12
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    Thanks Joe. That's not checked. SpySweeper did a complete system scan last night and was showing clean this AM, Avast is always there and SpywareBlaster is doing it's thing. I had problems with the new versions of Adaware and Spybot and no longer have them installed (Adaware wouldn't install, something about the installer version, and Spybot caused all sorts of problems when I upgraded, so I removed it.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  13. #13
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    I don't believe I've been attacked, but something isn't quite right and I don't know what. I'll go to Gibson's and get scanned and do some reading. Thanks for your interest.
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  14. #14
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    Back from Gibson's and I didn't do as well as I expected. Nothing open, but my system replied to a Ping. Here's the report......

    Results from scan of ports: 0-1055

    0 Ports Open
    1049 Ports Closed
    7 Ports Stealth
    ---------------------
    1056 Ports Tested

    NO PORTS were found to be OPEN.

    Ports found to be STEALTH were: 25, 135, 136, 137, 138, 139,
    445

    Other than what is listed above, all ports are CLOSED.

    TruStealth: FAILED - NOT all tested ports were STEALTH,
    - NO unsolicited packets were received,
    - A PING REPLY (ICMP Echo) WAS RECEIVED.

    I just started using MagicJack on this system as the phone service for a new business venture, so maybe that is replying to the ping. I'm confused. <img src=/S/hmmn.gif border=0 alt=hmmn width=15 height=15>
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  15. #15
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: explorer.exe Attempting To Access Internet

    I just checked the properties on the "New" explorer.exe file and they are exactly the same as the old file's prpperties. <img src=/S/confused.gif border=0 alt=confused width=15 height=20>
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •