Wrong Explorer.exe (version 6.1.7601.23537) (not signed) (and Worm.Snorm.Win32) Virustotal,...

[Guest WilliamHendershot]

I checked my process explorer today. To see that a virus came up on virustotal, called worm,snorm.win32 on explorer.exe. So I analyzed it on virustotal.com

 

 

Here is the link:

 

 

https://www.virustotal.com/en/file/d5bc504277172be5c54b60ad5c13209dc1f729131def084de3ec8c72e54c58ef/analysis/

 

 

 

I found out it wasn't signed by Microsoft or Trusted file.

 

 

 

So, when I googled this I couldn't find any information on how to fix this. I'm not sure how to replace it. And I need to know if the SHA256 or CRC32 or hash calc on it, is the same explorer.exe that you guys updated. If not I need to replace it. I don't know when it was updated to this version. I think a rouge virus modified it and replaced the signed and verified version of this.

 

 

Can you guys verify that this is the correct explorer.exe? Or if it's a virus that modified it? Or can I replace it with a good version. My friends explorer.exe is a virus free version that is signed but it's a different version.

 

 

Also I ran malware bytes (updated) and it didn't detect anything. And I ran spybotsearch and destroy and it came up with nothing.

 

Continue reading...