Explorer.EXE Trying to Install a Trojan

Windows Security Tutorials - Herong's Tutorial Examples

∟PWS (Password Stealer) Trojan Infection Removal

∟Explorer.EXE Trying to Install a Trojan

This section describes how Windows Explorer, Explorer.EXE, and FireFox firefox.exe was trying to install malicious .sys and .exe files on the system.

Half hour later, additional Trojan activities were reported by McAfee VirusScan See OnAccessScanLog.txt log file records below:

<date> 10:09:52 PM Cleaned hyang C:\WINDOWS\Explorer.EXE 
   c:\windows\system32\drivers\yzpqaxboqp.sys PWS-Mmorpg.gen (Trojan)

<date> 10:09:52 PM Deleted hyang C:\WINDOWS\Explorer.EXE 
   C:\WINDOWS\SYSTEM32\DRIVERS\YZPQAXBOQP.SYS PWS-Mmorpg.gen (Trojan)

<date> 10:09:52 PM Deleted hyang C:\WINDOWS\Explorer.EXE 
   C:\WINDOWS\system32\drivers\yzpqaxboqp.sys PWS-Mmorpg.gen (Trojan)

<date> 10:32:15 PM Cleaned hyang C:\Program Files\Mozilla Firefox
   \firefox.exe c:\windows\temp\my.exe PWS-Mmorpg.gen (Trojan)

<date> 10:32:15 PM Deleted hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\TEMP\MY.EXE PWS-Mmorpg.gen (Trojan)

<date> 10:32:15 PM Deleted hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\Temp\my.exe PWS-Mmorpg.gen (Trojan)

<date> 11:15:48 PM Cleaned hyang C:\Program Files\Mozilla Firefox
   \firefox.exe c:\windows\temp\my.exe PWS-Mmorpg.gen (Trojan)

<date> 11:15:48 PM Deleted hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\TEMP\MY.EXE PWS-Mmorpg.gen (Trojan)

<date> 11:15:48 PM Deleted hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\Temp\my.exe PWS-Mmorpg.gen (Trojan)

I was confused with these log records:

Why Windows Explorer, Explorer.EXE, was trying to install a malicious .sys file.? Or may be my Explorer.EXE had been replaced by the Trojan?
Why FireFox, firefox.exe, was trying to install a malicious .exe file? Or may be my firefox.exe had been replaced by the Trojan? Or the Trojan had installed a addon program in FireFox?
Why C:\WINDOWS\Temp\my.exe was detected and deleted by McAfee VirusScan this time? As you can see in previous sections, C:\WINDOWS\Temp\my.ex was actually installed and executed on the system.