XYplorer saved my system!
Posted: 07 Oct 2026 20:32
I tried to make the story as short as possible, but it's still "a poem", so don't waste your time. 
It started with my system got infected from some download, as i know now, by Floxif family trojan. It's purely my fault, but the story goes like this. Due to my laptop being quite old i "can't afford" to spend resources for real-time anti-virus and do full system checks periodically. And this situation got exactly "between checks". But where is the XYplorer here?
My workflow greatly based upon Modified date and items positions according to that one. I often change dates to some items simply to have them next to each other. That's why my XY setup has lots of Color Filters marking items time based = and Color Filters were my alert-savior!
So here i'm working and noticing some folders i haven't touched for year, suddenly start to popup among "recently modified". What's more strange, noting inside was changed, not a single date of any item. Having some experience in "manual virus tracking" i checked all processes for maybe some new/suspicious, sys startup list, and else usual "virus affected" areas, but found nothing. At this moment i was rather busy with work, plus nothing really wrong did happen, apart from some few folders popping as modified. Just in case, since i though maybe it's caused by one of my experimental XY scripts, i switched from XY to TC for the end of the day.
Next day i found that more folders "got modified", and to be honest, TC was much worse at revealing that, so i switched back to XY = Color Filters allowed to observe and track "new situations" much better, depicting colored items anywhere. But again, since utterly nothing else was strange and me still being busy with finishing work, i made a guess that it's probably again some idiotic system's indexing got enabled and causing the stuff.(i Hate indexing!)
A pure accident revealed everything: i got a sudden power shortage, laptop rebooted, and suddenly i found couple programs having strange files next to their executables = the naming was [program].exe.dat and the size was almost the same... That's when my inner alarm launched, cause each of those files were exactly 82kb smaller then the real working ones. A real deal got obvious: that sudden reboot "broke" a process of infecting and replacing the real executable right in that moment.
The quarantine measures with extensive scanning were launched and a pretty impressive trojan found. Impressive, cause this little pest was less than 100kb size, could infect EXE and Dll, was preserving dates of victims(that's why nothing was changed in folders), and most astonishing - it could infect and swap an app that is running right now, which is supposed to be "occupied" from any actions!! My sincere applause to the creators, that's a real biological-like virus behavior. If there was no "trojan's miss" with app's folder still got date modified, and if i hadn't XY's Color Filters - this could continue unnoticed till the the very end.
Later i found that not a single system file was touched (yet) -- trojan obviously kept those for later, to not get noticed before the finishing blow. A separate amusement for me, is that even those apps that refused to work(crashed) when i tried to resource-change their icons, at this occasion "didn't notice" extra 80kd "added" to them and worked like nothing.
Eventually i was lucky and anti-virus from live-usb managed to track everything and cure it.
Additional peculiar observation here: i myself forgot that had several portable XY betas extracted in different locations, but the trojan found them all.("almost") It appeared that i had 4 XY32 and 2 XY64 extracted = All 4 x32 very infected, yet 2 x64 stayed clean. I don't know if TB is the magic source here, but kinda surprising.
As a sidenote: if i may, i'd propose Don to add a "self-integrity check" on XY's start = a simple self-hash comparison. Yeah, it would demand to input hash- standard in each release, but could be a little nifty self-defense check for own safety.
If you've read till here, congrats!
It started with my system got infected from some download, as i know now, by Floxif family trojan. It's purely my fault, but the story goes like this. Due to my laptop being quite old i "can't afford" to spend resources for real-time anti-virus and do full system checks periodically. And this situation got exactly "between checks". But where is the XYplorer here?
My workflow greatly based upon Modified date and items positions according to that one. I often change dates to some items simply to have them next to each other. That's why my XY setup has lots of Color Filters marking items time based = and Color Filters were my alert-savior!
So here i'm working and noticing some folders i haven't touched for year, suddenly start to popup among "recently modified". What's more strange, noting inside was changed, not a single date of any item. Having some experience in "manual virus tracking" i checked all processes for maybe some new/suspicious, sys startup list, and else usual "virus affected" areas, but found nothing. At this moment i was rather busy with work, plus nothing really wrong did happen, apart from some few folders popping as modified. Just in case, since i though maybe it's caused by one of my experimental XY scripts, i switched from XY to TC for the end of the day.
Next day i found that more folders "got modified", and to be honest, TC was much worse at revealing that, so i switched back to XY = Color Filters allowed to observe and track "new situations" much better, depicting colored items anywhere. But again, since utterly nothing else was strange and me still being busy with finishing work, i made a guess that it's probably again some idiotic system's indexing got enabled and causing the stuff.(i Hate indexing!)
A pure accident revealed everything: i got a sudden power shortage, laptop rebooted, and suddenly i found couple programs having strange files next to their executables = the naming was [program].exe.dat and the size was almost the same... That's when my inner alarm launched, cause each of those files were exactly 82kb smaller then the real working ones. A real deal got obvious: that sudden reboot "broke" a process of infecting and replacing the real executable right in that moment.
The quarantine measures with extensive scanning were launched and a pretty impressive trojan found. Impressive, cause this little pest was less than 100kb size, could infect EXE and Dll, was preserving dates of victims(that's why nothing was changed in folders), and most astonishing - it could infect and swap an app that is running right now, which is supposed to be "occupied" from any actions!! My sincere applause to the creators, that's a real biological-like virus behavior. If there was no "trojan's miss" with app's folder still got date modified, and if i hadn't XY's Color Filters - this could continue unnoticed till the the very end.
Later i found that not a single system file was touched (yet) -- trojan obviously kept those for later, to not get noticed before the finishing blow. A separate amusement for me, is that even those apps that refused to work(crashed) when i tried to resource-change their icons, at this occasion "didn't notice" extra 80kd "added" to them and worked like nothing.
Eventually i was lucky and anti-virus from live-usb managed to track everything and cure it.
Additional peculiar observation here: i myself forgot that had several portable XY betas extracted in different locations, but the trojan found them all.("almost") It appeared that i had 4 XY32 and 2 XY64 extracted = All 4 x32 very infected, yet 2 x64 stayed clean. I don't know if TB is the magic source here, but kinda surprising.
As a sidenote: if i may, i'd propose Don to add a "self-integrity check" on XY's start = a simple self-hash comparison. Yeah, it would demand to input hash- standard in each release, but could be a little nifty self-defense check for own safety.
If you've read till here, congrats!