also @ TechSpot: Updated Microsoft EULA prohibits class action lawsuits

TechSpot

[Solved] I believe I have been hit by iexplore.exe virus. Done with 8-step

Discussion in 'Virus and Malware Removal' started by Storhm, Jul 14, 2010.

Thread Status:
Not open for further replies.
Page 1 of 2

  1. Storhm Newcomer, in training

    My computer has been running slowly lately and I checked out task manager and noticed that there was iexplore.exe running taking up 100k+ Memory. My main browser is Firefox, and I also noticed that iexplore.exe is running under the User Name System instead of my name. Also, every time I end the process, it comes right back in under 5 seconds. Please help me get rid of this!

    Attached Files:

    Storhm, Jul 14, 2010
    #1

  2. Broni Malware Annihilator

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip: http://www.7-zip.org/
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
    Broni, Jul 14, 2010
    #2

  3. Storhm Newcomer, in training

    Done, and thanks for taking the time to help.

    Attached Files:

    Storhm, Jul 14, 2010
    #3

  4. Broni Malware Annihilator

    You're welcome :)

    Open Notepad
    Copy and paste following text into Notepad:
    Code:
    @ECHO OFF
START remover.exe fix \\.\PhysicalDrive0
EXIT
    Go FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
    Then in the FILE NAME box type fix.bat.
    Save fix.bat to your Desktop.

    Run fix.bat by double clicking.
    You may see a black box appear; this is normal.

    When done, run remover.exe again and post its output.
    Broni, Jul 14, 2010
    #4

  5. Storhm Newcomer, in training

    Er same thing, when I open fix.bat, I get this:

    Bootkit Remover version 1.0.0.1
    (c) 2009 eSage Lab
    www.esagelab.com

    Restoring boot code at \\.\PhysicalDrive0...
    ERROR: No standard boot code found for your OS.
    You can restore boot code only for Windows XP, Server 2003, Vista, Server 2008 a
    nd Windows 7

    Press any key to quit...
    Storhm, Jul 14, 2010
    #5

  6. Broni Malware Annihilator

    If you have Vista DVD...

    start with step 2

    If you don't have Vista DVD...

    1. Create Vista Recovery Disc.

    Option 1:
    http://www.c4consulting.com.au/soluctions/vista/VISTA SOLUCTIONS.htm

    Option 2:
    Download Vista Recovery Disc iso image: http://neosmart.net/blog/2008/windows-vista-recovery-disc-download/
    Burn it to CD, or DVD: http://neosmart.net/wiki/display/G/Burning ISO Images to a CD or DVD

    2. Boot from created disk.
    At first screen click on Repair your computer:
    [IMG]
    This will bring you to a new screen where the repair process will look for all Windows Vista installations on your computer. When done you will be presented with the System Recovery Options dialog box:
    [IMG]
    After this, it will present you with a list of options including startup repair, system restore and command prompt:
    [IMG]
    Select Command Prompt

    Type in:
    bootrec /FixMbr
    and then press Enter

    Once completed then type Exit, press Enter and restart computer.
    Broni, Jul 14, 2010
    #6

  7. Storhm Newcomer, in training

    I'm sorry was afk, the disc is burning but it will take me awhile. Will probably be finished by morning, see you then.
    Storhm, Jul 14, 2010
    #7

  8. Broni Malware Annihilator

    No problem :)
    Broni, Jul 14, 2010
    #8

  9. Storhm Newcomer, in training

    Okay never mind, I'm using ImgBurner and I'm looking at the log when I pressed write and I get this:


    W 22:28:31 Failed to Write Sectors 0 - 31 - Reason: Power On, Reset, or Bus Device Reset Occurred
    W 22:28:31 Retrying (1 of 20)...
    W 22:28:42 Retry Failed - Reason: Not Ready To Ready Change - Medium May Have Changed
    W 22:28:42 Retrying (2 of 20)...

    It's just stuck at Retrying (2 of 20)

    PS. Before downloading ImgBurner, I tried my NTI CD & DVD-Maker 7, at about 0.05 bytes, it ejected my disc and I had some error.
    Storhm, Jul 14, 2010
    #9

  10. Broni Malware Annihilator

    I'd say bad CD?
    Broni, Jul 14, 2010
    #10

  11. Storhm Newcomer, in training

    I think I burned it.... 3 files on disc 2 folders: boot and sources. 1 file. bootmgr. What do I do now?
    Storhm, Jul 15, 2010
    #11

  12. Broni Malware Annihilator

    Put the CD in and restart computer.
    If boot order in BIOS is correct, your computer should boot from the CD automatically, or you'll see this message:
    "Press any key to boot from CD".

    Then follow my instructions (reply #6, step 2).
    Broni, Jul 15, 2010
    #12

  13. Storhm Newcomer, in training

    On a laptop right now, I do get the message "Press any key to boot from CD or DVD..." but when I click a mouse button or a key on the keyboard, nothing happens. It just sits there.
    Storhm, Jul 15, 2010
    #13

  14. Broni Malware Annihilator

    Restart computer again.
    Broni, Jul 15, 2010
    #14

  15. Storhm Newcomer, in training

    Did that =/ no dice. I tried pressing caps lock and num lock, the light doesn't change on my keyboard. That have anything to do with it?
    Storhm, Jul 15, 2010
    #15

  16. Broni Malware Annihilator

    Try this CD on another working computer and see, if it'll boot.
    Broni, Jul 15, 2010
    #16

  17. Storhm Newcomer, in training

    No can do, only computer with vista.
    Storhm, Jul 15, 2010
    #17

  18. Storhm Newcomer, in training

    Nevermind got it to work, it freezes up if I don't press a key in time. (When all the periods/dots load.) How wierd xD
    Storhm, Jul 15, 2010
    #18

  19. Broni Malware Annihilator

    OK :)
    Keep going....
    Broni, Jul 15, 2010
    #19

  20. Storhm Newcomer, in training

    After restart would you like me to try the fix.bat again?
    Storhm, Jul 15, 2010
    #20
Page 1 of 2
Thread Status:
Not open for further replies.