Iexplore.exe pop up problems

[Blkscholar]

Hi, I'm hoping someone can help me. I have a problem with 2 iexplore.exe processes popping up and slowing down my computer (1 of the iexplore processes automatically takes up over 100,000k of virtual memory). These processes start without me using internet explorer; I only use firefox for the internet. This causes my computer to be slow from the moment I log on. I also get pop ups as well.

I used AVG virus scan and cleaned what was there (2 trojans). Since then AVG hasn't detected anything. Please help.

My HJT logfile is attached.

Thanks in advance.

 

[kritius]

Download and Run NoLop
Please Download NoLop to your desktop from one of the links below...
Link 1
Link 2
Link 3

• First close any other programs you have running as this will require a reboot
• Double click NoLop.exe to run it.
• Now click the button labelled "Search and Destroy"
  (your computer will now be scanned for infected files)
• When scanning is finished you will be prompted to reboot only if infected, Click OK
• Now click the "REBOOT" Button.
• A Message should popup from NoLop. If not, double click the program again and it will finish.
• Please attach the contents of C:\NoLop.log later.

Note: If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to C:\WINDOWS\system32\ folder then rerun the program.

Fix entries using HiJackThis

• Launch HiJackThis
• Click the Do a system scan only button
• Put a check next to the entries listed below(if still present)

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.alot.com/sidebar?pr=asst&client_id=2B32D20001C838EB01CED00A&instal l_time=07-12-2007:11:06&src_id=11035&tb_version=1.0.3.158&q=&url=http://my.alot. com?client_id=2B32D20001C838EB01CED00A&install_time=07-12-2007:11:06&src_id=1103 5&tb_version=1.0.3.158 (obfuscated)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O2 - BHO: Union Plus.net - {CD292324-974F-4224-F70B-AEFD303F8260} - C:\PROGRA~1\UNIONP~1.NET\Toolbar\Toolbar.dll (file missing)
O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)
O3 - Toolbar: Union Plus.net - {CD292324-974F-4224-F70B-AEFD303F8260} - C:\PROGRA~1\UNIONP~1.NET\Toolbar\Toolbar.dll (file missing)
O3 - Toolbar: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing)
O4 - HKLM\..\Run: [Love default global mess] C:\Documents and Settings\All Users\Application Data\great coal love default\part axis.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {483EB14D-AF1C-4951-81B0-4E2B41829FF6} (QOLCheck Control) - https://www.select2perform.com/cabs/QOLCheck.ocx

• IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
• Click the Fix checked button and close HiJackThis
• Reboot HijackThis if necessary

Delete Files and Folders

• Right Click on the start button and chose explore
• Show all hidden files and folders, see how HERE
• Navigate to the following files and folders and delete them(if still present)

C:\Documents and Settings\All Users\Application Data\great coal love default<---------This Folder

• Empty the recycle bin.

If that does not work then repeat the process in safe mode. See how to boot into Safe mode HERE.
***DO NOT USE MSCONFIG TO BOOT INTO SAFE MODE***

After this is complete post the NoLop report and a fresh HijackThis log.

 

[Blkscholar]

Results of scan

Ok Kritius, I followed your instructions. The problem seems to have gone away (there are no more iexplore.exe processes popping up).
Attached are the hjt log and the Nolop log.

Thanks