By waverazor
Jul 13, 2010
  1. In my task manager i have a process named iexplore.exe up and its using my memory it keeps increasing, i've also ended the process on the task manager and still it comes back and starts and takes even more memory according to my task manager. I'd love for some help to get rid of this please!

    ive spybot, adware, and super anti-spyware for this and it says my computer is clean and after ive done all this i'm now getting bluescreens on the start up screen. How do i make Iexplore.exe just not run
  2. Broni

    Broni Malware Annihilator Posts: 52,799   +343

  3. waverazor

    waverazor TS Rookie Topic Starter

    OK.. I've done this but now my computer is massively getting blue screen and cannot be able to get on without safe mode. and if it does work on normal mode it would bluescreen like 5 minutes after i log in and it even goes in to bluescreen at the log in screen :S.. its just looping now to bluescreen and restarting and i was on the GMER step
  4. Broni

    Broni Malware Annihilator Posts: 52,799   +343

    Download Bootkit Remover to your Desktop.

    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip:
    • After extracing remover.exe to your Desktop, double-click on remover.exe to run the program (Vista/7 users,right click on remover.exe and click Run As Administrator.
    • It will show a Black screen with some data on it.
    • Right click on the screen and click Select All.
    • Press CTRL+C
    • Open a Notepad and press CTRL+V
    • Post the output back here.
  5. waverazor

    waverazor TS Rookie Topic Starter

    Bootkit Remover version
    (c) 2009 eSage Lab

    \\.\C: -> \\.\PhysicalDrive0
    MD5: d4b876239615e81ab805b6a9431ee920

    Size Device Name MBR Status
    931 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>

    Press any key to quit...
  6. Broni

    Broni Malware Annihilator Posts: 52,799   +343

    You're infected with a rootkit, indeed.

    Open Notepad
    Copy and paste following text into Notepad:
    START remover.exe fix \\.\PhysicalDrive0
    Go FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
    Then in the FILE NAME box type fix.bat.
    Save fix.bat to your Desktop.

    Run fix.bat by double clicking.
    You may see a black box appear; this is normal.

    When done, run remover.exe again and post its output.
  7. waverazor

    waverazor TS Rookie Topic Starter

    I was in the process of doing the last step you gave me and it just blue screened for me. After that it said that windows was damaged or something. I couldn't get logged in at all so i just gave up.

    Thanks a lot for the help though! i really appreciated it
  8. Broni

    Broni Malware Annihilator Posts: 52,799   +343

    ...and what did you do?
  9. waverazor

    waverazor TS Rookie Topic Starter

    I had a windows 7 so i just installed it and moved over the files that i needed that were in my hard drive over here.

    I still don't understand how it just bluescreened after i was doing all those malware and adware scans, they did find stuff but for some reason it just made things worse, well it seemed like it did.
    In conclusion i just deleted everything and started over with windows 7, i couldn't even log in after i did the last step in safemode it said i needed my windows vista cd..(didn't have it)

    Thanks a lot for your time Broni!
  10. Broni

    Broni Malware Annihilator Posts: 52,799   +343

    You're welcome :)
    You're infected with a rootkit, which is not detected by any conventional scans.
    Only Bootkit Remover was able to see it.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...