Solved Multiple iexplore.exe in task manager (a.k.a. is there an echo in here?)

Status
Not open for further replies.
No reason to feel bad.
Since I know your computer situation pretty well, it's easier to talk to me, than start a new topic.

Close Firefox. Go Start>All Programs>Mozilla Firefox, click on Mozilla Firefox (safe mode). Same thing?
 
CPU Useage in Task Manager is up at 90% or higher when youtube is playing. when it stops, it drops to 50%.
 
Depending on video, when I play it my CPU usage ranges from 40% to 90%.
However 50% usage with nothing playing seems too high.

Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
Click on View > Select Colunms.
In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
Go File>Save As, and save the report as Procexp.txt.
Attach the file to your next reply.

Post couple of logs.
- nothing opened
- Firefox opened
- Firefox playing uTube video
 
Three attached: one with just this web browser open (firefox.txt); one with this tab and youtube playing music (youtube.txt) and then finally one with nothing (nothing.txt).

You have WAY too much patience for one person :)
 

Attachments

  • Procexpfirefox.TXT
    7.6 KB · Views: 1
  • Procexpyoutube.TXT
    7.6 KB · Views: 1
  • Procexpnothing.TXT
    7.5 KB · Views: 1
I don't like it.
Firefox playing uTube and using 43% looks normal, but on a top of it we have a combination of services.exe and svchost.exe using another 40%, or so (no matter, Firefox on, or not).

You either got reinfected, or we missed something.

We need to re-run some scans.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  1. Please, never rename Combofix unless instructed.
  2. Close any open browsers.
  3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  4. Double click on combofix.exe & follow the prompts.
  5. When finished, it will produce a report for you.
  6. Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 
My machine MUST be better though - scan completed in record time :)

it didnt recommend a reboot - should I?
 

Attachments

  • ComboFix.txt
    29.7 KB · Views: 1
You don't have to, because Combo didn't find anything.
Let me see, what you got there...
 
I don't see much, just one leftover, but we better get rid of it...

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:
File::
c:\windows\system32\braviax.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"braviax"=-


3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
 
ok - thanks again Broni. I'll let this one run through the night as I am hitting the sack. have a good night/day wherever you are!
 
Ok - here she is....thanks!

I also checked which services are being run by the svchost.exe (in process explorer) - one of them is Windows Audio (and I cannot seem to use my volume up/down buttons on my keyboard to change the sound level anymore (only using my mouse in the actual 'volume' control in the system tray works).

other processes in there are the DHCP client, Network connections and Windows Automatic Updates. not sure if this helps, but thought I'd share the information ;)
 

Attachments

  • ComboFix.txt
    29.4 KB · Views: 1
Looks good :)

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

=======================================================================

Let's try something....

Go Start>Run (Start Search in Vista), type in:
msconfig
Click OK (hit Enter in Vista).

Click on Startup tab.
Click Disable all
IMPORTANT! In case of laptop, make sure, you do NOT disable any keyboard, or touchpad entries.

Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.

Click OK.
Restart computer in Normal Mode.

NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
If you use Windows firewall, you're fine.

Post Process Explorer log.
 
Done!

one new thing: I got a Windows Genuine Advantage screen after restarting - asking me to install some anti-piracy software that checks for legitimate versions etc. I pressed cancel and it closed. may not be anything, but thought I'd mention it.
 

Attachments

  • Procexpmsconfig.TXT
    3.6 KB · Views: 1
1. Update MBAM and run "Quick scan". Post its log.

2. Process Explorer log looks perfect.
You'll have some work to do then, but run MBAM first.
When done, go back to "msconfig" and start re-enabling processes and startups, you just disabled, BUT one by one.
Re-enable one process, restart computer, run PE.
If System Idle Process stays over 90%, re-enable next process. Restart.
Same with startups until you'll find a culprit, which knocks System Idle Process under 90% by a good margin.
 
ok - i dont mind doing some work :)

mbam log clean (and scan was super quick for a change!)

I assume for the msconfig part that I must always hide the Microsoft Services and just deal with the others?
 
Status
Not open for further replies.
Back