TechSpot

Multiple iexplore.exe in task manager (a.k.a. is there an echo in here?)

Solved
By drvodka
Jul 24, 2010
  1. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    No reason to feel bad.
    Since I know your computer situation pretty well, it's easier to talk to me, than start a new topic.

    Close Firefox. Go Start>All Programs>Mozilla Firefox, click on Mozilla Firefox (safe mode). Same thing?
     
  2. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    yeah - same problem - machine running at 90%+ just with these two tabs open.
     
  3. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    What do you mean by "machine running at 90%"?
     
  4. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    CPU Useage in Task Manager is up at 90% or higher when youtube is playing. when it stops, it drops to 50%.
     
  5. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    Depending on video, when I play it my CPU usage ranges from 40% to 90%.
    However 50% usage with nothing playing seems too high.

    Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
    Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
    Click on View > Select Colunms.
    In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
    Go File>Save As, and save the report as Procexp.txt.
    Attach the file to your next reply.

    Post couple of logs.
    - nothing opened
    - Firefox opened
    - Firefox playing uTube video
     
  6. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    Three attached: one with just this web browser open (firefox.txt); one with this tab and youtube playing music (youtube.txt) and then finally one with nothing (nothing.txt).

    You have WAY too much patience for one person :)
     

    Attached Files:

  7. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    I don't like it.
    Firefox playing uTube and using 43% looks normal, but on a top of it we have a combination of services.exe and svchost.exe using another 40%, or so (no matter, Firefox on, or not).

    You either got reinfected, or we missed something.

    We need to re-run some scans.

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  8. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    do I need to turn off Windows firewall? it isnt on the list...
     
  9. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    No. That would be dangerous. AV only.
     
  10. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    glad I asked :)

    this may take a while based on historical scans - see you on the other side!
     
  11. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    Hahaha........
     
     
  12. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    my machine MUST be better though - scan completed in record time :)

    it didnt recommend a reboot - should I?
     

    Attached Files:

  13. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    You don't have to, because Combo didn't find anything.
    Let me see, what you got there...
     
  14. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    I don't see much, just one leftover, but we better get rid of it...

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\system32\braviax.exe
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "braviax"=-
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  15. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    ok - thanks again Broni. I'll let this one run through the night as I am hitting the sack. have a good night/day wherever you are!
     
  16. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    No problem :)
    See ya tomorrow...
     
  17. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    ok - here she is....thanks!

    I also checked which services are being run by the svchost.exe (in process explorer) - one of them is Windows Audio (and I cannot seem to use my volume up/down buttons on my keyboard to change the sound level anymore (only using my mouse in the actual 'volume' control in the system tray works).

    other processes in there are the DHCP client, Network connections and Windows Automatic Updates. not sure if this helps, but thought I'd share the information ;)
     

    Attached Files:

  18. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    Looks good :)

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start>"Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall"
    Click OK (Vista users - press Enter).
    Restart computer.

    =======================================================================

    Let's try something....

    Go Start>Run (Start Search in Vista), type in:
    msconfig
    Click OK (hit Enter in Vista).

    Click on Startup tab.
    Click Disable all
    IMPORTANT! In case of laptop, make sure, you do NOT disable any keyboard, or touchpad entries.

    Click Services tab.
    Put checkmark in Hide all Microsoft services
    Click Disable all.

    Click OK.
    Restart computer in Normal Mode.

    NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
    If you use Windows firewall, you're fine.

    Post Process Explorer log.
     
  19. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    done!

    one new thing: I got a Windows Genuine Advantage screen after restarting - asking me to install some anti-piracy software that checks for legitimate versions etc. I pressed cancel and it closed. may not be anything, but thought i'd mention it.
     

    Attached Files:

  20. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    1. Update MBAM and run "Quick scan". Post its log.

    2. Process Explorer log looks perfect.
    You'll have some work to do then, but run MBAM first.
    When done, go back to "msconfig" and start re-enabling processes and startups, you just disabled, BUT one by one.
    Re-enable one process, restart computer, run PE.
    If System Idle Process stays over 90%, re-enable next process. Restart.
    Same with startups until you'll find a culprit, which knocks System Idle Process under 90% by a good margin.
     
  21. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    ok - i dont mind doing some work :)

    mbam log clean (and scan was super quick for a change!)

    I assume for the msconfig part that I must always hide the Microsoft Services and just deal with the others?
     
  22. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    forgot log.
     

    Attached Files:

  23. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    Exactly.
     
  24. drvodka

    drvodka TS Rookie Topic Starter Posts: 62

    see you in three weeks when I'm done! ;)
     
  25. Broni

    Broni Malware Annihilator Posts: 47,082   +259

    Looooooooooool
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.