TechSpot

Multiple IExplore instances badly need help

By santoshakhilesh
Feb 2, 2007
  1. Dear All ,

    I have winXP installed on my system. Whenever I start my machine and connect to net I see multiple instance of iexplore and it will start launching internet explorer with sites like google.cm etc. If I try to kill this from Task manager it reappears and after some time my Explorer.exe crashes and I am virtually no where and can't use my system if I am connected to net.

    If I am not connected to net and plug out the broadband cable everything is ok.

    I tried many things but not able to find any solution.

    I am not even able to log on my PC in safe mode if I try it it boots again and doesn't go to safe mode.

    Let me know what is the option remained for me do I need to reinstall the OS or is there any way to rectify this problem.

    Any help on this is highly appreciated.

    If more information is required please let me know as I am new to this thread and this is my first post.

    Thanks in advance,
    Santosh Akhilesh
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Go and read this thread HERE, then post a HJT log as an attachment into this thread.

    Regards Howard :wave: :wave:

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Log file using hijack

    I am attaching the log. Please let me know if anything else is required.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your system is badly infected with a variety of nasties.

    Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

    If after reading the above, you wish to clean your system, do the following.

    Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    one clarification

    One of the steps says log to the safe mode as I mentioned in the problem I cant log in safe mode. What should I do what is the way around ?
    Thanks
    Santosh
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Ok, forget safe mode for now and follow the instructions from normal mode.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Logs after doing the scans

    I followed the process as explained. However I found problem while running Tool3 I got a Blue screen. Tool 4 never ran it said it will come back after 1 minute which it didn't

    The logs after following other steps is attached.

    I still get the multiple explorer problem and explorer.exe also crashes every now and then.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE. If you still can`t boot into safe mode, follow these instructions from normal mode.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Delete all files in AVG Antispyware quarantine.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    SX Service (SXServ)<Disable the service name and/or the name in brackets.

    VundoFix Service (VundoFixSvc)<Disable the service name and/or the name in brackets.

    Close the services window.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    VundoFixSVC.exe
    sxserv101.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {25C7CE21-E543-46A9-B4B3-01B845B28A6D} - C:\WINDOWS\system32\admparsex.dll

    O2 - BHO: (no name) - {50199D07-4898-C9BE-5AB3-04FB87F26A25} - C:\WINDOWS\system32\zetnqll.dll

    O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00402} - (no file)

    O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00403} - (no file)

    O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\WINDOWS\system32\d3dxofa.dll (file missing)

    O17 - HKLM\System\CCS\Services\Tcpip\..\{0F578712-A37C-4867-9837-75A611B82429}: NameServer = 61.1.96.69,61.1.96.71

    O17 - HKLM\System\CS1\Services\Tcpip\..\{0F578712-A37C-4867-9837-75A611B82429}: NameServer = 61.1.96.69,61.1.96.71

    O17 - HKLM\System\CS2\Services\Tcpip\..\{0F578712-A37C-4867-9837-75A611B82429}: NameServer = 61.1.96.69,61.1.96.71

    O17 - HKLM\System\CS3\Services\Tcpip\..\{0F578712-A37C-4867-9837-75A611B82429}: NameServer = 61.1.96.69,61.1.96.71

    Only fix the above 017 entries if they don`t belong to your ISP.

    O20 - Winlogon Notify: h619 - C:\WINDOWS\g16173390.dll (file missing)

    O20 - Winlogon Notify: wineil32 - wineil32.dll (file missing)

    O23 - Service: SX Service (SXServ) - Unknown owner - C:\WINDOWS\system32\sxserv101.exe (file missing)

    O23 - Service: VundoFix Service (VundoFixSvc) - Unknown owner - VundoFixSVC.exe (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\WINDOWS\system32\sxserv101.exe
    VundoFixSVC.exe<Search your system for this file and delete it.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    These are the filepaths you need to enter into killbox.

    C:\WINDOWS\system32\admparsex.dll
    C:\WINDOWS\system32\zetnqll.dll

    Once your system has rebooted, rehide your protected OS files.

    Post a fresh HJT log.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    When I need to run Killbox , You said download it but don't run. Actually when it should be run ?
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Sorry, I forgot to add the killbox instructions. Fixed now.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Latest hijack file

    Please find the latest hijack file. Now I don't get any multiple iexplore Thanks a million ;-) But is my system clean in latest report.

    One more issue after doing these fixes my pc has started to boot slowly , First I get a blue screen for long time then I get the Task bar and I can use the PC after some 5 mins. Any solution for this ?
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is now clean.

    Download combofix.exe. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "Y" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  13. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Another point before I follow your instruction

    Thanks for your instructions After long time I could able to do something productive with my system this weekend, Thanks a loooooot :)

    I would like to add one more point before I try your instructions.

    I have seen that once I rebooted my system yesterday, I got a BSD indicating some page fault error and some corrupted .sys file. I rebooted again and I didn't find the BSD again atleast till now. I couldn't able to catch the exact error from BSD.

    Is there any way to know what is the problem with my system ?

    Now I am in office and would able to follow you instruction only in evening once I do that I will send you the latest log.

    Thanks again...
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your BSOD`s may be caused by many things, including malware. Once we`ve got rid of any malware you have, we`ll have to see if you still get BSOD`s and what`s causing them.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  15. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Latest log files

    I am attaching latest log files as you asked.
    Regards,
    Santosh
     
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is clean.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Delete the files in Combofix quarantine.

    Locate and delete the following bold files and/or directories(if there).

    C:\QooBox<Delete the entire folder.

    Reboot into normal mode and rehide your protected OS files.

    Let me know if you`re still having problems.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  17. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    I tried to login in safe mode but couldn't, Is there any way to fix this ?

    so I followed the instructions in normal mode.

    I deleted the folder QooBox but where do I find the quarantine folder of Combofix is it the same as QooBox ?

    Now I don't get multiple iExplore
    Regards,
    Santosh
     
  18. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Combofix`s quarantine folder should be in the same directory as Combofix.

    It`s not good that you can`t boot into safe mode. What exactly happens when you try?

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  19. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    I had put the combofix on desktop but I can't see any quarantine folder.

    When I start in safe mode , It starts then it shows the home screen and then it suddenly reboots

    Do I need to run Combofix again putting it in some other directory ?

    Can I create a safe restore point for logging to safe mode ?
     
  20. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Ok, lets try this.

    Go HERE and follow the instructions for the Rustock rootkit removal. I`m not saying you have this infection, but it`s possible.

    Please let me know the results and attach a fresh Combofix log. Don`t worry about the Combofix quarantine folder at the moment.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  21. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Got BSOD

    I got the BSOD after following the latest instruction once I ran the app and it asked me to reboot I got the same BSOD which I was talking about.

    While rebooting Rootkit app tried to delete some sys file and it printed

    Deleting file C:/...../.sys ( I don't exactly remember it) ERROR = 0x.....

    Am I still not clean ? I am kinda worried now of this BSOD

    I am attaching the Combofix log as u said.
     
  22. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I really need to know what .sys file the Rootkit app was trying to delete.

    Also, you haven`t attached the combofix log.

    Go and read this thread HERE and attach your latest five or six mindumps.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  23. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    Not able to attach Log file

    I am not sure why I am not able to attach it by I get this error
    "You have already attached this file in thread : Multiple IExplore instances badly need help"

    I dont find any dumps under windows/minidump folder

    How do you suggest me to find the sys file which it was trying to delete shall I run the tool once again ?
     
  24. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    I have removed all your other attachments, so you should now be able to attach the combofix log.

    Yes, run the Rootkit tool again and let me know the results.

    Regards Howard :)

    This thread is for the use of santoshakhilesh only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  25. santoshakhilesh

    santoshakhilesh TS Rookie Topic Starter Posts: 25

    I have put this under #21 to keep the continuity. Please check it. Meanwhile I will run the rootkit again and tell you the info.

    I rerun the tool this time while shutting don I didnt get any BSOD. The file which it tried to deleting LZX32.sys and it also displayed some error = 0xC0000033
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...