Solved Multiple instances of iexplore.exe

[Glowball]

Hi all, I've noticed my machine slowing down and a high CPU usage lately. I think that one of the symptoms is multiple iexplore.exe instances running. I can see them in the Task Manager, though they do not open visible windows. When I open Internet Explorer myself, it almost always tells me that the last session closed unexpectedly. It hasn't done this before, but it seems to be having an issue. After doing some research it seems that I might have some malware.

I did the eight steps and I've attached the logs. I have no other symptoms like popup windows or anything, just a high CPU usage. What should I do? Thanks!

 

[Broni]

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

 

[Glowball]

Hi Broni! Here's what I get. My C: drive is actually two mirrored drives. My Y: drive is a dynamic drive spanned across two drives (each drive is 232GB for a total of 464GB), and my Z: drive is just a basic, single drive. All of them are SATA.

MBRCheck, version 1.1.1

(c) 2010, AD



\\.\C: --> \\.\PhysicalDrive0

\\.\Y: --> \\.\PhysicalDrive2

\\.\Z: --> \\.\PhysicalDrive1



Size Device Name MBR Status

--------------------------------------------

931 GB \\.\PhysicalDrive0 Error reading raw MBR!

232 GB \\.\PhysicalDrive2 Error reading raw MBR!

931 GB \\.\PhysicalDrive1 Error reading raw MBR!





Done! Press ENTER to exit...

 

[Broni]

OK. I'm not very familiar with dealing with mirrored, or spanned drives, so I'm not sure, If MBRCheck reading is caused by your drives configuration, or there is really something malicious in MBR code.
We have to proceed carefully then. I don't want to make your computer un-bootable.

I have to ask you couple of questions then.
- you see iexplore.exe processes running even without IE being actually open?
- are you getting any IE pop-ups?
- is your sound getting muted?

 

[Glowball]

Just now, I opened Task Manager and there were 5 instances of iexplore.exe though I only have one window open with a few tabs. I closed my instance and checked Task Manager, and there was still one running. I opened Internet Explorer again and only one more iexplore.exe was added. So now I just have two running. But there should be a few more pretty soon.

I'm not getting any pop-ups.

I don't listen to much on my PC but I haven't noticed any fluctuation with the sound.

 

[Broni]

OK. That's good.
IE8 is different, then previous IE versions and it'll have 2 instances of iexplore.exe process running, just when opened. Every tab will add another process, so you may be OK here, but we'll keep checking.

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:



netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs



* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

 

[Glowball]

I just noticed something weird. In my IE instance I opened a new tab and there was another iexplore.exe that appeared in Task Manager. I opened another tab and the same thing happened. But then a third tab didn't open another iexplore.exe. The fourth tab did it, though. Then I individually closed all of those additional tabs but the iexplore.exe instances didn't go away. I only have this one tab open but I have 5 iexplore.exe instances in Task Manager.

Is this just a case of me not understanding how IE works? Does it run a separate process for each tab? I opened a completely new IE window and it didn't start another iexplore.exe in Task Manager.

I was noticing that my computer was slowing down at times so I originally checked in Task Manager to see if I had something weird happening. That's when I noticed all of the iexplore.exe processes.

 

[Broni]

I don't use IE much (at all!), but I just checked and...

Then I individually closed all of those additional tabs but the iexplore.exe instances didn't go away.

Same here.

I opened another tab and the same thing happened. But then a third tab didn't open another iexplore.exe. The fourth tab did it, though.

Pretty much same here. It seems to depend, if the link is an external, or internal link.

Let's see what OTL will show.

 

[Glowball]

It won't let me paste the text in because it's too long. I've attached the logs instead. Good to hear that your IE does the same things! Maybe I'm chasing the wrong issue...

 

[Broni]

Update your Java version here: http://www.java.com/en/download/installed.jsp
During installation, make sure to UN-check any pre-checked extra "garbage" installation, like Yahoo toolbar, or others.
Uninstall all previous Java versions, through Add\Remove (Programs & Features in Vista/7).

=======================================================================

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  O4 - HKLM..\Run: []  File not found
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
  O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.)
  O18:[b]64bit:[/b] - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
  O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
  O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
  O20:[b]64bit:[/b] - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab)
  O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
  O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
  
  
  :Services
  
  :Reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
  "DisableMonitoring" =-
  
  :Files
  
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [resethosts]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• You will get a log that shows the results of the fix. Please post it.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

 

[Glowball]

Could you tell me a bit about what the OTL fix will do before I do this? I'm going to run a backup before I do that, so it'll take me a little while before I get back with you. Thanks!

 

[Broni]

I don't see anything malicious there.
We're mostly removing garbage, dead entries and one incorrect registry entry.

 

[Glowball]

I ran OTL like you instructed and I got an alert box that read "Cannot create file C:\Windows\System32\drivers\etc\Hosts." I clicked "OK" and OTL has the message at the bottom that says "Resetting HOSTS file. DO NOT INTERRUPT..." and it has had that message for about 10 minutes now. It's definitely stuck.

What should I do?

 

[Broni]

Run OTL

Try again, but this time right click on OTL and click 'Run As Administrator".
If still no go, remove [resethosts] line from my script.

 

[Glowball]

I had to remove the [resethosts] line -- I've been running everything as Administrator, just to be safe. Here's the first log.

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Starting removal of ActiveX control Garmin Communicator Plug-In
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Garmin Communicator Plug-In\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ not found.
File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon\ not found.
File move failed. C:\Windows\SysNative\klogon.dll scheduled to be moved on reboot.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\\DisableMonitoring not found.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Monica
->Temp folder emptied: 431 bytes
->Temporary Internet Files folder emptied: 985165 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1860 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Monica
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 07192010_224700

Files\Folders moved on Reboot...
File move failed. C:\Windows\SysNative\klogon.dll scheduled to be moved on reboot.
File\Folder C:\Users\Monica\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File\Folder C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-2588.log not found!

Registry entries deleted on Reboot...

 

[Broni]

...and:

Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

 

[Glowball]

It's attached.

 

[Broni]

Excellent

Last scan....

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.


2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

• Spyware, Adware, Dialers, and other potentially dangerous programs
  [*] Archives
  [*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

 

[Glowball]

I ran TFC but I can't run the Kaspersky Online Scanner because I have Kaspersky Internet Security 9.0 installed. Should I just run a Kaspersky scan the regular way? Or something else?

 

[Broni]

Sorry for that...

Please run a free online scan with the ESET Online Scanner

• Disable your antivirus program
• Tick the box next to YES, I accept the Terms of Use
• IMOPRTANT! UN-check Remove found threats
• Click Start
• Accept any security warnings from your browser.
• Check Scan archives
• Click Start
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push List of found threats
• Push Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

 

[Glowball]

C:\Users\Monica\Downloads\Nero\Nero-9.4.13.2_update.exe Win32/Toolbar.AskSBar application
C:\Users\Monica\Web\_Etc\_Archive\RonsAdvice.com\_work\_mail_050612\inbox multiple threats

One of these is an update from Nero. I know that the update asks you if you want to install a toolbar for IE, and I said "no" to that one. The other is a file from 2005 that I've had on various installations since then, so it probably isn't causing any issues.

I can get rid of both. Should I do that?

 

[Broni]

This is just downloaded update file:

C:\Users\Monica\Downloads\Nero\Nero-9.4.13.2_update.exe Win32/Toolbar.AskSBar

so you can simply delete that update file from "Downloads" folder and empty recycle bin.

The other:

C:\Users\Monica\Web\_Etc\_Archive\RonsAdvice.com\_work\_mail_050612\inbox

looks like some of your old mail, so if you don't have anything important there, delete it.

Then....

OTL Clean-Up
Clean up with OTL:

* Double-click OTL.exe to start the program.
* Close all other programs apart from OTL as this step will require a reboot
* On the OTL main screen, press the CLEANUP button
* Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

===================================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista and 7:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

 

[Glowball]

I'll do all of this ASAP and report back when I'm done. Thanks for your help!

 

[Broni]

You're very welcome

 

[Broni]

The issue appears to be resolved.