TechSpot

Multiple instances of iexplore.exe

Solved
By Glowball
Jul 19, 2010
  1. Hi all, I've noticed my machine slowing down and a high CPU usage lately. I think that one of the symptoms is multiple iexplore.exe instances running. I can see them in the Task Manager, though they do not open visible windows. When I open Internet Explorer myself, it almost always tells me that the last session closed unexpectedly. It hasn't done this before, but it seems to be having an issue. After doing some research it seems that I might have some malware.

    I did the eight steps and I've attached the logs. I have no other symptoms like popup windows or anything, just a high CPU usage. What should I do? Thanks!
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.
     
  3. Glowball

    Glowball TS Rookie Topic Starter

    Hi Broni! Here's what I get. My C: drive is actually two mirrored drives. My Y: drive is a dynamic drive spanned across two drives (each drive is 232GB for a total of 464GB), and my Z: drive is just a basic, single drive. All of them are SATA.

    MBRCheck, version 1.1.1

    (c) 2010, AD



    \\.\C: --> \\.\PhysicalDrive0

    \\.\Y: --> \\.\PhysicalDrive2

    \\.\Z: --> \\.\PhysicalDrive1



    Size Device Name MBR Status

    --------------------------------------------

    931 GB \\.\PhysicalDrive0 Error reading raw MBR!

    232 GB \\.\PhysicalDrive2 Error reading raw MBR!

    931 GB \\.\PhysicalDrive1 Error reading raw MBR!





    Done! Press ENTER to exit...
     
  4. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    OK. I'm not very familiar with dealing with mirrored, or spanned drives, so I'm not sure, If MBRCheck reading is caused by your drives configuration, or there is really something malicious in MBR code.
    We have to proceed carefully then. I don't want to make your computer un-bootable.

    I have to ask you couple of questions then.
    - you see iexplore.exe processes running even without IE being actually open?
    - are you getting any IE pop-ups?
    - is your sound getting muted?
     
  5. Glowball

    Glowball TS Rookie Topic Starter

    Just now, I opened Task Manager and there were 5 instances of iexplore.exe though I only have one window open with a few tabs. I closed my instance and checked Task Manager, and there was still one running. I opened Internet Explorer again and only one more iexplore.exe was added. So now I just have two running. But there should be a few more pretty soon.

    I'm not getting any pop-ups.

    I don't listen to much on my PC but I haven't noticed any fluctuation with the sound.
     
  6. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    OK. That's good.
    IE8 is different, then previous IE versions and it'll have 2 instances of iexplore.exe process running, just when opened. Every tab will add another process, so you may be OK here, but we'll keep checking.

    Download OTL to your Desktop.

    * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    * Under the Custom Scan box paste this in:



    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\Spool\prtprocs\w32x86\*.dll
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\system32\spool\prtprocs\w32x86\*.tmp
    %systemroot%\*. /mp /s
    /md5start
    /md5stop
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs



    * Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  7. Glowball

    Glowball TS Rookie Topic Starter

    I just noticed something weird. In my IE instance I opened a new tab and there was another iexplore.exe that appeared in Task Manager. I opened another tab and the same thing happened. But then a third tab didn't open another iexplore.exe. The fourth tab did it, though. Then I individually closed all of those additional tabs but the iexplore.exe instances didn't go away. I only have this one tab open but I have 5 iexplore.exe instances in Task Manager.

    Is this just a case of me not understanding how IE works? Does it run a separate process for each tab? I opened a completely new IE window and it didn't start another iexplore.exe in Task Manager.

    I was noticing that my computer was slowing down at times so I originally checked in Task Manager to see if I had something weird happening. That's when I noticed all of the iexplore.exe processes.
     
  8. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    I don't use IE much (at all!), but I just checked and...
    Same here.

    Pretty much same here. It seems to depend, if the link is an external, or internal link.

    Let's see what OTL will show.
     
  9. Glowball

    Glowball TS Rookie Topic Starter

    It won't let me paste the text in because it's too long. I've attached the logs instead. Good to hear that your IE does the same things! Maybe I'm chasing the wrong issue...
     

    Attached Files:

  10. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Update your Java version here: http://www.java.com/en/download/installed.jsp
    During installation, make sure to UN-check any pre-checked extra "garbage" installation, like Yahoo toolbar, or others.
    Uninstall all previous Java versions, through Add\Remove (Programs & Features in Vista/7).

    =======================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O4 - HKLM..\Run: []  File not found
      O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
      O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
      O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB (Reg Error: Key error.)
      O18:[b]64bit:[/b] - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
      O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
      O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
      O20:[b]64bit:[/b] - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab)
      O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
      O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
      
      
      :Services
      
      :Reg
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
      "DisableMonitoring" =-
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [resethosts]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
    • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
     
  11. Glowball

    Glowball TS Rookie Topic Starter

    Could you tell me a bit about what the OTL fix will do before I do this? I'm going to run a backup before I do that, so it'll take me a little while before I get back with you. Thanks!
     
     
  12. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    I don't see anything malicious there.
    We're mostly removing garbage, dead entries and one incorrect registry entry.
     
  13. Glowball

    Glowball TS Rookie Topic Starter

    I ran OTL like you instructed and I got an alert box that read "Cannot create file C:\Windows\System32\drivers\etc\Hosts." I clicked "OK" and OTL has the message at the bottom that says "Resetting HOSTS file. DO NOT INTERRUPT..." and it has had that message for about 10 minutes now. It's definitely stuck.

    What should I do?
     
  14. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Try again, but this time right click on OTL and click 'Run As Administrator".
    If still no go, remove [resethosts] line from my script.
     
  15. Glowball

    Glowball TS Rookie Topic Starter

    I had to remove the [resethosts] line -- I've been running everything as Administrator, just to be safe. Here's the first log.

    All processes killed
    ========== OTL ==========
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Starting removal of ActiveX control Garmin Communicator Plug-In
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Garmin Communicator Plug-In\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Garmin Communicator Plug-In\ not found.
    64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ not found.
    64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ not found.
    File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found.
    64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
    64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon\ not found.
    File move failed. C:\Windows\SysNative\klogon.dll scheduled to be moved on reboot.
    64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
    64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus\\DisableMonitoring not found.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Monica
    ->Temp folder emptied: 431 bytes
    ->Temporary Internet Files folder emptied: 985165 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1860 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 1.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Monica
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.9.1 log created on 07192010_224700

    Files\Folders moved on Reboot...
    File move failed. C:\Windows\SysNative\klogon.dll scheduled to be moved on reboot.
    File\Folder C:\Users\Monica\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
    File\Folder C:\Windows\temp\vmware-SYSTEM\vmware-usbarb-SYSTEM-2588.log not found!

    Registry entries deleted on Reboot...
     
  16. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    ...and:
     
  17. Glowball

    Glowball TS Rookie Topic Starter

    It's attached.
     

    Attached Files:

  18. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Excellent :)

    Last scan....

    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.


    2. Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
  19. Glowball

    Glowball TS Rookie Topic Starter

    I ran TFC but I can't run the Kaspersky Online Scanner because I have Kaspersky Internet Security 9.0 installed. Should I just run a Kaspersky scan the regular way? Or something else?
     
  20. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    Sorry for that...

    Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • IMOPRTANT! UN-check Remove found threats
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Push Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
     
  21. Glowball

    Glowball TS Rookie Topic Starter

    C:\Users\Monica\Downloads\Nero\Nero-9.4.13.2_update.exe Win32/Toolbar.AskSBar application
    C:\Users\Monica\Web\_Etc\_Archive\RonsAdvice.com\_work\_mail_050612\inbox multiple threats

    One of these is an update from Nero. I know that the update asks you if you want to install a toolbar for IE, and I said "no" to that one. The other is a file from 2005 that I've had on various installations since then, so it probably isn't causing any issues.

    I can get rid of both. Should I do that?
     
  22. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    This is just downloaded update file:
    so you can simply delete that update file from "Downloads" folder and empty recycle bin.

    The other:
    looks like some of your old mail, so if you don't have anything important there, delete it.

    Then....

    OTL Clean-Up
    Clean up with OTL:

    * Double-click OTL.exe to start the program.
    * Close all other programs apart from OTL as this step will require a reboot
    * On the OTL main screen, press the CLEANUP button
    * Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    ===================================================================

    Your computer is clean [​IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

    Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista and 7:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    2. Restart computer.

    3. Turn System Restore on.

    4. Make sure, Windows Updates are current.

    5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run defrag at your convenience.

    8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    9. Please, let me know, how is your computer doing.
     
  23. Glowball

    Glowball TS Rookie Topic Starter

    I'll do all of this ASAP and report back when I'm done. Thanks for your help!
     
  24. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    You're very welcome [​IMG]
     
  25. Broni

    Broni Malware Annihilator Posts: 47,066   +257

    The issue appears to be resolved.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.