TechSpot

Two Processes of IEXPLORE.EXE in task manager processes

By neel_saraiya
Apr 6, 2008
  1. I have 2 processes of IEXPLORE.EXE in my task manager, and they wont go away when i try to end process on them.
    I have norton internet security 2006 installed updated it and scanned but no virus found.read in ur forum that it should not be used for net banking but my dad uses it so would be helpful if u could guide me how to solve this problem.

    Will a system restore work in this case.???
     
  2. kritius

    kritius TS Guru Posts: 2,087

    The first thing that I need you to do for me is to download and install HijackThis for me,

    Highjackthis Instructions
    • Make sure you have the LATEST version of HJT (currently v2.0.2) it can be downloaded from HERE
    • Run the HijackThis Installer and it will automatically place HJT in its own folder, usually C:\Program Files\Trend Micro\HijackThis. Please don't change the directory as it is necessary to create backups.
    • After installing, the program launches automatically, select Scan now and save a log
    • After the scan is complete attach the log with your reply.
    Do not attempt to fix any item yet.
    Do not add anything to the ignore list.
    Don't use the AnalyseThis button, its findings are dangerous if misinterpreted.

    Hijackthis will give me an idea as to what nasty things there are lurking about in your system and will help the both of us get rid of them.

    If you have any problems or questions then please post back.
     
  3. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    Hijachthis log

    hey kritius thanks a lot for helping i m attaching the log file created by hijack this
     

    Attached Files:

  4. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    Hijachthis log

    hey kritius thanks a lot for helping i m attaching the log file created by hijack this
     
  5. LookinAround

    LookinAround TechSpot Chancellor Posts: 8,395   +169

    ummm... where did you see you shouldn't have more then one iexplorer process?

    I don't believe that's true.. certainly for IE7 on XP. kritius or anyone else who wants to comment?

    /*** Edit ***/
    OK. Never mind. Having more then one iexplorer is not itself a problem but i see you're also having trouble killing them..
     
  6. Mictlantecuhtli

    Mictlantecuhtli TS Evangelist Posts: 4,916   +9

    Boot to safe mode, run HJT, and fix the following:

    R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll

    O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
    O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data\third lies itch ford\Mail load.exe
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

    O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe


    And so much other junk running, not that harmful though...
     
  7. kritius

    kritius TS Guru Posts: 2,087

    Before doing that, go to add/remove programs and look for,
    Search Settings
    RegistryBooster 2
    OneStep Search Service
    Remove them

    O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
    O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data\third lies itch ford\Mail load.exe
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O23 - Service: OneStep Search Service - OneStepSearch.net, Inc. - C:\Program Files\OneStepSearch\onestep.exe

    Delete the foolowing,

    C:\Documents and Settings\All Users\Application Data\third lies itch ford <-==This folder,
    C:\Program Files\OneStepSearch<-==This folder,
    C:\Program Files\Uniblue\RegistryBooster 2<-==This folder,
    C:\Program Files\Search Settings<-==This folder,
    C:\Program Files\OneStepSearch<-==This folder,


    O4 - HKLM\..\Run: [Itch ford four knob] C:\Documents and Settings\All Users\Application Data\third lies itch ford\Mail load.exe

    This looks like a lop infection.

    Download and Run NoLop
    Please Download NoLop to your desktop from one of the links below...
    Link 1
    Link 2
    Link 3
    • First close any other programs you have running as this will require a reboot
    • Double click NoLop.exe to run it.
    • Now click the button labelled "Search and Destroy"
      (your computer will now be scanned for infected files)
    • When scanning is finished you will be prompted to reboot only if infected, Click OK
    • Now click the "REBOOT" Button.
    • A Message should popup from NoLop. If not, double click the program again and it will finish.
    • Please attach the C:\NoLop.log later.
    Note: If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to C:\WINDOWS\system32\ folder then rerun the program.
     
  8. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    Nolop log attached

    hey did everything wat u said and now i have attached the nolop log
    now wen i start my computer and check processes then only one iexplore.exe is running but dont knw even y that one is running
    wen i end process that one it closes and does not start again unlike the earlier ones
     
  9. kritius

    kritius TS Guru Posts: 2,087

    : Download and Run DSS

    Download Deckard's System Scanner (DSS) to your Desktop. You must be logged onto an account with administrator privileges.
    • Close all applications and windows.
    • Double-click on dss.exe to run it, and follow the prompts.
    • When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<- this one will be minimized.
    • Attach the main.txt and the extra.txt in your reply.
     
  10. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    attatched log files

    hey i have attached the necessary log files
     
  11. kritius

    kritius TS Guru Posts: 2,087

    Ill post back results later, im in work at the minute.
     
     
  12. jobeard

    jobeard TS Ambassador Posts: 13,469   +327

    these are certainly suspect

    2008-04-07 00:00:38 705 --a------ C:\d1.exe
    2008-04-07 00:00:29 2 --a------ C:\-1608041051
    2008-04-07 00:00:26 6656 --a------ C:\jgkpt.exe
    2008-04-07 00:00:23 125440 --a------ C:\vwhfxvxv.exe

    I would verify this too: C:\wallpaperviews.vbs

    autorun from a mounted drive looks suspect:

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fe69f28-80b6-11dc-8230-0019d1653d9e}]
    AutoRun\command- I:\b.com
    explore\Command- I:\b.com
    open\Command- I:\b.com​
     
  13. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    k so now wat should i do could u just help me out i need to fix this issue as soon as possible please could u help me
     
  14. kritius

    kritius TS Guru Posts: 2,087

    Can you please be patient, everyone here is a volunteer and everybody whos brings their problems here thinks that their need id the most urgent.

    You should get a firewall as well, either, these firewalls are all free,

    Fix entries using HiJackThis
    • Launch HiJackThis
    • Click the Do a system scan only button
    • Put a check next to the entries listed below
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O4 - HKCU\..\Run: [Tick Sixth] C:\DOCUME~1\Neel\APPLIC~1\GPLAXI~1\Time Axis.exe

    • IMPORTANT: Do NOT click fix until you exit all browser sessions including the one you are reading in right now
    • Click the Fix checked button and close HiJackThis
    • Reboot HijackThis if necessary

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      C:\d1.exe
      C:\-1608041051
      C:\jgkpt.exe
      C:\vwhfxvxv.exe
      C:\WINDOWS\system32\zip.exe
      C:\WINDOWS\system32\sed.exe
      C:\WINDOWS\system32\grep.exe
      C:\WINDOWS\system32\fdsv.exe 
      C:\wallpaperviews.vbs
      C:\DOCUME~1\Neel\APPLIC~1\GPLAXI~1
          
    • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and attach that document back here in your next post.


    After this run a fresh HijackThis scan and post back.
     
  15. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    hijack this log

    hijack this log and all files were successfully moved i assure that
     
  16. kritius

    kritius TS Guru Posts: 2,087

    Why did you not post the report for me?

    • Navigate here using Windows Explorer (windows button + E) or My Computer -> Local Disk C: -> C:\Program Files\Trend Micro\HijackThis
    • Right-click on the HijackThis.exe
    • Choose from the pull-down menu; "Rename"
    • And now Rename HijackThis.exe to saraiya.exe
    • When you've renamed HijackThis, open HijackThis again.
    • Take a fresh HijackThis log (click Do a system scan and save a log file)
    • Post the fresh HijackThis log here.

    I would like you to do an online scan so that we can what else may be in your system,
    Run Kaspersky online scanner
    With the exception of Internet Explorer, which must be used for this scan, keep ALL programs closed
    Note: It is recommended to disable onboard antivirus program and antispyware programs while performing scans to speed up scan time and to make sure there are no conflicts.
    Do not go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable resident antivirus protection along with whatever antispyware application you use.


    Do an online scan with Kaspersky Online Scanner in Internet Explorer. You will be prompted to install and run an ActiveX component from Kaspersky, Click Yes.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75%. Once the licence accepted, reset to 100%.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      o Scan using the following Anti-Virus database:
      o Extended (If available, otherwise use standard)
      o Scan Options:
      o Scan Archives
      o Scan Mail Bases
    • Click OK
    • Under select a target to scan, select My Computer
    • The scan will take a while so be patient and let it run.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)

      [​IMG]
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file
    • In the Save as type prompt, select Text file (see below)

      [​IMG]
    • Include the report in your next post.
     
  17. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    kaspersky and hijackthis log

    kaspersky and hijackthis log
     
  18. kritius

    kritius TS Guru Posts: 2,087

    Instructions to follow.
     
  19. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    hey can u tell me which instructions to follow please
     
  20. kritius

    kritius TS Guru Posts: 2,087

    When im finished coming up with them then I will.
     
  21. kritius

    kritius TS Guru Posts: 2,087

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5 <======== Delete the contents of this folder
    C:\Documents and Settings\Neel\Desktop\BLACK\StyleXP_3.19_Full_KeyGen .rar<================Delete this file
    C:\Documents and Settings\Neel\Desktop\Style XP\StyleXP319-Kg\Keygen.exe<================Delete this file
    C:\Program Files\Circle Developement<================Delete this file
    C:\QooBox\Quarantine<======== Delete the contents of this folder
    C:\WINDOWS\Help\SETUP.EXE<================Delete this file
    C:\WINDOWS\Installer\2df3b9d.msi<================Delete this file
    D:\Neel\Mobile\Ngage\sysiconzngage..sis<================Delete this file
    D:\Neel\Setup\Softwares\BitLord_1.1.exe/file9<================Delete this file
    D:\Neel\Setup\Softwares\xilisoft 3gp video converter.rar<================Delete this file

    • Double-click OTMoveIt2.exe.
    • Click the CleanUp! button.
    • Select Yes when the "Begin cleanup Process?" prompt appears.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes, if not delete it by yourself.

    Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt2 attempting to contact the internet, please allow it to do so.

    • Disable and Enable System Restore. - If you are using Windows XP or Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

      You can find instructions on how to enable and re-enable system restore here:

      Windows XP System Restore Guide

      or

      Windows Vista System Restore Guide

    Re-enable system restore with instructions from tutorial above
     
  22. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    hey i would like to tell u there are now none iexplore.exe in task manager processes but wen scanned with that kaspersky online it found 19 viruses
     
  23. kritius

    kritius TS Guru Posts: 2,087

    if you deleted the files and folders that I told you to, used the CleanUp! button in OTMoveIt2.exe and disabled and re enabled system restore then you should have none now, that will have gotten them all.
     
  24. neel_saraiya

    neel_saraiya TS Rookie Topic Starter Posts: 19

    hey done all of it could you suggest me some nice antivirus pls
     
  25. kritius

    kritius TS Guru Posts: 2,087

    If you choose one of these remember to completely unistall Norton from your system.



    You should get a firewall as well, either, these firewalls are all free,

    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.

    • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
    • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

      This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

      Instructions for Spybot S & D

    • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.

    Here are some additional utilities that will enhance your safety

    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
      Using Winpatrol to protect your computer from malicious software

    Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

    The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

    Also, please read this great article by Tony Klein So How Did I Get Infected In First Place
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.