Okay, I have 2 processes of IEXPLORE.EXE in my task manager, and they wont go away when i try to end process on them. i ran AVG Anti-Spyware and cleaned what it found, also ran AVG Free Anti-Virus, it found nothing, i ran HIJACKTHIS. And well need a little help with it, i attached the log file. i tried as i saw in another post somewhere to go into the Internet Explorer folder and rename IEXPLORE.EXE and it just recreated the file soon after. Thanks in advance

Joe.

Attached Files

hijackthis.log (10.3 KB, 20 views)

[B]Hello and welcome to Techspot.[/B]

Your system is infected with several nasties.

[b][color=red]Very Important:[/color] Before deciding whether you should clean or reformat your system, go and read this thread [b][URL="http://www.techspot.com/vb/topic65943.html"][color=blue]HERE[/color][/URL][/b] and decide what it is you want to do.[/b]

If after reading the above, you wish to clean your system, do the following.

Download LSPFix from [url]http://cexx.org/lspfix.htm[/url]
1. Disconnect from the Internet, go to the LSPfix file and extract/unzip LSP-Fix into its own folder [C:\lspfix].
2. Open the lspfix folder and double-click on LSPFix.exe to start the program.
3. Check the "I know what I am doing" checkbox.
4. Select (highlight) all instances of 'rlls.dll' in the left column under "Keep".
5. Click the arrow >> so it goes over to the right column under "Remove".
6. Click "Finish" and LSPfix will remove references to the file and restore the chain numbers.
7. Restart your computer

[b]In Windows Explorer, turn on "Show all files and folders, including hidden and system".[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial62.html"]HERE[/URL].

Locate and delete the following [b]bold[/b] file(if there).

C:\Windows\System32\[b]rlls.dll[/b]

Rehide your protected OS files and reconnect to the net.


Then, go and read the [b][URL="http://www.techspot.com/vb/topic58138.html"]Viruses/Spyware/Malware, preliminary removal instructions.[/URL][/b] Follow all the instructions exactly.

Post fresh [b]HJT[/b] and [b][color=red]AVG Antispyware[/color] logs as attachments[/b] into this thread, only after doing the above.

Regards Howard

[color=red][b]This thread is for the use of[/color] Vudew [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

I have 2 and XP.Thats what makes your computer operate.
I think they have to be running.
My cpu useage is 1 to 3 % right now.
What problems do you think this is causing ?
If you mean named ? Iexplorer ?

Ok, firstly in reply to Howard, i followed all the intructions, except for one, near the end where it says to download http://download.bleepingcomputer.com/sUBs/combofix.exe when i finish downloading it it brings up a txt file that is attached ( notice.txt ). Thanks and sorry took so long to reply.. that stuff takes a LONG time in safe mode, lol, oh and virus scan found nothing. but the two IEXPLORE.EXE processes are still running. as far as firewall, I am behind a Sonicwall Pro 3060 Hardware firewall currently.

Now in reply to Zipperman. IEXPLORE.EXE is not what runs windows, EXPLORER.EXE is. IEXPLORE should only be running when internet explorer is. and should not re-run itself when you close it in task manager.

Attached Files

	hijackthis.log (9.9 KB, 4 views)
	Report-Scan-20070215-134047.txt (79.9 KB, 2 views)
	notice.txt (331 Bytes, 1 views)

The situation with Combofix was only discovered yesterday. See this info [URL="http://www.techspot.com/vb/topic70127.html"]HERE[/URL].

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

[b]Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT).[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial61.html"]HERE[/URL].

[b]In Windows Explorer, turn on "Show all files and folders, including hidden and system".[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial62.html"]HERE[/URL].

Delete all files in AVG Antispyware quarantine.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Viewpoint
Viewpoint Manager

Close control panel.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

Viewpoint Manager Service

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

ViewpointService.exe
AXISNEW.exe
ViewMgr.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R3 - URLSearchHook: (no name) - - (no file)

O4 - HKCU\..\Run: [book ante] C:\DOCUME~1\Vudew\APPLIC~1\ELSEPL~1\AXISNEW.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following [b]bold[/b] files and/or directories(if there).

C:\Program Files\[b]Viewpoint[/b]<Delete the entire folder.
C:\DOCUME~1\Vudew\APPLIC~1\[b]ELSEPL~1[/b]<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log.

Regards Howard

[color=red][b]This thread is for the use of[/color] Vudew [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

new HJT log..

Attached Files

hijackthis.log (9.3 KB, 4 views)

Your HJT log is now clean as a whistle.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

[color=red][b]This thread is for the use of[/color] Vudew [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

Yay, thanks heaps! and both the iexplore processes are gone! YAY.. ok now the question is, how would be best to go about keeping it clean?.. and is there anything i can do to keep tabs of what people like my wife and her friends install on the comp when i'm not there? ... oh and one last thing, am gunna run HJT and such on my desktop at home and was wondering if i should post it here or make a new thread since its a diff comp? thanks in advance.

Joe.

Please feel free to post your HJT log from your desktop into this thread.

For info on how to keep your computer safe, see this thread [URL="http://www.techspot.com/vb/topic31474.html"]HERE[/URL].

Regards Howard

[color=red][b]This thread is for the use of[/color] Vudew [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

Yes your right,i was here when i checked.When i close my browser their not listed.Sorry i can't be of more help.

ahh... for some reason my laptop isnt detecting my wireless network... i cant figure it out, please help.

Post a fresh HJT log and I`ll see if any nasties are present.

Regards Howard

[color=red][b]This thread is for the use of[/color] Vudew [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

i cant.. cant connec to the inet on my laptop, lol, am on the desktop now.. for some reason it wont detect any networks, i thought it was just at work and was gunna take a look at our wireless router ( i'm the only one who ever uses it so i didnt make a priority of it ) but i get home and its the same thing, as if nothing is around, then i click to change preffered networks to see if thats it and it gives me the authentication tab on the properties of the connection. i never messed with this part beforesays EAP: Type Smart card or other certificate. and to enable IEEE 802.1x authentication for this netowrk.

Ok, I think you need to open a new thread for your problem in our [URL="http://www.techspot.com/vb/menu35.html"]Mobile Computing[/URL] forum.

Regards Howard

[color=red][b]This thread is for the use of[/color] Vudew [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/color][/b]

i have the same iexplorer.exe problem =/ when i try to end process they just come up again =/

Attached Files

hijackthis.log (6.1 KB, 1 views)

I havn't seen any mention of what problems this is causeing with
Browsing with Internet Explorer.
What are you trying to "end" ?

sorry, i meant iexplore.exe. when i go into task manager and click processes theres two iexplore.exe running, one uses more memory than the other and they keep continuing to use more. when i try to end the one that uses the most memory nothing happens. when i try to end the one that uses the least it goes away then comes back up again. =/ its quite annoying bc ive been trying to install stuff and it says it cant bc internet explorer is running (which it isnt. and i use firefox anyway).

I know you meant iexplorer.Just want to be sure we are talking about you Internet Browser.Does it affect firefox.
What is listed in Applications ?
Is it there twice ?
Check and set your default Browser.

Attached Images

Defaults.jpg (69.1 KB, 2 views)

firefox isnt affected in any way whatsoever. infact i was unaware untill i tried to install something and it said it couldnt install bc internet explorer was open (which it wasnt). its there twice. my defaults are set to custom and everythings set to use the current web browser/email programme...etc.

edit: internet explorer isnt listen in applications

You are haveing problems installing software.
Why have you concluded it was IEx listed twice ?
It's an install problem .Start a new post on this problem with details
and error messages.