Iexplorer.exe win32/heur cannot be removed

By icec0rpse · 7 replies
Jun 22, 2009
  1. I'm relatively new to removing trojans.
    Was found here:
    "C:\Program Files\Internet Explorer\iexplore.exe (1992)";"Virus found Win32/Heur";""

    I'll attach a hijackthis log. I honestly have no clue how to remove this virus. I am hesitant to delete random stuff so I'll leave it to the experts.
  2. touch

    touch TS Rookie Posts: 978

    Hello icec0rpse

    Please download combofix here ->
    Before Saving it to Desktop, please rename it to to stop malware from disabling it.

    Now, please make sure no other programs are running, close all other windows.

    Please double click on the file you downloaded. Follow the onscreen prompts to start the scan.
    Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall.
    It may take a while to complete scanning and this is normal.

    You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after
    scanning has completed.

    Combofix will create a logfile and display it after your computer has rebooted.
    Usually located in c:\combofix.txt, please attach it to your next post
  3. icec0rpse

    icec0rpse TS Rookie Topic Starter


    After fighting with avg, i finally got combofix to run. Here is the coveted log.
    Thanks again for helping me so quickly!
  4. touch

    touch TS Rookie Posts: 978

  5. icec0rpse

    icec0rpse TS Rookie Topic Starter


    Alright, done. I recently installed Internet Explorer 8.
  6. touch

    touch TS Rookie Posts: 978

    Have hijackthis to fix:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

    Viewpoint is considered foistware and is not needed on your computer.

    Download and unzip ViewpointKiller to own folder on Desktop - Here
    Run ViewpointKiller.exe

    Reboot, and tell how yhings are running now ?
  7. icec0rpse

    icec0rpse TS Rookie Topic Starter


    The system is running with some snap now! I can't thank you enough for the your help. Is there anything else we need to do?
  8. touch

    touch TS Rookie Posts: 978

    That´s good news :)

    Just the cleanup procedure ->

    You should Create a New Restore Point to prevent possible reinfection from an old one.
    The easiest and safest way to do this is:
    Go to Start > All Programs > Accessories > System Tools > System Restore
    Select Create a restore point, and Ok it.
    Next, go to Start > Run and type in cleanmgr
    Select the More options tab
    Choose the option to clean up system restore and OK it.

    This will remove all restore points except the new one you just created.

    Click START then RUN
    Now type Combofix /u in the runbox and click OK.
    Note the space between the X and the U, it needs to be there.
    When shown the disclaimer, Select "2"
    The above procedure will:
    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present.
    The C:\Deckard folder, if present.
    The C:_OtMoveIt folder, if present.
    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.

    To learn more about how to protect yourself while on the internet, please read Tony Klein´s guide:
    How did I get infected in the first place?

    Keep safe :wave:
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...