Help with Malware problem on my PC!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by musicteach09, Feb 22, 2009.

  1. musicteach09

    musicteach09 Private E-2

    Hi! This is my first time posting a to a forum like this. I ran across you guys when I googled "two iexplore.exe processes running" and I have followed the READ & RUN ME to a T in order to solve my problem. I really appreciate this site, and have found it very informative!! Here is some background info:

    For a few weeks now, my IE would work for an hour or so at a time and then just stop running. I would have to re-start my computer, and it would not work, it would simply freeze at the "Logging Off" screen. I would have to power it off manually. This happened over and over. I decided to check my Task Manager, and discovered that even after closing IE, a process continued to run, hogging MAJOR amounts of resources, called iexplore.exe, and I could not end the process. After googling the problem, I found many posts which led me to believe I had a trojan of some sort in my system.

    I downloaded Ad-Aware, as I've had success with it in the past. Sure enough, it found a trojan--I can't remember what it was called exactly, and I removed it from quarantine during the READ & RUN ME process--something like Win32.Inject.Trojan. I quarantined it using Ad-Aware, and thought my problems were solved. But later that night, I noticed the iexplore.exe hog had returned, to my chagrin.

    This is when I googled again and found your READ & RUN ME process. I followed it all step by step to a T, no short cuts, just as instructed, up until Step 4 in the "Vista Cleaning Procedures." Then I waited a day to see if I still had problems. Well, sure enough, the iexplore.exe process has returned, and this time with a vengeance--it's currently hogging over 160,000K!! And I can't end the process.

    So please help me! I am attaching my logs from the READ & RUN ME.
     

    Attached Files:

  2. musicteach09

    musicteach09 Private E-2

    Here is the final log, from MGTools. Again, thank you for your help!
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean.....this is not a malware issue, though I would recommend you uninstall Ad-Aware as it has become a useless program.

    I suggest that you post in the software forum for additional assistance.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
  4. musicteach09

    musicteach09 Private E-2

    Thank you TimW. I guess I should be happy to hear you say that my logs are clean... but it doesn't entirely solve my problem. I have followed your advice, and removed Ad-Aware and have posted to Software for more help. I will keep you posted (pun intended) if they have any malware issues to add.

    Thanks again.
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I took another look at your logs and want you to do this:

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    o If it is not on your Desktop, the below will not work.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
    
    Registry::
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{002e7fa5-77af-11dd-8cde-001ec95142f1}]
    
    
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now attach the new combo log. Sorry for missing this. :(
     
    Last edited: Feb 24, 2009
  6. musicteach09

    musicteach09 Private E-2

    Hi Tim!

    Thanks for taking a second look!! Have I mentioned that you amazing volunteer malware support people ROCK?!?! I can't believe you do this voluntarily. It's wonderful.

    Anyway, I'm happy to hear you found something, actually, because I didn't want to just reformat my computer--too lazy, really. ;)

    Here is my new Combo Fix log. I followed your suggestions exactly... except... sheepishly, I haven't uninstalled Ad-Aware yet, as I know you will find out when looking at the log :-o--just haven't gotten around to it. Have done it with my other PC though. I will soon follow suit with this one.

    Thanks again for the second look!
     

    Attached Files:

  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    That looks like it removed it, so tell me if you are still having problems. Ad-aware is just useless.....but not critical to remove. SAS and MBAM do a far better job.
     
  8. musicteach09

    musicteach09 Private E-2

    Fantastic! I will keep you posted! MANY MANY MANY THANKS!!!!!
     
  9. musicteach09

    musicteach09 Private E-2

    Well, came home today and woke my computer up from sleep... and the internet wouldn't work. Sure enough, closed the browser, and the process was still running and eating up RAM and I couldn't end it. Then the computer wouldn't re-boot again. :cry

    Seems like the problem is still haunting me. But unless you can suggest a simple solution--I think I'll just re-format! Sometimes it's the easiest solution... :banghead
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now that is just rude!! .....Re-run SAS, MBAM and run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

    Is this with IE or a different browser?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds