IExplore.exe Malware

Discussion in 'Malware Help (A Specialist Will Reply)' started by _lov3d, Jul 11, 2010.

  1. _lov3d

    _lov3d Private E-2

    So I just got the virus today - the volume suddenly muted (wave turned low) while I was watching a youtube video.

    So I immediately ran CCleaner, but iexplore seemed to be opened and lagging the program, so I went into task manager and ended iexplore.exe. BUT, I noticed that iexplore.exe kept reappearing - and I kept having to end it... I do NOT use Internet Explorer as my browser - I use Google Chrome.

    In the end, I ended loader.exe, and iexplore.exe stopped appearing...
    I don't hear any clicking noises, or see any pop-ups or sense any invisible Internet Explorer browsers either..unlike the symptoms of other people...the volume is staying normal as well - it is no longer adjusting itself to low wave.

    HOWEVER, I ran Bootkit Remover, and I got this:


    Bootkit Remover version 1.0.0.1
    (c) 2009 eSage Lab
    www.esagelab.com

    \\.\C: -> \\.\PhysicalDrive0
    MD5: b19ee33a0168d5f0bb9afbe12e2bc035
    \\.\D: -> \\.\PhysicalDrive0

    Size Device Name MBR Status
    --------------------------------------------
    232 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>


    Press any key to quit...

    I will attach the logs in my next post! Thank you in advance for your help! I really do not want to reformat my computer :(
     
  2. _lov3d

    _lov3d Private E-2

    Okay, I attached the zip file from MGTools. Please help me :(
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do you have all important data backed up? You really should do this before continuing since we will need to rewrite your MBR to fix this and while most times this can be done without any problem, these infections can react badly and that could result in a PC not being bootable. You really don't have much choice though since these infections are too dangerous to your security to leave on a PC.

    Also note if you have a Dell PC which uses a non-standard MBR ( or another manufacturer's who does similar to Dell) , fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not continue but you risk serious problems leaving this infection in place and thus your only other option would be to try using the Dell Restore Utility to return a factory ship state which will remove everything you additional you have put onto the PC.


    Now - please do the following:

    • Click Start, Run then copy and paste the below into the Run box and click OK.

    "%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive0

    • Now reboot your PC and after reboot continue with the below instructions.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  4. _lov3d

    _lov3d Private E-2

    Okay~ I attached the MGlogs.zip file! Thank you so much, please tell me everything is fine :)

    While running the C:\MGtools\GetLogs.bat file, i was asked if i should allow netstat.exe to run (asked by my firewall) - I clicked Yes... I don't know if I should've done that - please tell me I did the right thing :(

    Also, by any chance, do you know what this virus does at all? Am I good to log into personal accounts now? Thanks!
     

    Attached Files:

  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you are now symptom free, as a caution, I would suggest that you use a different computer and change all your online account passwords. This is just a precaution. It is possible that nothing was compromised.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:

     
  6. _lov3d

    _lov3d Private E-2

    Thanks! I did the last steps.

    I am just wondering, are my logs clean? Because recently, when I play Neopets (online site game), this message (security pop-up) constantly appears:

    Adobe Flash Player Security

    The following local application on your computer or network:
    about:blank
    is trying to communicate with this Internet-enabled location:
    spe.atdmt.com

    To let this application communicate with the Internet, click Settings.
    You must restart the application after changing your settings.


    But visiting any other sites is fine...

    I have no idea what the message means...and I haven't heard from anyone else (that plays Neopets) who is getting this message. I am suspecting it may be the ads that are embedded in the Neopets site, but I am not sure. I am not sure if you are familiar with the site, but many people play Neopets (www.neopets.com)...and I consider it to be a safe site, so maybe it is my computer??
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am totally unfamiliar with that message as well as that game. Perhaps someone in the games forum is familiar with it. You might try posting in that forum. ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds