Somethings taken over my IE8 - multiple iexplore.exe, winlogon.exe persistent

brunobru · Jan 22, 2011

Hello MG’s,
I have a problem of new processes and multiple iexplore.exe processes. Also wmpnscfg.exe showed up just recently and is disabled in services and it’s still running; and winlogon.exe (Windows Logon Application) won’t end process through task manager.I have run scans and they found a few things but did not fix the problems (this has been going on for over a week and I have not been able to resolve it). Browsing is slower than usual. F-Secure online scan found a backdoor Trojan. My recent scans are reporting as nothing found however I was not able to run combofix because I received the error message that it conflicts with AVG Internet Security (paid version) and I don’t want to uninstall it because it is also my firewall. Is there another program I could use like Avenger or what should I do? Also, when one tab of IE8 is open it shows two processes in task manager (one high cpu usage and one low), and if I end process of one it will close IE but if I end process on the other nothing happens. If I have two tabs open (therefore 3 iexplore.exe running in TM) and end process, then one tab will start to close but open back up over and over. I Reset IE thinking it might help but it did not. I read that the winlogon.exe windows Logon Application is malware, but my programs are no longer finding malware though it won’t stop in TM. I’ve attached the logs and I included Panda activescan. Root Repeal ran for 4 hours and never finished so I stopped it thinking it shouldn’t take that long, but am I wrong about that? I would appreciate your help. Thank you.

TimW · Jan 22, 2011

Winlogon.exe is a needed windows process. Remove it and your computer is a brick. It is not unusual for IE to have multiple processes running.

You still need to attach the C:\MGLogs.zip from running the C:\MGTools.exe.

wmpnscfg.exe is a process associated with Windows Media Player Network Sharing Service Configuration Application from Microsoft Corp.. It is used to share Windows Media Player libraries.

brunobru · Jan 22, 2011

Yes, I understand what the wmp network sharing service is but I don't use it and it started running on it's own so I stopped the service and disabled it but it's still running in task manager.
Normally, there is only one iexplore.exe running on my pc unless I have more than one tab/window open but anyway it has strange behavior when I try to end the process it pops right back up on it's own like I have no control and this is not how my pc behaves normally.
I guess I'm confused about the winlogon because I read it can be malware as well as the windows logon...I won't worry about it.
I attached the MGlogs log. Thank you for your time and help.

TimW · Jan 22, 2011

Your logs are clean. All I can suggest is that you remove these items:
C:\Windows\Temp\6ba9d0e5-79f0-442a-a349-d6a545ef3e9b
C:\Windows\Temp\f1a974ea-f3c8-4766-8ba5-e8d8cec9ad36

Your other issues are best discussed in the software forum.

Since you are not having any malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

brunobru · Jan 22, 2011

Awesome - Thank you! :-D:-D

I haven't done any banking/financial/important accounts for a week because I didn't know what the malware situation was but a high-five to you for helping me! :wave

TimW · Jan 23, 2011

You are most welcome. It is always best, when you suspect malware on your system to use a different computer and change all your online passwords. Safe surfing.

Log in or Sign up

Somethings taken over my IE8 - multiple iexplore.exe, winlogon.exe persistent

brunobru Private E-2

Attached Files:

mbam-log.txt

SASlog.txt

ActiveScan.txt

RRLog.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

brunobru Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

brunobru Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member