What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Unwanted iexplore.exe process

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi all, I have a problem with a friend's computer and hope someone can help me (us). It's a Dell Inspiron Laptop, a 510C I think. It's running WinXP SP3, with 256mb ram. Mostly used for the internet (in particular gmail) and office files. The user is generally careful, not downloading or opening mysterious files. Recently it was used at a conference by many attendees and their flash disks, and got infected with a bunch of stuff. It had AVG 7.0 running. I've cleaned many of the problems with AVG 7.0 and now 8.0 (all files, heuristics on), SpyBot, Ad-Aware, MalwareBytes, and maybe something else (I've lost track). But one problem remains and I don't know what to do. I'm a semi-geek, but not very knowledgable about Windows and viruses and trojans. Every time the computer starts, the Windows Task Manager shows one or two "iexplore.exe" processes running. It's "iexplore.exe", not "explore.exe", and in lower-case. It usually takes from 20-70mb of memory. If I kill it, it reappears a few minutes later. My friend uses FireFox (only rarely IE, maybe once site a week). I checked msconfig, it's not on the startup list. It's not in the Start Menu startup folder. I searched the registry for "iexplore.exe" and only found references to "C:\program files\internet explore\iexplore.exe", nothing else. I'll post the hijack log in the next entry to this thread. Thanks for any help or suggestions anyone can give. I don't have regular access to the computer, so can only try something once a day (or so). Regards, Jerry
Post #2 last edited
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:43:57, on 13.01.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\TEMP\ept7.tmp
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ABBYY Lingvo 11 Three Languages\Lvagent.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\init.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Lingvo Launcher] "C:\Program Files\ABBYY Lingvo 11 Three Languages\Lvagent.exe" /STARTUP
O4 - HKLM\..\Run: [LingvoTraining] "C:\Program Files\ABBYY Lingvo 11 Three Languages\Tutor.exe" /ND /NW /AS
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with ABBYY &Lingvo… - res://C:\Program Files\ABBYY Lingvo 11 Three Languages\Lingvo.exe/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: iBank2 UA Client 2015 - https://ibank.ukrsotsbank.com/client.cab
O16 - DPF: iBank2 UA Registry 2015 - https://ibank.ukrsotsbank.com/makekeys.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1157018614346
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1193755342886
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: arxrhbi - C:\WINDOWS\SYSTEM32\arxrhbi.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 7851 bytes
Post #3
Hi,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


Your computer appears to have been infected by multiple backdoor trojans. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response.
Post #4
Hi Tomk, Thanks for your help! I appreciate your work and the work of this forum (and am quite amazed that such services exist!). Wow, multiple backdoor trojans does not sound good. From what you say, and other things I've read, it sounds like the way to go is to format and reinstall to be 100% sure. Since it's a laptop with no floppy, and the cd drive does not work, I guess I'll have to remove the hard disk. I'd rather not do this since I'm not good with hardware (although a friend will probably help). Is it possible to format and reinstall via a usb flash or portable hard disk, copying the files from a licensed cd? What freeware firewall do you recommend in the future to avoid such problems? My friend had the Windows firewall running, but I've read it's not the best. And what freeware real-time virus/spyware protection do you recommend these days? (They must be freeware, budget is very limited.) How to check if portable hard disks and flash disks connected to the computer during the past few weeks are safe - scan them, or is it better to format them on a clean computer too? Thanks again, Jerry
Post #5
thejerryman,

Those are good, though tough, questions.

As far as the reformat, I suggest that you pose a question in the hardware forum as I believe they will be able to better help you there. I can tell you that I don't know if a reinstall can be done from a thumb drive. I believe that you can network two computers together to use the CD drive off the other computer, I know that you can use a portable cd drive. The Tech Helpers will know alot more tricks than I do so they are your best bet.

Information on security programs, including firewalls and Anti-virus, can be found here: Preventing Malware - Tools and Practices for Safe Computing.

As far as your portable storage devices, that presents a bit of a catch-22. You need to get them clean, however using them on a clean machine could result in contamination of the "clean" machine. Therefore I suggest a hodge-podge of measures. I suggest that you scan them on the infected machine including a scan with Malwarebytes' Anti-Malware. After you have cleaned anything found, then format them from a clean machine. Don't put them in the clean machine and read them to find out what is on them.

Most importantly, before anything else, I see iBank2 installed which suggests to me that this computer has been used for financial transactions. You need to protect those accounts immediately. Today. Right now.
Post #6
Thanks, Tomk. I'll start the scans now (I'm at the computer). Interesting enough, AVG 8 reported about 8 backdoor trojans on booting 8 hours ago, and could only remove 2 of them, the others it said 'file not found' or something like that. And I checked the task manager and 'iexplore.exe' is not showing. I'm not thinking it's cured or healed though, and hope to format and reinstall tomorrow. You're right, it has been used for internet banking, and we appreciate the warning. Fortunately, the account is very small. It's a major effort in this country and bank to change the pw, but we'll get it done asap. I'll look for the hardware stuff about usb install. From what I've read elsewhere it's possible, but hard for someone with my knowledge. So we'll get it the old fashioned way by yanking out the hd. Thanks again, Jerry
Post #7
About format, is the Windows format good enough? Or, like the firewall and defrag, are there better freeware options? Any special options to select for the format? Thanks, Jerry
Post #8
thejerryman, iexplore.exe doesn't show in the log you posted so I don't have alot of information on it except to tell you that Internet Explorer runs from iexplore.exe. There are several different trojans and worms, many with backdoor capabilities, that also use this file name. Just because you see iexplore it doesn't mean it's bad. However, you have some other files: such as csrcs.exe and svchost.exe:ext.exe that are always backdoor trojans. There are some legitimate files that are named similarly, but not exactly. I know of no way to format except through windows itself. There are other programs that "erase" data. I do not know if they work on flash drives though.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI