Member Avatar for knight fyre

Do I have a virus or is there some sort of conflict on my system? I was simply browsing the net and I noticed my usage maxing out at a 100%. This is the third time I've noticed a number of these processes running at the same time. I took some screen shots.

processes.JPG 104.78 KB
  • 3 Contributors
  • 2 Replies
  • 188 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by memnac

Dani AI

Generated

A dozen IEXPLORE.EXE processes can be normal at a small scale (IE often creates separate processes for tabs and plugins), but a swarm of them combined with 100% CPU is not normal and needs careful, measured diagnosis. : screenshots help. : good call to get a HijackThis log. : Process Explorer/Autoruns are useful, but a few clarifications below will make the troubleshooting safer and more productive.

Immediate, safe steps

  • Physically disconnect or disable networking so the machine stops talking to unknown hosts. Do not log into sensitive accounts from that PC until it is clean.
  • Gather diagnostic output before killing things. Post the HijackThis log as suggested, and also capture these command outputs (open a command prompt as administrator and run):
wmic process where "name='iexplore.exe'" get ProcessId,ParentProcessId,ExecutablePath,CommandLine
tasklist /v /fi "imagename eq iexplore.exe"
netstat -ano | findstr ESTABLISHED

What to look for (and how to inspect)

  • Legitimate iexplore.exe normally runs from "C:\Program Files\Internet Explorer" (or "Program Files (x86)" on 64-bit). Any instances running from Temp, AppData, or a user folder are suspicious.
  • Use Process Explorer to view the process tree, the full command line, loaded DLLs/BHOs and the digital signature. Right-click a process -> Properties to see the path and signature.
  • Note the ParentProcessId: if IE was spawned by an unexpected parent (not explorer.exe), that is a red flag.
  • The Task Manager "Go to Service(s)" step mentioned earlier rarely applies to IEXPLORE.EXE (IE is not a Windows service); stopping services usually won’t remove a rogue browser process.

Next steps if infection is likely

  • Scan with an up-to-date anti-malware tool (on-demand scanners like Malwarebytes) and consider an offline rescue scan if the system resists cleaning. Back up critical data (documents only) before large removals. If you cannot clean reliably, a reinstall is the safest route.
    When you post back, include the HijackThis log plus the three command outputs and note the exact sites visited just before the spike. That will let responders point to precise lines to examine and safer next actions.

Recommended Answers

All 2 Replies

Member Avatar for crunchie

Are you running all those instances of Internet Explorer? If not, please do the following;

Download HijackThis Executable from Save it to your desktop.
Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you the option of where to save it. Save it to desktop where it is easy to access. Open the log file and then go to the format Tab and make sure that wordwrap is unchecked. Copy the entire contents of the file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is necessary for the running of your system.

Member Avatar for memnac

Hello! A virus is definitely not out of the question. I presume you use firefox more often, in that case you can disable internet explorer all the same.
Looking at the screenshot IE runs implicitly, apparently started by u and is definitely occupying most of your CPU.

From your query, there is a high probability your system is infected with malware and if this is not resolved ASAP ur system will grind to a halt!

Here are some suggestions:
1) Try getting a copy of McAfee virus scan / Norton Anti-virus (some of these offer a 30 day trial but its best obtaining your own copy) and update this with the latest virus definitions to capture more recent threats.

If you do not have this, and maybe a friend does, ask him/her to scan ur computer using theirs. They will have to access the 'c$' (\\<your Ip address>\c$) share on your computer and run a virus scan on that drive. To accomplish this all necessary permissions have to be granted prior and pcs will have to be on the same network to avoid complexities.

2)In the meantime you should STOP the service running IEXPLORE.EXE.
If you are using Vista, Open up the task manager, right-click on any one of the IE process and select go to service. When on the relevant screen, right-click again and select stop service.
On other systems you may have to manually stop the processes by right-clicking and selecting 'End Process'.

3) You can also set the priority level of the IEXPLORE.EXE to 'below Normal or Low'. This however might be ineffective depending on the nature of malware you have on your system. Since it strives to use most of your CPU thne the malware is self-adjusting.

4)To better manage process runs, i would also look at two sysinternal tools - process explorer. These tools are available for free download from Microsoft Technet, i have supplied direct links to the zip files: Process Explorer:
and Autoruns (which displays all your processes - at boot time, run time, drivers etc):

Hope this helps and Good Luck!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.