Member Avatar for Velius2820

OK here is the deal, I got done playing a game today, took a nap, woke up and all kinds of weird things are happening with my pc. I am not too tech savvy so excuse any rudimentary explanations. Here is what is happening.

-I have a new process running called iexplorer.exe which i read is not to be confused with iexplore.exe and is bad.

-I thought I could system restore to fix this problem but no dice. I get to the screen click a date to restore to ->Next->Are you sure you want to restore->Next then nothing. I click next but it does nothing, no hourglass or sound or anything.

-My internet has been acting up. I can no longer google search. If i click anything when i search google it will take me to ads for insurance, blah blah and whatnot.

-I also cannot enter certain sites. Usually if it has ware in the address or something it will just say server not found. I was with a friend on vent at the time and he could access the site just fine.

-If I restart my computer occasionally it will just sit at the welcome screen or a black screen beforehand doing nothing until i manually push the reset button.

-I get errors sometimes when I log in about processes having to be terminated. On one occasion after I clicked ok it prompted a shutdown in 60 seconds saying something about NT

-One thing I forgot about the internet, on a few sites only it will screw with the font sizes. so one thing will be normal size but the other parts of a post will be a few notches higher in font size.

-My search function for files and folders seems to be acting up. It cannot find iexplorer.exe or even iexplore.exe so something is up there.

I have ran all of the following programs in attempt to fix this;
AVG antivirus, Malwarebytes, Lavasoft, Spybot S&D, superantispyware, freeregistryfix

If I end the process on iexplorer.exe 2-3 minutes later I will hear a clicking sound, just like you would if you were exploring your harddrive say. Then iexplorer will be running again.

Here is my HJT log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:20 PM, on 9/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v\Alcohol_Toolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools\daemon.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe


I would really appreciate any help I could get with this, thank you.

  • 2 Contributors
  • 2 Replies
  • 253 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Short, practical expert summary and next steps based on the thread: the process name spelled “iexplorer.exe” (note the extra “r”) is a known fake—the real Internet Explorer is iexplore.exe—and that name + the redirection, blocked sites, and System Restore problems you describe all match a browser‑hijacker/adware or trojan that persists by changing proxy/hosts/startup settings. already ran several scanners and reported Malwarebytes looked better on a second pass; asked for the MBAM log, which is the right kind of evidence to attach when asking for further help. (file.net)

Investigation checklist (non-destructive, in this order): confirm the running image path and publisher (don’t trust just the process name) with Process Explorer; use Autoruns to find and disable any unfamiliar auto‑start entries; inspect the hosts file at C:\Windows\System32\drivers\etc\hosts for redirects; and check/reset IE/WinHTTP proxy settings (netsh winhttp show proxy / netsh winhttp reset proxy) if searches are being hijacked. These tools show full paths and digital‑signature info so you can tell legit Microsoft binaries from impostors. (learn.microsoft.com)

Cleanup sequence to try next (ordered, escalating): isolate the PC from the network and image or copy important personal files to external media (scan that media before re‑using). Boot Safe Mode and run updated Malwarebytes + a second scanner (ESET/HitmanPro or similar); if problems persist, run an offline/bootable scan (Microsoft Defender Offline or a rescue ISO such as Kaspersky Rescue Disk) to catch rootkits that run before Windows. If System Restore refuses to run, try starting it from Safe Mode with command prompt: %systemroot%\system32\restore\rstrui.exe or use the offline rescue environment to repair/remove persistent items. (learn.microsoft.com)

Final notes and when to reimage: if the infection re‑creates itself, hides in restore points or the firmware, or a rootkit/bootkit is detected, a clean reinstall (after backing up only data, not executables) is the reliable cure; reflashing firmware or full drive wipe may be required for very advanced rootkits. Preserve logs (MBAM, FRST/Addition, Autoruns) for helpers to analyse rather than pasting long HJT dumps, and prioritize an image/backup of irreplaceable files before attempting destructive repairs. (raywoodcockslatest.wordpress.com)

Recommended Answers

All 2 Replies

Member Avatar for Velius2820

I would like to say I just did another malwarebytes scan and it seems to be back to normal. Maybe something went wrong with the first one. Anyways I don't think I'm out of the woods yet I will update this again if not.

Member Avatar for jholland1964

Post the log of the malwarebytes' scan and we can take a look.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.