Member Avatar for JamesH07

Hi, it seems i am infected with something that opens internet explorer popups in the background without me being able to see them. The process is called iexplore.exe i think. I saw another thread with this problem and followed it. I have already scanned with superanti spyware and malwarebytes.
The thread i read told me to download bootkit remover so i did and this is what came up
Bootkit Remover
(c) 2009 eSage Lab

Program version:
OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600)

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
Boot sector MD5 is: 053cceb28da3cbbc8bf81f9870cc697a

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...

I then made a command in notepad and saved it as a .bat file, ran it and it seems to have fixed the physicaldrive0.
Do you think that this will have removed the virus for good?

  • 2 Contributors
  • 1 Reply
  • 247 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Brief expert note following and : repairing the master boot record can neutralize a bootkit, but invisible Internet Explorer popups are commonly caused by persistent user‑mode components (browser helper objects, scheduled tasks, services, rogue DLLs or replaced IE binaries) that survive an MBR repair. Treat the MBR fix as one necessary step, not the whole cure.

Suggested troubleshooting and verification workflow:

  • Boot to Safe Mode (or Safe Mode with Networking) and take a full image or backup of important data before making more changes.
  • Re-run a full, updated antimalware scan (Malwarebytes or equivalent) in Safe Mode; follow that with an offline rescue scan (bootable rescue media) to catch things active only before Windows starts.
  • Use a trusted process viewer to inspect every iexplore.exe instance: confirm the command line and image path are the real Internet Explorer binary (typically under Program Files\Internet Explorer), examine the parent process, and review loaded DLLs and network connections. A mismatched path or strange parent process is a red flag.
  • Run an autorun/startup audit to check Run/RunOnce keys, Scheduled Tasks, Services, Browser Helper Objects and shell extensions; remove or disable anything unknown. Capture the autoruns/process lists to a log for careful comparison.
  • Check Scheduled Tasks and the Task Scheduler library for entries that may silently launch browsers, and review installed browser toolbars and add-ons. Temporarily disable all IE add-ons to see if popups stop.
  • If intrusive components are found but not removable, consider exporting data and performing a clean OS install; persistent rootkit/bootkit activity is safest removed by reinstalling after verifying backups.

Cautions: avoid random "fix" scripts without a backup, and do not assume a single scan proves the system clean. Preserve copies of any suspicious files and logs for analysis before deletion.

Member Avatar for jholland1964

Update and rerun Malwarebytes' Anti-Malware. Do the full scan. Have it remove anything found. REBOOT the computer, VERY IMPORTANT.

Also do the following:
Please Run the ESET Online Scanner and attach the ScanLog with your post for assistance.
You will need to use Internet Explorer to to complete this scan.
You will need to temporarily Disable your current Anti-virus program.
Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\

Download and run a System Scan with HiJackThis version 2.0.4. Save the log.

Post back here with all logs, even if they show clean.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.