Member Avatar for Tiffini

I have a processing showing up in my task manager (iexplorer.exe) this is the first time I've seen it. It shows up when I start my computer and is taking up a very large amount of memory. Please tell me how to delete it? I ran hijackthis and it does not even show up there. I also want to know what process could I delete from my start up and how? Below is the scan results from Hijackthis;

Logfile of HijackThis v1.99.1
Scan saved at 6:08:24 PM, on 5/24/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: hp officejet 4100 series.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10801} (FlyLoader Class) - http://www.flyword.com/loaderword_win.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Please diregaurd the running process above here is the complete list of running process that start up when I start my computer that I want to disable:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpomau08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

  • 9 Contributors
  • 13 Replies
  • 490 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

A short clarification and a safe checklist for the OP and anyone who finds this thread later. correctly drew attention to the name confusion: the Windows shell and the Internet Explorer browser are different processes, and attackers sometimes use similar or misspelled names to hide malware. Before removing anything, verify whether the process is a legitimate browser instance or a rogue program pretending to be one. (learn.microsoft.com)

Immediate checks (fast, non-destructive):

  • Inspect the running process with a tool that shows the image path, publisher signature and command line — this quickly distinguishes signed Microsoft binaries from suspicious copies. Use Process Explorer for an easy UI and deeper inspection. (learn.microsoft.com)
  • Check what starts at boot with Autoruns; uncheck (disable) questionable autoruns rather than deleting until you confirm. (learn.microsoft.com)
  • If a specific executable looks suspicious, gather its hash and check it on VirusTotal before deleting. (docs.virustotal.com)

Quick troubleshooting commands (run as Administrator only if comfortable):

tasklist /FI "IMAGENAME eq iexplore.exe" /V
taskkill /F /IM iexplore.exe
sigcheck -n -h "C:\path\to\suspect.exe"

Use Sigcheck to confirm the digital signature (signed-by-Microsoft executables are normally safe); Sigcheck can also query VirusTotal. (learn.microsoft.com)

If you find malware: boot to Safe Mode or run an offline/rescue scanner, run a full on-demand scan with a modern anti-malware tool, then remove autorun entries with Autoruns and delete the rogue file. Malwarebytes and Microsoft's on-demand scanner are reliable options for removal and second opinions. Always create a restore point or backup the registry before manual removals. (malwarebytes.com)

If uncertain, collect the Process Explorer properties (image path, publisher), the Autoruns entry name/location, and a VirusTotal link for the file hash, then open a new help thread with those details (the original poster’s thread is three years old). , and raised the right flags — follow the verification steps above before deleting anything.

Recommended Answers

All 13 Replies

Member Avatar for kylethedarkn

iexplorer.exe is Internet Explorer, which is the web browser your using right now. You shouldn't get rid of because you need it.

Member Avatar for Tiffini

Thank you.

Member Avatar for jbennet

NO NO NO

explorer.exe is the windows GUI
iexplore.exe is IE

iexplorer is a trojan which masquerades as IE

are you sure thats how it is spelt?

Member Avatar for Tiffini

Sorry, it is spelled (iexplore.exe).

Member Avatar for jbennet

oh no, thats IE then which you need

Member Avatar for kylethedarkn

lol my bad. I never use IE so i forgot the exact process name. That could of been bad though, so thx jbennet.

Member Avatar for aaxcountry

Could you please tell me how to remoxe iexplorer.exe
I am definitely sure this is not IE as i dont use IE I use mozilla firefox i uninstalled IE already anyway.

Member Avatar for jbennet

yeah if its got an R on the end then its malware, not the real one.

Member Avatar for slynchmob

This may help I just got done using it go to and then help to run a free scan. It took a long time to run but when I restarted
iexplorer.com came up 3 times not 20 times

Member Avatar for wnoorlag

I just picked up the same virus and would like to know how to remove iexplore.exe

Member Avatar for jholland1964

wnoorlag, this thread is three years old and is somebody else's thread. You will not receive answers in another persons thread. You should begin your own thread after completing the steps given in our Read Me Sticky.

http://www.daniweb.com/forums/thread134865.html

Member Avatar for benmar

update the new version I.E 8 or 9,,,,

Member Avatar for crunchie

benmar. Old thread.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.