Solved

iexplore.exe opens by itself but no ie window visible. Only visible in task manager.

Posted on 2009-03-31
12
1,954 Views
Last Modified: 2012-05-06
I beleive my internet explorer is hijacked. iexplore.exe will open by itself but can only be seen in the task manager and no visible window will be seen. Also when this happens, i go to google.com and do a search, it hijacks the result links when i click them.

Has anybody seen this issue before?
0
Comment
Question by:integservices
  • 4
  • 3
  • 2
  • +3
12 Comments
 
LVL 27

Expert Comment

by:David-Howard
ID: 24035452
Try to download (onto a thumbdrive, etc.) these two programs. They are very small, free and may resolved the issue.
www.malwarebytes.org
http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
Once downloaded, boot into Safe Mode (F8 at startup) and run HiJackThis. Save the log file. Post the log file here for analysis or at www.hijackthis.de 
Items marked with Red X's are normally listed as dangerous and should be removed.
Run Malwarebytes as well in Safe Mode.
You might also try logging on to the system as a different user and trying to get IE access. Sometimes the malware that installs itself on a system does not affect every profile.
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24035595
Scan for spyware as David- Howard said.  Is this a Unveristy computer?
0
 

Author Comment

by:integservices
ID: 24035657
It's not a university computer. I will try the malwarebytes.

So far I tried, AVG, spybot, windows defender and Trend's SysClean. All of them came up with nothing.

0
 
LVL 66

Accepted Solution

by:
johnb6767 earned 500 total points
ID: 24035705
Did you try them in Safe Mode?

RootRepeal - RootRepeal - Rootkit Detector
http://rootrepeal.googlepages.com/

Under each tab, hit the Scan button, and see if you get any RED files/services/processes/drivers in the list, or just look for the summary, for any hidden files/services/processes/drivers in the lower left hand corner.....
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24035838
hmmm, suprising none of the spyware programs you tired so far found anything.  Sounds like a worm or tojan.  
0
 
LVL 16

Expert Comment

by:warturtle
ID: 24037193
Hmm.. download SmitFraudFix and do a scan with that in safe mode, if possible:

http://siri.geekstogo.com/SmitfraudFix.php

Hope it helps.

0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:integservices
ID: 24044690
SmitFraudFix did not fix it.

I couldn't even install Malwarebytes. I see in task manager but no installation wizard comes up.

I did get further with RootRepeal. It found traces of the UAC trojan. How do i get rid of this nasty trojan?
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 24045174
You would need to rename MalwareBytes and or Combofix before saving to your desktop. Or use another pc to download the tools and rename them before in contact with the infected pc. The nasties blocks the tools from running unless renamed.


Combofix should get rid of it. Rename combofix before saving the download.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24046284
Find your self a boot CD that you can create, update and scan for spyware.  
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 24046396
Last time I removed it manually by slaving the HDD into another PC, and loading the registry hives to remove the files, and the services..... After that SAS was able to remove the remnants.....

We can revisit this if ComboFix doesnt work....
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24053392
The fix is Linux based.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 24056430
"The fix is Linux based. "

???
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows Defender for Windows 10 12 452
Protection from Keyloggers, Spywares etc. 20 99
Browser Pop up fix 12 55
Anti exploit excel 3 133
Most PC repair technicians (if not all) always start their cleanup process by emptying the temp folders before running any removal tools. It makes sense because temp folders are common places for malware installers to lurk and removing all the junk …
Operating system developers such as Microsoft (https://www.microsoft.com) and Apple have made incredible strides in virus protection over the past decade. Operating systems come packaged with built in defensive tools such as virus protection and a f…
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now