Solved

iexplore.exe opens by itself but no ie window visible. Only visible in task manager.

Posted on 2009-03-31
12
1,959 Views
Last Modified: 2012-05-06
I beleive my internet explorer is hijacked. iexplore.exe will open by itself but can only be seen in the task manager and no visible window will be seen. Also when this happens, i go to google.com and do a search, it hijacks the result links when i click them.

Has anybody seen this issue before?
0
Comment
Question by:integservices
  • 4
  • 3
  • 2
  • +3
12 Comments
 
LVL 27

Expert Comment

by:David-Howard
ID: 24035452
Try to download (onto a thumbdrive, etc.) these two programs. They are very small, free and may resolved the issue.
www.malwarebytes.org
http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
Once downloaded, boot into Safe Mode (F8 at startup) and run HiJackThis. Save the log file. Post the log file here for analysis or at www.hijackthis.de 
Items marked with Red X's are normally listed as dangerous and should be removed.
Run Malwarebytes as well in Safe Mode.
You might also try logging on to the system as a different user and trying to get IE access. Sometimes the malware that installs itself on a system does not affect every profile.
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24035595
Scan for spyware as David- Howard said.  Is this a Unveristy computer?
0
 

Author Comment

by:integservices
ID: 24035657
It's not a university computer. I will try the malwarebytes.

So far I tried, AVG, spybot, windows defender and Trend's SysClean. All of them came up with nothing.

0
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
LVL 66

Accepted Solution

by:
johnb6767 earned 500 total points
ID: 24035705
Did you try them in Safe Mode?

RootRepeal - RootRepeal - Rootkit Detector
http://rootrepeal.googlepages.com/

Under each tab, hit the Scan button, and see if you get any RED files/services/processes/drivers in the list, or just look for the summary, for any hidden files/services/processes/drivers in the lower left hand corner.....
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24035838
hmmm, suprising none of the spyware programs you tired so far found anything.  Sounds like a worm or tojan.  
0
 
LVL 16

Expert Comment

by:warturtle
ID: 24037193
Hmm.. download SmitFraudFix and do a scan with that in safe mode, if possible:

http://siri.geekstogo.com/SmitfraudFix.php

Hope it helps.

0
 

Author Comment

by:integservices
ID: 24044690
SmitFraudFix did not fix it.

I couldn't even install Malwarebytes. I see in task manager but no installation wizard comes up.

I did get further with RootRepeal. It found traces of the UAC trojan. How do i get rid of this nasty trojan?
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 24045174
You would need to rename MalwareBytes and or Combofix before saving to your desktop. Or use another pc to download the tools and rename them before in contact with the infected pc. The nasties blocks the tools from running unless renamed.


Combofix should get rid of it. Rename combofix before saving the download.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24046284
Find your self a boot CD that you can create, update and scan for spyware.  
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 24046396
Last time I removed it manually by slaving the HDD into another PC, and loading the registry hives to remove the files, and the services..... After that SAS was able to remove the remnants.....

We can revisit this if ComboFix doesnt work....
0
 
LVL 4

Expert Comment

by:Compnecessity1
ID: 24053392
The fix is Linux based.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 24056430
"The fix is Linux based. "

???
0

Featured Post

On Demand Webinar - Networking for the Cloud Era

This webinar discusses:
-Common barriers companies experience when moving to the cloud
-How SD-WAN changes the way we look at networks
-Best practices customers should employ moving forward with cloud migration
-What happens behind the scenes of SteelConnect’s one-click button

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
Operating system developers such as Microsoft (https://www.microsoft.com) and Apple have made incredible strides in virus protection over the past decade. Operating systems come packaged with built in defensive tools such as virus protection and a f…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question