?
Solved

Explorer.exe creating many internet connections to random ip addresses

Posted on 2013-12-13
7
Medium Priority
?
880 Views
Last Modified: 2014-01-05
I have a friend who received an email with a zip attachment about air line tickets.  I was able to scan the computer and remove the virus.  However now everytime he starts up his laptop, Explorer.exe runs at a hight cpu percent and there are over 100 connections to random IP addresses.  Their status is either established, time_wait, or Close_wait.  

His system is running windows 7 home premium.

On occasion, after arount 15minutes, the process will end, and system idle will be over 90%.  On most occasions it never ends.

I have disabled all startup entries, processes not microsoft, and have disabled hidden startup's with sysinternals autoruns program.

When I boot to safemode, the same thing happens.  

Not sure what to do next.  I have used Kaspersky's cd scanner too.  No virus was detected.
0
Comment
Question by:rrincones
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 11

Expert Comment

by:David Kroll
ID: 39717583
What did you use to remove the virus?  I would definitely run a full scan with Malwarebytes.
0
 
LVL 24

Accepted Solution

by:
aadih earned 2000 total points
ID: 39717593
If the problem happened recently (1-2 days), restore your PC to an earlier time by booting up in safe mode with command prompt and typing rstrui.exe to restore.

Scan with:

(1) Malwarebytes Antimalware (free).

(2) TDSSKiller (free).

(3) Malwarebytes AntiRootkit (Beta) (free).
0
 

Author Comment

by:rrincones
ID: 39717617
I scanned with malwarebytes twice.  1st scanned resulted in 33 registry entries, 8 values, 15 folders, and 57 files, detected with items such as funmoods, whitesmoke, visual bee.  

2nd scan had 1 detection from vid-saver.

Prior to scanning, I went to add remove programs and uninstalled several free programs and toolbar addons.

I will try system restore.  I will have to remove those programs again, but I will check for internet connections prior to removing the programs.

By the way, there are 4 instances of explorer.exe running, each using 20 to 40 % of cpu.  And the dll's are for various programs.
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 

Author Comment

by:rrincones
ID: 39717625
Ive been monitoring explorer.exe with process explorer from sysinternals.  Every 10 minutes or so, all the dll's will end at the same time, then startup again after a few seconds.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 39758266
I've requested that this question be deleted for the following reason:

The question has either no comments or not enough useful information to be called an "answer".
0
 

Author Closing Comment

by:rrincones
ID: 39758267
Sorry about the late update.  tdsskiller did the trick. after scanning the pc, no more internet ports opened up on their own.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On some Windows 7 (SP1) computers, Windows Update becomes super slow even the computer is reasonably fast.  There's one solution that seemed to have worked well for me (after trying a few other suggested solutions).
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question