How To Prevent IExplore.Exe Trying To Connect To Webcam?

For the past six weeks my Zemana anti-spy software has detected iExplore.exe trying to connect to the webcam on my Sony laptop. I never use the webcam on this computer.

The Zemana (antikeylogger) utility stops this connection in its tracks. However, I wonder if there is there a way to permanently prevent these attempted connections?  Zemana is now detecting unauthorized connection attempts 8 or 10 times a day. This is not just an inconvenience, but a major security concern.

I'm using an up-to-date version of Windows 7. A JPG picture of the message is attached.

Thanks for your consideration.
gbmcneilAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
I have a built in camera on my laptop and an external camera on my desktop. They are both OFF unless I need to use them.

For the past six weeks my Zemana anti-spy software has detected iExplore.exe ...

Scan completely for viruses and then use Malwarebytes to scan again. It sounds like a virus.
gbmcneilAuthor Commented:
Thanks, John. But, I run three different anti-spy programs regularly.

I think I need something more definitive to go on.

In addition to Zemana, I use Malwarebytes and Webroot.
JohnBusiness Consultant (Owner)Commented:
To the best of my knowledge, iexplore does not activate a camera on its own.  

Try removing (disabling) IE Add-ins. Remove almost all including anything to do with Skype.
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

gbmcneilAuthor Commented:
No add-in to remove. Every add-in has been disabled.

I did find a service running called "SkpPopupSvc".

I found this using a utility called Process Explorer. I believe it is launched in the Registry by HKLM\System\CurrentControlSet\Services.

All I can do at the moment is to see if Zemana traps another violation. This may take a day or so.

Thanks for the suggestion. Let me get back to you. I'll report in sooner if another warning is flashed.
JohnBusiness Consultant (Owner)Commented:
SkpPopupSvc is a Skype service. I have Skype but no such service. It may be part of Skype Click to Call that I uninstalled.
gbmcneilAuthor Commented:
Hi John -

As I say, the only way to establish whether killing that service stops the attempted intrusions, is to see what happens. I have had no security warning since I terminated SkpPopupSvc.

GBM
JohnBusiness Consultant (Owner)Commented:
You can open Skype and check its options.

1. I have Skype NOT to start when Windows starts. That will help a lot.
2. Unless you use it, uninstall Skype Click to Call.
gbmcneilAuthor Commented:
The warning message just returned. Therefore, killing SkpPopupSvc is not the answer.

Does Skype go by any other name in the Programs and Features section of the Control Panel?
JohnBusiness Consultant (Owner)Commented:
Skype only has two entries:  Skype and Skype Click to Call.

Uninstall Skype and Click to Call and see if the message returns. Then we can go from there.
David Johnson, CD, MVPOwnerCommented:
The truly paranoid stick a piece of tape over the webcam's camera. check your Adobe flash settings re your camera
gbmcneilAuthor Commented:
John -

I have neither a program named Skype or Click to Call in Programs and Features.

GBM
gbmcneilAuthor Commented:
John -

It is not a matter of being paranoid. Unless I want to disengage Zemana, I'm going to get warning messages popping all day long.

GBM
JohnBusiness Consultant (Owner)Commented:
If you do not have Skype installed, then skppopupsvc may well be a virus deeply hidden. Think root kit (which evades most scanners).

Try this:

Download, install and run Process Explorer from Microsoft. Find this service in the left hand tree. Assuming you find it, kill it, exit Process Explorer, do NOT restart and run Malwarebytes again. Remove any malware.

Also try TDSKiller for root kit malware.
gbmcneilAuthor Commented:
Does anyone know how to change the settings on Adobe Flash?
JohnBusiness Consultant (Owner)Commented:
Go to the Flash Player settings manager

http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html

There are a variety of settings here.

Flash has NEVER turned on my camera.
JohnBusiness Consultant (Owner)Commented:
@gbmcneil - I have had Flash running forever now and Skype running for a long time. In addition I use Go to Meeting video conferencing. NONE of these programs turn on my camera unless I permit it first.

So look for issues on your computer rather than thinking standard programs are doing this to you. Probably not, at least not in my experience.
gbmcneilAuthor Commented:
David suggested that I check the Adobe Flash Player settings.

Does anyone know how to launch Adobe Flash?
JohnBusiness Consultant (Owner)Commented:
Check the link I gave you above for Flash Settings. There is more than one settings link so check through them.
gbmcneilAuthor Commented:
John -

Thanks for your help, but you are really not helping me.

I need answers to specific questions, not a referral to a help file.

The issue at present is: "How do I launch Adobe Flash." If you can't answer the question, please don't respond. I appreciate your attempts to help, but I'm going no where.
JohnBusiness Consultant (Owner)Commented:
The Flash Settings do NOT launch Flash. Flash is launched by a web page.  I have done this before and I do know what I am doing. And most likely Flash is not your issue.

There was a link to Global Settings in the link I gave. Note under the image where it says it is the actual settings manager. If you have never used it, it is different, but I am not sending you to a help file.

I have Windows 8 and Flash is built in here, but I tested in a Windows 7 machine and it works.
JohnBusiness Consultant (Owner)Commented:
See how you make out setting Flash, but my guess that if you have never set Flash (a) it probably does not need setting and (b) it probably is not the cause of your issue.

Also, I do not answer questions if I do not understand the issues. Here, I do understand the issues.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gbmcneilAuthor Commented:
I had no success going into the Flash Player help file and changing the Global Privacy Settings Panel. After I clicked on the "Always Deny..." button to prevent a website app from using the camera or microphone, the security message from Zamana antikeylogger still was triggered.

So, I went into Control Panel/Device Manager and made a settings change there. In clicked on Imaging Devices/Sony Visual Communication Camera. Then I went to the Driver Tab. Four button down, it said "Disable" - meaning "Disable the Selected Device". This I did.

Then I found a page on the web that seemed to consistently trigger the security message from Zemana. And, "Voila!" the message no longer displayed. Now, I assume by doing this that I have disabled the camera, which for me is no big deal because in the 2 1/2 years I've owned it, I've never used the it (the webcam). So, no big loss here.

For me, that's a satisfactory solution. Zemana has a setting in its Antikeylogger app to activate/deactivate attempts to access my computer's camera. I left  that switch "on". Thus, in the unlikely situation that someone hacked into my computer and reactivate the camera device, then I'd expect that Zemana would display a popup warning that an intruder was trying to access my webcam.

That's it. Thanks for everyone's help.
JohnBusiness Consultant (Owner)Commented:
@gbmcneil  - Thank you for a good update. I appreciate working with you.
gbmcneilAuthor Commented:
Okay, John. Thanks for your help.
David Johnson, CD, MVPOwnerCommented:
what is the problem page?
gbmcneilAuthor Commented:
http://www.marketwatch.com/investing/index/dxy

Dave - My problem was not limited to this webpage. However, yesterday this page consistently caused me a problem (i.e., triggered Zamana Antikeylogger to warn me that iexplore.exe was trying to connect to my webcam).

See the attached JPG file to view the message.
150312-Zemana-WebCam-Warning.jpg
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Web Browsers

From novice to tech pro — start learning today.