Author Topic: iexplore.exe - be warned (Read 8,071 times)

nudone · « **on:** August 26, 2006, 12:41 PM »

my machine is currently infected with a trojan or something.

after startup i have a new file 'iexplore.exe' trying to access the internet - each time i delete the file and then restart, the said file has moved to a new location (please don't start announcing that iexplore.exe is internet explorer - this particular file that keeps appearing is definitely something nasty).

i looked around the web and there appears to be plenty of confusion and not particularly brilliant advice about getting rid of it - virus and trojan scanners seem to be unable to find the file if the comments on other forums i've read are correct.

here is the most helpful page i've found that deals with the problem http://www.jimmyr.com/blog/IEXPLORE_EXE_Virus_230_2006.php (not actually tried his method yet but will do in a minute).

i wouldn't make such a post but this is the first time my machine has been infected for a long time - and i can't even remember a time that my scanning software seemed completely oblivious to the fact that the machine is infected.

TucknDar · « **Reply #1 on:** August 26, 2006, 12:49 PM »

Sorry for you, but hopefully you'll get rid of it. Please post about your progress and how you got this thing on your computer in the first place.

nudone · « **Reply #2 on:** August 26, 2006, 01:18 PM »

here's the output from the first run using the Ikarus dos scanner:

Code

c:\windows\system32\directx.exe - Signatur 'Net-Worm.Win32.Mytob.DE' gefunden
c:\windows\system32\pxcpya64.exe - Virenverdächtige Programmsequenz gefunden
c:\windows\system32\pxcpyi64.exe - Virenverdächtige Programmsequenz gefunden
c:\windows\system32\pxinsa64.exe - Virenverdächtige Programmsequenz gefunden
c:\windows\system32\pxinsi64.exe - Virenverdächtige Programmsequenz gefunden

so, looks like the problem might be getting worse. i'll now run another scan in safemode...

(grisoft avg is still completely unaware that there is a problem.)

nudone · « **Reply #3 on:** August 26, 2006, 01:28 PM »

nod32 doesn't appear to think there is a problem either - even with all options turned on and forced to scan the system32 folder.

it's a pity, isn't it.

kimmchii · « **Reply #4 on:** August 26, 2006, 11:09 PM »

nod32 has improved a lot but it's still a toy, i only trust kaspersky.

download esan here:
http://www.spywareinfo.dk/download/mwav.exe

then run kavupd.exe to update the sig, it will catch everything.

f0dder · « **Reply #5 on:** August 26, 2006, 11:57 PM »

NOD32 is more than a toy, it has a decent detection rate... kaspersky is back in business, though, after they stopped the NTFS streams stuff

nudone · « **Reply #6 on:** August 27, 2006, 05:59 AM »

Quote from: kimmchii on August 26, 2006, 11:09 PM

nod32 has improved a lot but it's still a toy, i only trust kaspersky.

download esan here:
http://www.spywareinfo.dk/download/mwav.exe

then run kavupd.exe to update the sig, it will catch everything.

i'd love to be able to put kasperspy to the test on this one but i've deleted the files that were infected - i ought to have saved them somewhere perhaps.

kimmchii · « **Reply #7 on:** August 27, 2006, 06:17 AM »

Quote from: nudone on August 27, 2006, 05:59 AM

i'd love to be able to put kasperspy to the test on this one but i've deleted the files that were infected - i ought to have saved them somewhere perhaps.

just scan anyway make sure it's 100% clean.

mouser · « **Reply #8 on:** August 28, 2006, 05:15 PM »

i think it's good advice to always save such viruses until you are 100% sure you know where they came from how to deal with them in future, etc. they can be very helpful in testing future antivirus solutions, etc.