Malware Removal Forums

IEXPLORE trojan removal help needed

earlycobra · 2010-07-06T17:28:44+00:00

As requested, HiJackThis log: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 12:19:54 PM, on 7/6/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Common Files\Apple\Mo

13 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

earlycobra

July 21, 2010, 2:38 AM UTC

It sounds like I should probably go get an external hard drive and at least back everything up before moving on. Let me put these two things on the table real quick, could we delete Internet Explorer and not give the virus a program to run in? I have used internet explorer maybe twice in the entire 5 years I have owned this computer, I don't see anything coming up that I couldn't find a workout with. And secondly, before we reinstalled Adobe Acrobat Reader the virus couldn't run, but it was poping up an Internet Explorer error message every 30 seconds or so saying there was an error and it couldn't run. Just hoping maybe this will help narrow things down, maybe we can find the specific file without having to reload the whole machine.

askey127 Admin/Teacher

July 21, 2010, 10:47 AM UTC

earlycobra,
With a Master Boot Record infection, it will run what programs it wants, and do what it pleases. It has control over your machine. It would be impossible to stop it or render it harmless just by removing IE, or something else simple.

If you save your programs on an external HD, be sure to scan the external HD with an Antivirus before you restore any of your files from it.

Be sure to save the instruction for Bootkit Remover and run it after you do any re-install to be sure the MBR is OK.
You don't want it to report this:

Size Device Name MBR Status
--------------------------------------------
55 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>

askey127

earlycobra

July 23, 2010, 2:29 AM UTC

Askey127-
I picked up a flash disk to back up my files, there are not many programs that I need that I do not have on disk or available to download). Once I get them backed up here, I will start with your instructions on the MBR fix. Thank you for your help.

NonSuch Administrator

July 26, 2010, 5:48 AM UTC

As this issue appears to be resolved, this topic is now closed.

You can help support this site from this link :
Donations For Malware Removal

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.