Virus Help

[Kurstone]

Ok so I got an e-mail supposedly from EZ-pass about an unpaid toll, and because I'm dumb and instead of looking it up on google first I downloaded a zip file then my computer continued to restart itself, "shit... sigh". Now every time i'm connected to the internet, I see on the task manager that iexplorer.exe is using insane amounts of CPU memory, even if I click on "End Process" it will show up again in a couple of seconds, once it gets to 100% and stays there my computer will blue screen and restart.

I tried using system restore to set it about a month back, but it still showed up again. the only way I can use the internet w/o worrying about that happening while i find a way to fix this, is to open up the files/programs I want to use and then pull up task manager and end the Explorer process which Includes the task bar(start,shortcuts,desktop). But it will show up again if I open up a folder using a browser/etc. Other than that I can use my computer just fine if I just pull the plug on my internet cable (problem).

I wanted to know if anyone has experienced something like this and if there are tools/etc I can use to remove this virus, or would it be better to just back everything up on an external HD and have it restored to factory settings. I'm using windows 7. Thanks in advance.

[The Stig]

Have you tried the usual remedies? Malware Antibytes, and AdwCleaner being my go-to ones.

Failing that you'll need to further explore your Internet Explorer.

- Try to start Internet Explorer in Safe Mode, does it still happen? Could be an addon it planted
- If you're experienced with what runs in the background of your PC, try to look for rogue processes (hard to explain, but my devices are like an extension to my own body. If I see something rogue I'll know right away)
- In the virus thread is a list of virus checkers people use, you can try one of those. I personally use Microsoft Security Essentials, seems to do the job (I don't believe in X product being better than Y anymore. For the less technical... MAYBE but that is debatable. I've cleared several infections without the aid of one before)
- Look in Start Up Manager (start > run > msconfig ... startup tab); see if you can identify anything weird that might be running upon boot up
- Someone might tell you to reformat or stop using IE and use Chrome/Firefox

It's rather irritating there's no info of the possible strains of infection in the first 2 pages of Google on the EZ pass thing besides warnings from news outlets too.

[Kurstone]

Thanks I'll try that!, oh and I haven't used IE at all on this computer, but its there, somewhere.

[The Stig]

Hm wait, re-reading your question, you mention iexplorer (internet explorer) then explorer... did you get the 2 mixed up? Looking at your symptoms, it seems more explorer (windows) related than internet explorer, in which case you should start it up in safe mode to see how it fares.

It almost seems like as if explorer detects an internet connection and then begins to spill traffic out, whereas if unplugged it can't do shit.

So try to gather all the tools you think will fix this (make sure it's updated), unplug it and let it run.

Oh, if no luck it is indeed better to restore, because it's possible there's some latent shit left in there that might be hard to detect. Will probably save you time in the long run too if you're not too comfortable with it.

[Kurstone]

Yeah I guess I didn't explain properly, on task manager>processes iExplorer.exe (which is the actual browser i believe) is blowing up my memory, and I never open it at all, but it could still have a shit addon planted on it. But if i end Explorer.exe (which is windows, which doesn't seem to screw up the memory) the iExplorer.exe will stop coming up in task manager>processes and blowing up the cpu memory.

[The Stig]

Gotcha. The fact you're explicitly capitalising the "E" makes me think it's not IE but a "fake" process. If you get the opportunity, right click it (I deleted my initial reply suggesting the same) and click "open file location" in task manager to see if you can find the offending exe. If it's not in C:\Program Files\Internet Explorer or C:\Program Files (x86)\Internet Explorer then you can try to rename it or delete it and hope it doesn't respawn.

Again, check your your startup too (Start > Run > msconfig > startup tab) to see if it you can see anything odd.

[Niya]

Also, implying it wasn't a typo, the real executable of IE is called iexplore.exe. Notice the "missing" R at the end.

[chiyio]

get this (make sure to get 64 bit if your system is 64 bit.) http://www.comodo.com/business-secur...essentials.php

There's no install, just unzip. Run killswitch first, have it kill any unsafe processes, then run CCE. Killswitch is pretty awesome, it's process hacker, but with built in process identification. You can set it to just replace task manager as well, it's a pretty easy way to see if anything weird is running at a glance.

[Shenrien]

A system restore could help as well, restore to any point prior to the infection and it could just be dumped off with the rest of the crap that gets bundled up with it. Worked for myself a year or so back when fixing a similar issue for someone.

[Elizara]

Worst case if you can't get rid of this, go dig up your Windows/driver disks.

A reformat should nuke this. It's a extreme measure, but sometimes you have to go extreme if there's no earthly way you can remove it. I hope you got backups if it comes to that.

[Kurstone]

Thanks for all the replies, yeah it was a typo meant iexplore.exe, so i tried renaming the actual file that it had made a copy of, but it just made a copy of explore.exe =/, i'll try doing the killswitch and cce thing

Also in my first post i said that i tried system restore but that didnt fix it ;;

[CoreyX]

How could your computer be infected by zip file unless you opened the zip and opened an .exe inside of it? Maybe it was caused by something else