multiple iexplorer processes

[smartpaul]

I've recently moved to Avast, having suffered many problems with virus attacks that MS Security Essentials seemed unable to deal with. Avast seems to have done a good job of identifying and isolating most of the issues and my machine does now run OK ... with one exception. Memory use always seems to be excessive, even with no applications running. Task Manager reports the culprit as multiple occurrences of iexplore.exe *32 processes. I never use IE but I found that it wouldn't open anyway. I have downloaded IE9 but it refuses to open correctly and eventually is closed by Windows.

Whilst typing this I've managed to capture an Avast pop-up which I've seen a few times and I've attached it here, along with the resulting web page received when pressing More Details.

I guess this is all a hangover of previous problems. Hope you can assist.

Windows 7 Home Premium
Samsung R540 laptop
Intel i3 CPU
64 bit

[essexboy]

Hi that looks like adware trying to phone home (and failing )

Download OTL  to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

• Select All Users
  
• Select LOP and Purity
• Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir "%systemdrive%\*" /S /A:L /C
/md5start
rpcss.dll
/md5stop
CREATERESTOREPOINT

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Attach  both logs

[smartpaul]

Hi, thanks for this.

Log attached. (Other one in next post - file size limit exceeded).

[smartpaul]

extras file

[essexboy]

Let me know if this stops the alerts

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Download the attached fix.txt to your desktop

Run OTL

Press Run Fix
A dialogue will open asking for the location of fix.txt
Locate and select the text file you downloaded to your desktop
Press Run Fix again
OTL will now execute the commands
 

THEN

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
  
• Click on Scan.
  
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.
  

[smartpaul]

Many thanks Essexboy. I will have to come back to this tomorrow.

[smartpaul]

Hi.

Sadly there are still iexplore processes running. Please see Task Manager screenshot attached, along with the AdwCleaner log.

[essexboy]

Hi it is normal for a 64bit system to have two iexplore processes running

Are you still getting the avast alerts

[smartpaul]

I saw one after I sent the previous post but didn't catch it in time. It doesn't look like Avast stores those alerts - is that right?

There are four iexplore processes running currently.

[essexboy]

There will be one for each tab open plus one

You can see the last avast alert by right clicking the icon and selecting show last popup

Lets look deeper

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will produce a log called FRST.txt in the same directory the tool is run from. 
  
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
  

[smartpaul]

Hi
When you say one process per tab, are you referring to IE tabs? I never use IE, in fact, as I said in my original post, IE will not run. The iexplore processes I have mentioned occurred with no applications open at the time. Having said that, I haven't seen them during the last hour or so.

Anyway, thanks for sticking with this. Logs attached along with latest alert.


Update at 14:26
Also attached is the latest alert which came when I was viewing Task Manager. I presume it's associated with the last entry. Chrome was open at the time but definitely not IE.

[essexboy]

When you try to run IE what error do you get ?

Also are you using Skype when these alerts occur

[smartpaul]

No, while all this has been going on I've ensured that Skype is not running.

IE error messages attached. I tried re-installing IE yesterday before I posted on here.

BTW, windows freezes a couple of times each day, as it did when I was reading your last post.

[essexboy]

In Internet Explorer could you go to manage addons and disable the Avast Security Addons and see if IE then runs

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[smartpaul]

IE does now work OK!

Avast is disabled but Combofix tells me that Security Essentials is running. I uninstalled it yesterday and there's no sign of it. The only option seemed to be to agree to continue (at my own risk) so I killed the blue box when it started to run.