Multiple instances of iexplore.exe

[REDACTED]

My task manager shows 4 (8 if I click "show processes from all users") instances of iexplore.exe. I've done scans with Avast and Malwarebytes, and neither of them found anything. I have been using nothing but Firefox for several moths now, so I'm assuming these probably aren't legitimate.


These weren't in my task manager yesterday. And I did not go to any unusual or suspicious sites. So if this is a virus, I have no idea where I could have gotten it.

[Eddy]

Download AdwCleaner by Xplode onto your desktop.
Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
ATTACH the content of that logfile with your next answer.

Download Junkware Removal Tool to your desktop.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
ATTACH the contents of JRT.txt into your next message.

[REDACTED]

Okay, here they are. There were two AdwCleaner logs. I don't know if you need both of them, but I attached both just in case.

[REDACTED]

I figured I'd just bump this one instead of making a new one.

A day or two after my last post, the iexplore.exe's stopped showing up, which is why I never posted anything here. Unfortunately, they've started appearing again. In addition to that, I've noticed that I have two instances of dllhost.exe and crss.exe in my task manager when I have it set to show processes from all users. The properties and file locations of both seem to be exactly the same.

Again, I've ran scans with Avast, Malwarebytes, and TDSSKiller. None of them found anything.

[essexboy]

Looks like you slipped through the cracks

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Select  additions at the bottom
• Press Scan button.
  
  
• It will produce a log called FRST.txt in the same directory the tool is run from. 
  
• Please attach both logs generated.

[REDACTED]

Okay, here they are.

[essexboy]

Nothing untoward is showing there, although you do have a dot net programme running that was installed on 14 July and is running three services.  The files are legitimate as it is using a semaphore method of controlling threads

IE will be open for windows updates and there will be one process for each tab opening.

Are you experiencing any problems ?

[REDACTED]

Aside from the stuff I've already mentioned, no, not really.


I did look at the properties for one of the iexpore processes though, under "Groups or user names" in the security tab, it lists "Account Unknown S-1-15-2-1". Not sure what that's about. I'm pretty sure none of the other processes in task manager say that.

Wait, nevermind apparently that account unknown thing is just something Windows 7 Internet Explorer does.

I also just noticed that when I click on 'show processes from all users" in task manager, there are four dllhost.exe's. But two of them quickly disappear, leaving the two I mentioned earlier.

[essexboy]

It is normal to have multiple dllhost processes running as it is windows workhorse for any dll file http://www.neuber.com/taskmanager/process/dllhost.exe.html