iexplore.exe process - hidden and self renewing

Okay, so the subject pretty much says it all. I've found that explore.exe will be running at all times. I will hear random page refresh clicking sounds. If I for whatever reason leave my computer on overnight, the next morning I have 1 or 2 popups there.

Did a little research on this on my own, ran multiple scans with SUPER AntiSpyware Free Edition (I don't have the money to spend on this kind of thing when there are ways to do it manually). All kinds of cleanups and restarts, only to find it always comes back.

So I did the last thing I could think to do, and that was to go through each of my processes manually and see google them to see what they were capable of doing. I did find one process, C3Gd0Ij3.exe, that returns NO results on google. I took the risk, ended the process tree (just in case) and bam, I was able to actually kill the iexplore.exe process and it didn't go all zombie on me.

So I went through to find this C3Gd0Ij3.exe and related files on my computer and deleted them with no problems. I decided to run another full scan of my computer in case it was still moping around somewhere and hoped it was more vulnerable to removal, being offline. Well, about 4 hours later, the process randomly starts up again! The files I deleted are back and I grow weary of fighting this alone with my limited experience.

So, I come asking for help. Rather lengthy post but I wanted to convey as much information as I could. I've not posted here before so if you could email me that would be great, thanks!

<Kaleb Buckner> wrote in message news:2008101594258tasarn@gmail.com...
Okay, so the subject pretty much says it all. I've found that explore.exe
will be running at all times. I will hear random page refresh clicking
sounds. If I for whatever reason leave my computer on overnight, the next
morning I have 1 or 2 popups there.

=========================================

Malwarebytes (possible this program will fix it without using another
program)
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

Download and execute HiJackThis
http://www.trendsecure.com/portal/en...ols/hijackthis

HijackThis - Quick Start!
http://www.whatthetech.com/hijackthis/

Do not post your HJT log to this newsgroup.

You will get free expert advice for HiJackThis logs at these sites.
http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/i...hp?showforum=7
http://www.5starsupport.com/ipboard/...p?showforum=18
http://www.theeldergeek.com/forum/in...showf orum=29

Registration maybe required in some of these forums before posting a HJT
log. Most have FAQ's you should read before posting. Don't expect instant
answers as most of these forums are handled by volunteers from all over the
planet [different time zones etc], so you may have to wait for responses.


--
Regards,
Touch Base
Report back on the results, good or bad so others may benefit

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://spywarehammer.com/simplemachi...php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or another appropriate forum for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Kaleb Buckner wrote:
> Okay, so the subject pretty much says it all. I've found that explore.exe
> will be running at all times. I will hear random page refresh clicking
> sounds. If I for whatever reason leave my computer on overnight, the next
> morning I have 1 or 2 popups there.
>
> Did a little research on this on my own, ran multiple scans with SUPER
> AntiSpyware Free Edition (I don't have the money to spend on this kind of
> thing when there are ways to do it manually). All kinds of cleanups and
> restarts, only to find it always comes back.
>
> So I did the last thing I could think to do, and that was to go through
> each of my processes manually and see google them to see what they were
> capable of doing. I did find one process, C3Gd0Ij3.exe, that returns NO
> results on google. I took the risk, ended the process tree (just in case)
> and bam, I was able to actually kill the iexplore.exe process and it
> didn't
> go all zombie on me.
>
> So I went through to find this C3Gd0Ij3.exe and related files on my
> computer and deleted them with no problems. I decided to run another full
> scan of my computer in case it was still moping around somewhere and hoped
> it was more vulnerable to removal, being offline. Well, about 4 hours
> later, the process randomly starts up again! The files I deleted are back
> and I grow weary of fighting this alone with my limited experience.
>
> So, I come asking for help. Rather lengthy post but I wanted to convey as
> much information as I could. I've not posted here before so if you could
> email me that would be great, thanks!