1

I'm pretty sure my laptop has been infected with a virus but I can't identify it or remove it.

Symptoms:

  • Multiple explorer.exe processes being spawned some consuming lots of memory enter image description here

  • When I launch IE the history shows lots of sites/pages I've never visited. enter image description here

  • When I shutdown I see flashes of images that look like they are from web sites filled with ads.

I'm guessing the background explorer.exe process are visiting sites to either increase views or click-thrus and to make it look like it's coming from different computers.

What I've tried:

  • Downloaded CCleaner and remove temp internet files, etc
  • Downloaded and run multiple anti-virus programs including McAfee, AVG, Malwarebytes and Ad-aware
    • Scans have been run in both normal Windows and safe-mode.
    • Most of the AV programs haven't found much. Mostly bad cookies which I think are related to the hidden browsing going on.
    • AVG did find an HTML/Framer and Java/Downloader virus on first run but claimed it cleaned it and then ran clean on the next runs.

  • I can end the explorer.exe process from Task Manager but new spawn again. If delete all explorer.exe process then eventually I hit the real one and the task bar, etc goes away.

    • I've also download Process Explorer to try and find the parent process but the parent looks like the system process: enter image description here

I am reaching the point where I think a clean install is my only option but hoped there is an solution to remove this without resorting to that.

Improve this question
4

2 Answers 2

Reset to default
1

You may need to try the Combofix tool next. It's a very powerful tool, so make sure you have backups of your important data. It works on Windows XP, Vista, 7 and 8; make sure you run it as an Administrator though. This tool goes through many more checks than typical anti virus programs

DISCLAIMER: I only use this product, I do not help develop it or receive compensation for telling others of its use. It works well for me, so I am offering it as a possible solution.

Improve this answer
3
  • Running this over night. Will check the results in the morning. If that doesn't work I think reinstall is my only option.
    – Brad Patton
    Feb 25, 2014 at 1:39
  • ComboFix hung after rebooting (sat there all night). Ended up going with re-imaging the system.
    – Brad Patton
    Feb 26, 2014 at 3:29
  • That sucks, sorry to hear that
    – Canadian Luke
    Feb 26, 2014 at 13:49
0

Yes. I've seen this multiple explorer.exe before and even if you kill the processes, they still come back. Malwarebytes is the only software that fixed the virus.

Improve this answer
1
  • OP already tried Malwarebytes
    – Canadian Luke
    Feb 24, 2014 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .