My system ( Dell Inspiron 1520, Core 2 Duo T5250 @ 1.5GHz, 2 GB RAM, 160GB HDD, 8600m GT) was acting a bit sluggish, so I launched Process Explorer, and when I saw the process tree I was astounded:

alt text

Why are so many processes running ? I don't use Internet Explorer. I use Steam so I suppose that's 1 app which uses the IE rendering engine. This is not the first time that its happened, I had to get a screenshot this time. I've run HijackThis, and had the logs scanned, but it doesn't show any malicious processes running.

link|improve this question

1  
Theoretically, each IE tab could be using its own process. Maybe there's a bug in the Steam client. – alex Jan 7 '10 at 9:32
feedback

1 Answer

up vote 5 down vote accepted

I've seen this behavior on others machines before. I know you've run HijackThis already, but give MBAM (Malwarebytes' Anti-Malware) a try, it may have missed something. A lot of malware will try and "phone home" to give the coder information as to what the software is doing, or just as a notification that it's up and running on a remote machine. They may also be using your machine to visit other sites for various reasons (gaining ad revenue, DoS, etc). A lot of coders don't properly terminate these forked processes and this is what you get as a result.

I'd also download Sysinternals TCPView and see what these IE processes are connecting to.

link|improve this answer
1  
TCPView shows that they're connected to my system, on random ports ( 61xxx series), but no remote connections. Will try MBAM. The connections make me fear if my system has been converted into an on-demand DDoS provider :-s – Sathya Jan 7 '10 at 10:01
Yep, you could indeed be a member of a botnet ( en.wikipedia.org/wiki/Botnet ) – John T Jan 7 '10 at 10:17
2  
MBAM found Trojan.Vundo & Trojan.BHO, and few malicious registry keys deep in HKR\CLSID and HKR\Typelib hives. Thanks! – Sathya Jan 7 '10 at 10:37
You're most welcome :) – John T Jan 7 '10 at 10:39
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.