Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't Remove Iexplorer.exe And Window.exe From Windows Folder


  • Please log in to reply
2 replies to this topic

#1 Piyu

Piyu

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:48 AM

Posted 15 June 2008 - 01:11 AM

Earlier today my computer got hijacked by some spyware. The effect was immediate (desktop wallpaper got changed, Internet Explorer repeatedly went to a particular site advertising a spyware removal program, etc.). I ran the latest Spybot and Ad-Aware, even the free trail versions of CounterSpy and Spyware Doctor, updated ZoneAlarm, and now everything is *almost* back to normal.

There are just two things left: iexplorer.exe and window.exe

I did some searching on Google and neither of them are legitimate Windows files and appear to be malware. Both of them have creation dates that match with the time my computer suffered the spyware attack. Both of them reside in C:\WINDOWS\ Both of them give me an error message that says: "Cannot delete [name of .exe]: It is being used by another person or program. Close any programs that might be using the file and try again." When I try looking in the Task Manager I do not see either of them running.

I have tried booting my computer in Safe Mode and I cannot delete those files even then. I get the same error message about the programs being in use.

Spybot and Ad-Aware do not recognize these files as malicious. HijackThis doesn't seem to either, though that might just be my lack of understanding.

I tried to follow the "How to remove a Trojan, Virus, Worm, or other Malware" tutorial on this site (http://www.bleepingcomputer.com/tutorials/how-to-remove-a-trojan-virus-worm-or-malware/) but Autoruns did not list them anywhere so I wasn't able to pull them from the startup process.

None of the "bad" stuff associated with the inital spyware attack appears to be happening anymore, but I really don't trust these two pieces that remain. Can someone help me delete these?

Edited by Piyu, 15 June 2008 - 01:36 AM.


BC AdBot (Login to Remove)

 


m

#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,570 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:48 PM

Posted 16 June 2008 - 02:00 AM

You could try deleting those files with MoveOnBoot.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,560 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 AM

Posted 16 June 2008 - 07:22 AM

If you have not deleted those files yet, go to jotti's virusscan or virustotal.com. In the "File to upload & scan" box, browse to the location of the suspicious file(s) and submit (upload) it for scanning/analysis. Then repeat for the other file.
-- Post back with the results of the file analysis.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users