Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Iexplore.exe On Boot Up - Same Problem As Tjo123


  • Please log in to reply
2 replies to this topic

#1 physguy88

physguy88

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:06 PM

Posted 06 July 2007 - 07:20 AM

Hey guys, I'm posting here because I found Tjo123's post from google:

http://www.bleepingcomputer.com/forums/t/96548/iexploreexe-backdoor-at-bootup/

He seems to be the only guy on the internet with the same problem as mine. I have the exact same symptoms and I found out a little more about what iexplorer.exe is doing using a program called process monitor from ZDNet.

iexplorer.exe is writing to a file called c:\windows\system32\Systemfiles\klog.dat every time I press a key on the keyboard. Clearly, I think, it's a key logger. You'll find this same directory in his combofix.exe scan. That's how I found his post through google. Now, in this directory, which my laptop and other normal computers don't seem to have, was created on June 11. Inside, besides klog.dat, there is a file called taskmgr.exe. Neither Symantec nor Windows Defender recognizes this as malware but it's pretty darn suspicious.

After I quarantined this file using Symantec, the iexplore.exe file still boots and still writes to klog.dat, so some other file is doing the dirty work.

Have you guys been able to find out any more info?

Thanks for your help.

Edited by physguy88, 06 July 2007 - 07:26 AM.


BC AdBot (Login to Remove)

 


#2 physguy88

physguy88
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:06 PM

Posted 06 July 2007 - 07:21 AM

I should add that, besides a general slow down, my computer also started freezing every time I open outlook.

#3 physguy88

physguy88
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:06 PM

Posted 06 July 2007 - 08:12 AM

Well, it definitely appears that systemfiles\taskmgr was the problem. iexplore.exe stopped booting after I deleted this line in my registry found by combofix:


*Newly Created Service* - NVXBAR

HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7AC5DF9C-0F1C-E2CB-6770-4B2C483A02CD}
C:\WINDOWS\system32\Systemfiles\taskmgr.exe s

Incidentally, a lot of my personalized profiles on my computer also seems to have been lost. For example, when login into outlook, outlook asks me to start a new profile.

So.... is this a legitmate windows process or not???




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users