Re: IE runs at 99%



"Ron" <ronjon2@xxxxxxx> wrote in message
news:%239Fwhz7LIHA.4712@xxxxxxxxxxxxxxxxxxxxxxx
A couple days ago I turned my computer on and had more spam and crap than
I've ever seen. I've been working for two days now

Way too much time spent.

to try to return to normal. I have Zone Alarm Security Suite, SpyBot,
Adware, Norton but nothing works. I got rid of the one worm I found, 22
spywares, and 283 ad's. This happened overnight or in one day of use. I
have used all the utilities in normal mode, Safe Mode, etc but no luck.
System Restore won't work for any date chosen.

The restore points are likely infected, so when you restart the system, the
first thing to do is delete them by turning System Restore OFF. Then turn
it back on.

Everytime I turn the computer on Task Manager reports explorer.exe running
at 99% and won't let me shut it down or delete it and explorer is not even
open.

Actually, it is. What you see as the desktop *is* Explorer.

Task Manager doesn't show you nearly enough detail. Try Process Explorer
instead.

OK, I'm off point. What I want to do is slow explorer down so I can
reformat and rein-stall. Anyone have any suggestions?

No, that is not what you want to do. What you want is not to slow explorer
down, but to disable the malware that's running.

First, shut the system down, remove the drive, attach it to another system,
and scan it for malware *there*, after first locating and clearing all the
temp folders and the content.ie5 folders. Locate and clear these folders
for all accounts. Empty the recycle bin. Chances are high that the
running malware is actually in one or more of these folders.

I would suggest that you scan that drive using the installed A/V app on the
host system, and also the online Trend Micro Housecall site.

Also, afterwards, do a manual search of the Windows and System32 folders for
files that just shouldn't be there. A preliminary view using a command
prompt and "dir /ah" is often useful, as some malware hides itself with the
hidden attribute. You may need to use the attrib command to take these
files out of hidden *and* system status to rename or delete them.

After you have done these things, put the drive back in and restart, without
a network connection, in Safe Mode. Run MSCONFIG, and disable or delete
any suspect entries. Then install and run HiJack This, and use it to
locate and remove other malware references.

Finally, restart in regular mode, still not connected to networks.
Rescan the system, but consider that the A/V install is possibly damaged.
Run Process Explorer as you reconnect to the internet and watch carefully as
the system responds.

HTH
-pk


.



Relevant Pages

  • Re: IS this caused by a virus?
    ... It could certainly damage the video drivers and registry settings. ... Safe Mode, there's another VGA mode, which will use a very generic driver ... antivuris will detect any malware during the copies. ... locate all the "content.ie5" folders and cache folders for other ...
    (microsoft.public.windowsxp.general)
  • Re: IS this caused by a virus?
    ... It could certainly damage the video drivers and registry settings. ... Safe Mode, there's another VGA mode, which will use a very generic driver ... antivuris will detect any malware during the copies. ... locate all the "content.ie5" folders and cache folders for other ...
    (microsoft.public.windowsxp.general)
  • Re: Ping Malke
    ... > | running from safe mode, be run from safe mode WITH COMMAND PROMPT instead. ... > there is malware being chained off of explorer such as... ... one of the reasons for which you are better of in safe mode with command prompt. ...
    (microsoft.public.security.virus)
  • Re: Change default file view when browsing for a file to thumbnail
    ... Open either Explorer or MyComputer. ... Select any folders with your graphics, on the Toolbar click the dropdown for Views and select Thumbnails. ... Safe Mode breaks a few settings which need your attention after rebooting to your normal desktop. ...
    (microsoft.public.windowsxp.general)
  • Re: Original version of Windows 2000 Pro has re-appeared
    ... And is there any change if you boot into safe mode, then check in Explorer ... Darned if I can find them using Windows Explorer. ... Also tried a system search for one of the folders: ...
    (microsoft.public.win2000.general)