IEXPLORE.EXE(99% CPU useage)

hello people..
got a little problem over here and I couldnt find its trace. Last night, I was using my computer as for my daily routine. reading posts and stuff. The OS really got stuck.really went slow, like I couldnt open nearly anything. CTRL+ALT+DEL showed me that IEXPLORE.EXE is taking 99% of CPU usage.

I launched system restore,it solved the problem for a while, but when I tried to access apartition in my hard drivr, it again got stuck. I launched system resotre again and opened my hard disk partitions in Internet Explorer browser(i.e. type c: in the address bar), and it showeds me the contents of C drive.

System restore feature restores the system cpu usage for a while, and let me do everything I want, but when i try to access my partitions by clciking My Computer icon, it gets stuck.

It means that I can still install and run any applications, until the computer gets stuck again. I am unable to find any traces behind all these strange happening.

I am using a Windows XP professional version on an Intel celeron machine.

Any suggestions and recomendations from you people.
Thank you
ommy

you've gotten yourself a virus.. there's a few that it might be.
do you have an up to date (defintions wise) Antivirus scanner ?

search the forum for that IEXPLORE.EXE or have a look here in google

IE using 99 % of CPU can be for a variety of reasons .. and not neccasrily be linked to a virus....

IEXPLORE is the service used by Internet Explorer is a valid service....

Could you share more info about your problem.. did you install any new program .. or what was a specific activity after which your PC started behaving awkward..... Was it the last mail that you just opened... or a resource hungry website... or that ur browser was trying to open / acccess other program like acrobat, word etc.....

Once u share the information it could be simpler to analyze ur problem..

In the meantime always recommended to update ur virus definitions and run it once.. also scandisk your hardisk to verify any harddisk related problems....


Regards

yes indeed it is a valid service.. and yes it might not be a virus..
but something about this one strikes me as being virus related.
there are I believe, a few that masquarade as a vaild file.
svchost.exe is another example.

do a search of the drive for this file and tell us the locations you find it in.

(and file sizes would help too)

edit : here are just two of the possible viruses that it could be.
http://www.sophos.com/virusinfo/anal...32spybotv.html
http://www.sophos.com/virusinfo/anal...2lovgatee.html

ommy,

iexplore.exe can hog cpu for a variety of reasons.

as previous posts indicate these include ... amongst others ...

+ virus
+ internet sourced activity
+ other installed ie plugins
+ other installed explorer plugins
+ ms related issues

also your issue seems to arise when attempting to access your local disk(s) which may suggest that other issues arise including disk fragmentation.

I'd suggest that you do the following:

+ ensure that you have the most up to date virus definition file for your protection software
+ shutdown network connections
+ run a full system scan and clean if necessary
+ reboot your machine, if necessary re-run your virus scanner after reboot
+ defrag your local drives

still having problems: come back here with the fullest infomration you can manage - you can find various hints on obtaining system information in the fora on this site - mostly it's just a case of running some simple tools and cutting and pasting the data into your post. You may find it convenient to paste the data into a clibboard or text file as you acquire it and then add to your posting when you've gathered all your bits and pieces.

Best

TQ

Note also you stae that you are using system restore to correct the problem.. BAD MOVE..

If you have a virus.. the virii will also be restored..

1/ Use the Msconfig utility and post a list of what is in your startup (Start-Run msconfig OK)
2/ When you bring up taskmanager.. list ALL the progs tha are running here
3/ post the above information here OR

D/L Hijackthis and post the process details it lists.. don't change anything just yet OK

And if your AV is not upto date, or installed. tsk tsk tsk

(removed 6 versions of MSBLASTER from one machine yesterday weiredest symptoms I ever heard of..)

Cheers

Possibilities in order of approximate likelihood:

- An applet (Java or ActiveX) on the page that you're on is hogging the CPU (This includes flash)
- A script (Javascript etc) on the page that you're on is hogging CPU
- Some HTML error by the coder of the page causes some part of it to continuously reload, possiby invisibly
- A bug in IE (surely not!) causes it to go into some kind of loop on a particular page (possibly combined with any of the above)
- Some kind of IE extension (google bar, etc) suffers from one of the above
- Malicious code

Note that I've put malicious code at the bottom.

If, when going to a known page that has no scripts, applets, dodgy HTML etc, from a clean boot, causes this behaviour, it is most likely a dodgy IE extension. Try disabling 3rd party extensions (A menu option somewhere) and restart. If it *still* happens, it might be malicious code.

Slarty

well... What I was doing before my system started behaving insane was a little messy.. I downloaded a crack for a program(though I know its wrong t do so, But I have reasons :) )
Executed the patch but that was the wrong patch and execution resulted in an error message saying "mismatched version or already patched". I looked at the application carefully and I came to know that it was a worng patch downloaded. Alongwith the patch there was registry file(.reg), I executed it that as well. At first I thought, that those registry keys are malicious, so I opened the .reg file(it was a normal .reg file inserting keys with username and password for the desired application). So I 'regedit' my machine and and remove those keys that was inserted by that .reg file that came along with the patch. And ofcourse for getting the crack, I visited alots of sites that gives you cracks and serial numbers (yes, with alots of popups and porn banners, but I immediately 'spybot s&d' on my PC and removed all spyware, but still there are popups even if I am not going to any of those sites anymore).

I dont think that its a virus, but I would like to go though a virus scan as well.

Defragmenttaion is a good idea as well. Cane there be more then one IEXPLORE.EXE processes in task manager, coz I have seen 2 processes of IEXPLORE.EXE in task manager.

I'll post the screenshot of my startup and task manager (though, I have already gone through this, and I recognise every running process)

Thanx for helping
lookin forward..
Ommy

hmmm... my taskmanager shows me 99% for iexplore, too.
but it's only ~4% !!

???

Hi, ommy

Yes, if you open another IE session you will get another iexplore.exe. BUT IF YOU HAVE NOT....you most probably have malware on your system that is opening the session.

Are you running a firewall? It should warn you if something is trying to phone home?

Update your AV and run it in safe mode , do the same with AdAware and SpyBot.

You should also get CWShredder, you will have to google for it, as the major sites have been undergoing a DoS attack, and have been down :(

You must run this without any browser windows open.

Good luck

I don't have iexplore.exe in my task manager. I have explorer.exe, but then I also don't use IE as a browser.
I found this when searching for muliple iexplore.exe in task manager.

Quote:

---

Backdoor.Tofger
http://securityresponse.symantec.com...fger.html?Open

W32.Hostidel.Trojan.B
http://securityresponse.symantec.com...an.b.html?Open

---

as to be the likely cause. This came from here

Yes,

"explorer.exe" is windows explorer and is normal.

"iexplore.exe" is Internet Explorer and you will get one running for each instance of IE you have opened. That is actually clicking on the icon to run the program again, NOT opening something in a new page or window.

So, if you lgin and go on the net for a while and find that you have more than one iexplore.exe running, it means that you are infected.

As your problem is probably a trojan I would suggest that you get a trial of Moosoft's "The Cleaner".

AVs are not very good at detecting trojans :(

Good luck

I have managed to gather all the possible screen shots. I am uploading them in a zipped file. I have also found some strange processes when i looked more carefully, I have encircled them in the images, I am uploading. Moreover I also did netstat on ma PC and found some IP's, even when I was not doing something(no browsing/IM)Please have a look on them...
thank you
ommy

Hi,

1. Do you realise that you have a keylogger installed?
2. Kazaa..........................arrgh! :p
3. Some of the other stuff looks very suspect? I will have a look at it later today.....have to go to a meeting right now.

Perhaps some of the other members can help, if they recognise the items?

Cheers

yes Nihil, I do realise that I have installed a keylogger, and that is for montioring my PC when I am away. Kazaa is something that is I use for experiments, like looking for ways to tunnel its traffic with HTTP traffic but it nerver got connected neither I found some good tutorial or helping material that could help to make me understand that how can I tunnel Kazaa's traffic with HTTP traffic so that it look legitmate traffic to the firewall,but I never got connected to Kazaa(as my ISP has banned almost every p2p application for saving their bandwidth)

And do look at the netstat screen shot.
Thanx

and now its "explorer.exe" is hogging the CPY with 95% usage...and I believe its not a virus..and I couldnt access the defrag menu..when I try to access the menu, the computer gets stuck....

There is another discussion about this problem going on here, now I didn't read through the whole thread, but there are a few posts with some advise on how you may cure this problem.

Good luck.

did almost evrything..looked into microsoft knowledge base, googled it every where...ran AV with latest updates, ran anti trojan, registry-mechanics, but the problem is still there, as I searched it on google and alots of people are having these kinda problems with CPU hog...
this thread is dying
...
:(

ommy

1. Update Spybot S&D
2. Get AdAware & update it.
3. Update your AV
4. Boot into safe mode and run 1,2, & 3.
5. Empty your IE temporary files and history.
6. Defrag your HDD in safe mode.
7. Open your "Hosts" file in a text editor and delete all the stuff you do not recognise that you want..............mjxads is one to get rid of for example :)
8. Get rid of Kazaa
9. Run a couple of online scans like PcCillin (Trend Microsystems) and Panda
10. Get CW Shredder and run that.
11. Edit your startup file and only run things you really need............like you don't need a keylogger when you are on your machine? "BadBlue" ?????...........just start stuff when YOU need it, not when you boot up.............you avoid conflicts and memory leaks that way.
12. Update your video and soundcard drivers. ( :D trust me)

If that doesn't fix it try running Windows repair from your CD.
If that doesn't work try re-installing Windows and re-applying all the MS patches.

I do not know what uo428 is..........find the executable and rename it uo428.txt, then watch for error messages on boot-up. fhesrv32.exe is your folder hiding software (AB Hide Folder)

I could not resolve the DNS on most of those IPs, but I think that clearing the Hosts file will resolve that.

It might help if you posted a HijackThis log after step 10.

Cheers