Solved IEXPLORER.EXE process keeps growing (malware-related?)

Thanks for your help noahdfear.

Just to keep you informed about what is taking me so long...

I will take a look into this in a few days. My McAfee license came pre-installed with the Dell system, and it included a 3 year subscription to updates. I will check if a re-install disk was supplied with the computer. I'll also have to check how to avoid that the McAfee subscription will end by uninstalling, as I have no documents from this, I assume. Looking for and checking the box next weekend, may enlighten me.

Apart from that: The McAfee firewall indeed seems pretty lame/tame. While it was running, I just picked up a fake trojan allert bratsk.exe. I did not install / agreed / clicked yes in iexplorer to any requests. I do remember an assert warning. (I think stuff enters at that point, and McAfee doesn't mind). Then it crashed my acrobat reader process and my computer shut down suddenly. After rebooting I saw the process and googled it.

Only after a minute or so McAfee told me 'Bratsk.exe' was accessing the internet, which I blocked.

First ran spybot, no trojans were found. I tried to update, but the update is disabled (all checksums bad), then I started mbam for scanning. It recognized and removed bratsk (I think, it told me so ;-) ).
Spybot updates still don't work. Will try again tomorrow... way past bedtime...

 

Oh no! You just now picked up bratsk? That nasty usually comes bunbled with some other nastier junk. If so, I recommend you run ComboFix.

Download ComboFix by sUBs from here, saving the file to your desktop.


Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click ComboFix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

 

Hi noahdfear,

You must be getting headaches from my system. At least I do. I'm glad you know the naugthy bratsk.exe intruder. I'm sorry that I hassle you with that on top of the initial issue. Sorry... I'm quite impressed by the creative minds malware coders seem to have. They should use it to something useful with it in stead of annoying everybody

I did indeed pick up the bratsk.exe 2 days ago, had it scanned/removed by Mbam, and after my previous post here, I picked it up again the day after. Not sure why and how it finds a way around the McAfee firewall. It's running in 'tight' mode, so should monitor and alert quite some stuff. Anyway: I got it a second time BEFORE I read your post, meanwhile updated spybot, but it does still not detect this one. So I used Mbam again and kicked bratsk once more, keeping my firewall locked down this time until it was finished.

I add the mbam log here after the second infection removal attempt, just to show what it did BEFORE the combofix tool was released on my system.

Malwarebytes' Anti-Malware 1.30
Database version: 1366
Windows 5.1.2600 Service Pack 3

5/11/2008 22:34:22
mbam-log-2008-11-05 (22-34-22).txt

Scan type: Quick Scan
Objects scanned: 58595
Time elapsed: 13 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3ba4271e-5c1e-48e2-b432-d8bf420dd31d} (Rogue.DeusCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\brastk.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Then I ran Kaspersky online scanner again during the night to have a second opinion. No critical stuff at first sight.

When I read your post, I downloaded Combofix, manually disabled all McAfee components including the firewall, the scanners, real-time protection units, script analysers and alerts. I don't seem to be able to just 'quit' the security center (the guidance page you link to contains no McAfee security center hints). So I sent most components out for a 30 minute break (a bit optimistic, I'm afraid). Combofix first kept the HD busy, then it installed the Windows Recovery Console, taking 15 minutes, and I began to fear that it stalled, but the HD-led was *so* active that I did not interfere. After that, it rebooted, which relaunched McAfee Security center.

ComboFix 08-11-05.02 - master 2008-11-06 21:12:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.599 [GMT 1:00]
Running from: c:\documents and settings\master\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PACKET
-------\Service_Packet


((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 )))))))))))))))))))))))))))))))
.

2008-10-30 22:33 . 2008-10-30 22:33 250 --a------ c:\windows\gmer.ini
2008-10-23 20:48 . 2008-10-15 17:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll
2008-10-21 20:54 . 2008-10-21 20:54 <DIR> d-------- c:\windows\system32\scripting
2008-10-21 20:54 . 2008-10-21 20:54 <DIR> d-------- c:\windows\system32\en
2008-10-21 20:54 . 2008-10-21 20:54 <DIR> d-------- c:\windows\system32\bits
2008-10-21 20:54 . 2008-10-21 20:54 <DIR> d-------- c:\windows\l2schemas
2008-10-21 20:51 . 2008-10-21 20:51 <DIR> d-------- c:\windows\ServicePackFiles
2008-10-20 21:55 . 2008-04-14 01:12 1,737,856 --------- c:\windows\system32\mtxparhd.dll
2008-10-20 21:54 . 2004-08-03 21:41 1,041,536 --------- c:\windows\system32\drivers\hsfdpsp2.sys
2008-10-16 19:23 . 2008-10-16 19:23 <DIR> d-------- c:\program files\Mythicsoft
2008-10-15 00:20 . 2008-08-14 11:11 2,189,184 --------- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 00:20 . 2008-08-14 11:09 2,145,280 --------- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 00:20 . 2008-08-14 10:33 2,066,048 --------- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 00:20 . 2008-08-14 10:33 2,023,936 --------- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-15 00:20 . 2008-09-15 13:12 1,846,400 --------- c:\windows\system32\dllcache\win32k.sys
2008-10-15 00:20 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys
2008-10-12 23:03 . 2008-10-13 20:15 <DIR> d-------- C:\rsit
2008-10-12 21:03 . 2008-11-05 01:40 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-10-12 21:03 . 2008-10-12 21:03 <DIR> d-------- c:\documents and settings\master\Application Data\Malwarebytes
2008-10-12 21:03 . 2008-10-12 21:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-10-12 21:03 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-12 21:03 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-10-12 11:46 . 2008-11-01 15:42 54,156 --ah----- c:\windows\QTFont.qfn
2008-10-12 11:46 . 2008-10-12 11:46 1,409 --a------ c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-05 23:37 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-05 21:13 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-05 00:06 --------- d-----w c:\program files\McAfee
2008-11-02 21:17 --------- d-----w c:\program files\FLV Player
2008-11-01 14:43 --------- d-----w c:\documents and settings\master\Application Data\Corel
2008-10-26 21:32 --------- d-----w c:\documents and settings\All Users\Application Data\pdf995
2008-10-06 22:06 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-04 14:13 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-04 14:12 --------- d-----w c:\program files\Lavasoft
2008-10-04 14:10 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-04 13:22 --------- d-----w c:\documents and settings\master\Application Data\Uniblue
2008-10-03 20:20 --------- d-----w c:\program files\Trend Micro
2008-09-30 18:49 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-09-29 18:45 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-09-22 19:00 --------- d-----w c:\program files\FLAC
2008-09-15 21:08 --------- d-----w c:\program files\IrfanView
2008-09-09 21:52 --------- d-----w c:\program files\Microsoft Works
2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys
2008-02-23 19:50 470 ----a-w c:\documents and settings\master\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport "= "c:\program files\Dell Support\DSAgnt.exe" [2006-08-28 395776]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PhotoShow Deluxe Media Manager "= "c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"ATICCC "= "c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"DMXLauncher "= "c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"CTSysVol "= "c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"UpdReg "= "c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VoiceCenter "= "c:\program files\Creative\VoiceCenter\AndreaVC.exe" [2006-02-16 1118208]
"ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 58992]
"Norton Ghost 10.0 "= "c:\program files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 1537696]
"DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"Google Desktop Search "= "c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-02-27 236544]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2007-04-08 282624]
"CanonSolutionMenu "= "c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter "= "c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"SigmatelSysTrayApp "= "stsystra.exe" [2006-07-24 c:\windows\stsystra.exe]
"MBMon "= "CTMBHA.DLL" [2006-06-29 c:\windows\system32\CTMBHA.DLL]

c:\documents and settings\master\Start Menu\Programs\Startup\
Shortcut to MEMO.lnk - c:\documents and settings\master\Desktop\Koen\2007 FinalMoveP133\Disk10\Program Files\memo\MEMO.EXE [2007-08-18 25650]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Scanner Finder.lnk - c:\program files\ScanWizard 5\ScannerFinder.exe [2007-03-10 315392]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify "=dword:00000001
"UpdatesDisableNotify "=dword:00000001
"FirewallOverride "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-10-08 203280]
S3 NAL;Nal Service ;c:\windows\system32\Drivers\iqvw32.sys [2006-06-05 24064]
.
Contents of the 'Scheduled Tasks' folder

2008-09-14 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://users.telenet.be/koen.vervoort1/explorerlaunch.htm
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Window Title =

O16 -: {A73BAEFA-EE65-494D-BEDB-DD3E5A34FA98} - hxxp://www.extrafilm.be/ImageUploader4.cab
c:\windows\Downloaded Program Files\ImageUploader4.inf
c:\windows\system32\unicows.dll
c:\windows\Downloaded Program Files\ImageUploader4.ocx

O16 -: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} - hxxp://as.photoprintit.de/ips-opdata/74914091/activex/IPSUploader4.cab
c:\windows\Downloaded Program Files\IPSUploader4.inf
c:\windows\system32\unicows.dll
c:\windows\Downloaded Program Files\IPSUploader4.ocx
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-06 21:16:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: c:\windows\explorer.exe
-> c:\program files\McAfee\SiteAdvisor\saHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\rundll32.exe
c:\docume~1\master\LOCALS~1\Temp\clclean.0001
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\gearsec.exe
c:\program files\Dell Network Assistant\hnm_svc.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\McAfee\MSK\msksrver.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-11-06 21:33:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-06 20:33:49

Pre-Run: 49.644.843.008 bytes free
Post-Run: 49,644,490,752 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

189 --- E O F --- 2008-10-23 23:46:13


I noticed a freshly created folder Qoobox in the root. Appears to be combofix stuff. In there is a text file: ComboFix-quarantined-files.txt, containing 7 or 8 entries I believe. Do you need to know about these?


Meanwhile, I have had no more RAM issues from the iexplore.exe during the last 5 days. So I may observe it a bit longer before actually uninstall McAfee. If it does turn up again. I will follow the instructions of the previous post before reporting again.

When looking deeper into the firewall's settings (why do they hide the essential stuff so well? I found a setting in to alert any registry changes, rather than just logging them. I hope this is going to give me a better idea where the bratsk.exe is coming from. I already had configured the firewall that I should approve any inbound/outbound requests from new software, but maybe that does not include active-X objects etc. Anyway... I'll stop talking... took enough of your time already.

Thanks,

Koen

 

Looks like things are cleaned up. There will likely be infected System Restore points, so lets finish cleaning up. First, open the MBAM interface and remove any items quarantined. Do the same with your resident antivirus.

Run ATF Cleaner once again as previously described.


Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.
You can delete any other logs that were created/saved too.


Monitor things for a couple of days and let me know if we can mark this one resolved.

 

I forgot to turn of McAfee security center during the combofix uninstall. It blocked RemAdm-proclaunch!171, during tis procedure. Yet I got a message that combofix was uninstalled. I had to remove the combofix folder and combofix.txt file manually though.

I will now further monitor the RAM-issue, as I haven't been surfing that much lately, but it looks promising.

And although I suppose this isn't the right place for this question... I was looking into becoming a contributing member, because I saw the people at WindowsBBS are doing a great job and I want to support their virtual home . I haven't decided yet about the period of subscription. 2 questions arise:

Is the e-mail addres .....@windowsbbs webmail only?
Are you guys planning on keeping this place open for at least a few more years?

 

I think those 2 questions are best answered by the Administrator and site owner. I'll shoot him a link to this topic.

 

Conclusion

Regarding my initial problem:

* No more error-messages have been displayed.

* No noticeable Ram-issues have come up in the last 10 days

* Bratsk has not returned


I'm still not sure what caused it in the first place, but it looks like it's in the past now...


Thanks for your time, expertise & help!

 

That's good news. I'll mark this topic resolved.