IEHighutil.exe Need urgent help, something that can fry my GPU

[AlexRD]

Hi,

After my friend lent me his minecraft mod setup, i noticed that there was a folder called Temporary on my C folder. I tried to delete it but it wouldn't let me because iehightuil.exe was using it.
I noticed my system was making more noise than usual on idle, as if the system was under stress, so i immediately shut it down. I went into bitdefender rescue mode, ran a full system scan, that didn't detect anything. I googled it, got worried, ended iehightutil.exe process and permanently deleted it from my system, removed it from msconfig startup and deleted it's entry.

But i am worried it has spread. Bitdefender didn't detect it at first. So what if it spread to some unknown location on which it won't be detected by bitdefender? I even installed malwarebytes but so far it didn't detect anything, so i'm not sure i removed the virus correctly, or they don't detect anything at all.

After googling iehighutil.exe, it is said that its an exploit to the java security hole, that uses it to infect the system in question.

Now after running revo uninstaller to uninstall java from my system, i see something shady called setup version 1.0, on further inspection lists me in Program Files a folder called AppName, which i don't know what it does.

Several people reported having their GPU fried after noticing Iehighutil.exe . I don't wish to be counted among them.
Can someone help me be sure that my system is clean, and my GPU won't be fried?

 

[AlexRD]

One more thing, i didn't have java installed in my system at all, but after searching my system for JAVA, i found java.exe in system32 folder

 

[Arc]

Some other programs may install Java for it's use. Whatever, it is a threat, and need a precaution better than BitDefender.

First, scan the system for possible virus infection with these two tools.

• Anti-rootkit utility TDSSKiller
• Windows Defender Offline

Possibly they will catch something .... as I have seen in your other thread that you got a crash caused by SCSIPORT.sys.


Let us know what the scans found.

 

[AlexRD]

Alright, will post back with the scan results.
By the way, shouldn't i post something like the list of processes running in my computer to see if there is any shady process there? I can't remember the name of the program that did that, among other things.

 

[Arc]

These two programs ... specially WDO will take care of all the processes hopefully

 

[Alejandro85]

Minecraft itself is 100% written in Java, so if you can play it, you HAVE to have Java. If you are concerned about security (which you should not, if you have a decent antivirus), disable the Java web plugin which is the only component that has known security issues, after that you are safe from new threats. Of course, won't be able to play Minecraft in the browser, but the desktop version will work perfectly.

Now, make sure you do a deep scan with a good antivirus program to make sure it went away. A file search utility may also point additional copies of the virus if it's still present.

 

[Layback Bear]

What exactly is this, minecraft mod setup?
How did you install this mod setup?
Did you scan the mod setup before installing?
Where did your friend get the mod setup?

 

[AlexRD]

What exactly is this, minecraft mod setup?
How did you install this mod setup?
Did you scan the mod setup before installing?
Where did your friend get the mod setup?

The mod setup is actually just the folder with the mods installed, to which i replaced in the appdata.
It's not an installer, it's just the way he played minecraft.

He made it himself, but now i see i should have known better to scan it at least. I don't think however, that bitdefender would have found anything.

By the way, TDDS Killer found one infection on Iastor ( i think thats intel rapid storage ) which i removed about a week ago from my system. By mistake, i quarantined the file instead of removing it, but now i'm not sure where to access the quarantine to delete it


EDIT: Is there a Windows Defender Offline Offline version? Because its downloading at like 5 Kb/s, i left it for 20 minutes, and it downloaded 8 MB. Not to mention, after it reaches about 100 MB the download fails.

 

[cottonball]

AlexRD,

Please do the following to see what is going on in the system...

Download DDS from any of the following:
http://download.bleepingcomputer.com/sUBs/dds.scr
http://download.bleepingcomputer.com/sUBs/dds.com
http://www.infospyware.net/sUBs/dds
Save the program to the Desktop <<<---

Disable any script blocker, and then double click dds.scr to run the tool.



When done, DDS opens two (2) logs:

• DDS.txt
• Attach.txt

Save both reports to the Desktop.

-----------------------------------------------------

Please attach both logs to your reply.

 

[indianacarnie]

Do what cottonball said first. Have you tried this? : Malwarebytes : Malwarebytes Anti-Rootkit It IS still in beta but hasn't hurt my machine. Might be worth a shot. Everything I can find about it says its a trojan/rootkit. WDO should take care of it and/or malwarebytes anti-rootkit.

 

[AlexRD]

I ran WDO, Malware Bytes Rootkit, TDDKS, Karspersky Virus Removal Tool, and TDDKS found a rootkit on iastor, which funnily enough, had something to do with the SCSI. That's it. That's what all of those programs found.
I guess my computer is clean now?

EDIT: Here are the DDS reports

EDIT 2: I opened task manager again to see if iehighutil.exe was running, but then found a process named ielowutil.exe . Is someone messing with me? haha
But, instead of opening the process location, i ended it. Now i have to wait to see if it runs again to get to the bottom of this.

EDIT 3: I also uploaded a msinfo32 report

 

[cottonball]

TDSS/TDL3 uses rootkit technology to hide itself on a system by infecting drivers like iastor.sys, atapi.sys, and a few others.

We can't be too careful with this. Need to see the following:

The TDSSKiller tool outputs its log to the disk with the Windows operating system, normally C:\

Logs have a name like:
C:\TDSSKiller.2.4.7_27.02.2013_15.31.43_log.txt

Please post the TDSSKiller log in your reply.

 

[Arc]

And, an iaStor.sys error anytime may cause an scsiport.sys BSOD, as both of these are storage root related.

If those tootkits are deleted, hopefully the BSODs will also be stopped, provided iaStor itself is not causing a problem there. Other than this particular version, all other recent versions of RST (iaStor.sys) is somehow problematic.

 

[cottonball]

Arc,

Hopefully, if a backup copy of iaStor.sys is not found, TDSSKiller will try to cure the infected file.

However, we need to take a gander at that TDSSKiller log to see if the issue was resolved.

Otherwise, we need to find out what is going on...

 

[AlexRD]

Arc,

Hopefully, if a backup copy of iaStor.sys is not found, TDSSKiller will try to cure the infected file.

However, we need to take a gander at that TDSSKiller log to see if the issue was resolved.

Otherwise, we need to find out what is going on...

Umm... I deleted the log yesterday. But from what i remember is, IASTOR.sys had 3 infections on it, and it couldn't be disinfected, only quarantined and deleted. I deleted it.

Also, i ran driver verifier like someone suggested, and had a nice little BSOD as a surprise on log-on.
I uploaded the BSOD Dump.

 

[cottonball]

As far as the BSOD report goes, Arc is your expert.

It is unfortunate the report was deleted. The information on it is valuable in determining a plan of action.

Let's see if there is another iaStor.sys available in your system...

Please download SystemLook:
http://jpshortstuff.247fixes.com/SystemLook.exe
Save the file to the Desktop

• Right-click SystemLook.exe and select: Run as Administrator
• Copy the content inside the following quote box into the open field:

:filefind
iaStor.sys

• Click the Look button to start the scan.

When finished, a Notepad window opens with the results of the scan.

Please post the SystemLook.txt in your reply.

 

[AlexRD]

As far as the BSOD report goes, Arc is your expert.

It is unfortunate the report was deleted. The information on it is valuable in determining a plan of action.

Let's see if there is another iaStor.sys available in your system...

Please download SystemLook:
http://jpshortstuff.247fixes.com/SystemLook.exe
Save the file to the Desktop

• Right-click SystemLook.exe and select: Run as Administrator
• Copy the content inside the following quote box into the open field:

:filefind
iaStor.sys

• Click the Look button to start the scan.

When finished, a Notepad window opens with the results of the scan.

Please post the SystemLook.txt in your reply.

Done

 

[Layback Bear]

Do I understand correctly AlexRD; you got this from a friend?

 

[AlexRD]

Do I understand correctly AlexRD; you got this from a friend?

Yes, and everything that is being suggested for me here, i am telling him to do.
It's strange however, that he doesn't have a temporary folder in C:/

Why do you ask?

 

[Layback Bear]

Well so you can help your friend. Your friend is infected also. Knowing where your friend got this little sweat heart of a infection would also help making sure you and your friend don't make the same mistake again.