Solved Explorer.exe causes Iexplore to open multiple instances and high mem

[mohavepc]

Hello my friends:

I am working on an Acer all in one touch that had a minor malware infection that is now clean.

Websearch was found and cleaned by malwarebytes.

I have scanned with the following and found no issues. Malwarebytes, eset standalone scanner, Superantispyware tech edition stand alone, ADW, TFC, Mbar root kit detector, Kaspersky rescue dvd, AVG Rescue DVD.

What happens is this.
When booted up and using a clean boot no less the pc runs for a few minutes then something invokes Iexplore. then another and another I have seen a max of 7 running and one will be at max memory use.

If I kill Iexplore another opens. if I kill explorer.exe first THEN kill iexplore (all of them) windows levels off and runs normally except I have no desktop or menus.

I have tried sfc /scannow and it fixed a few things on 3 runs but no change in IE behavior.
I have run 3 scandisks no errors no repair no change in IE
I tried to do a repair install and it tells me it cannot set up the machine to restart and exits.

This is an Acer 23" touch all in one with i5 and 4gb memory. I am currently backing up data and settings.
Please let me know what tool you would like run and I will do so Sat before I Give up on Monday and wipe the damn thing out.

Thanks

 

[gregrocker]

Did you reset IE? Try uninstalling and reinstalling in Features

Which version of IE? Check Updates for newer version which might resolve it. Also all Updates installed since one may be a fix.

Otherwise it sounds like deep corruption which might be remedied by Repair Install if SFC can't handle it. It sounds like you cleaned it up thoroughly but search the infection to see if special tools are indicated. Often a wipe is best due to lingering corruption creep.

 

[NoelDP]

Check the Scheduled Tasks - I've seen malware sitting in there that MBAM has missed

 

[mohavepc]

Did you reset IE? Try uninstalling and reinstalling in Features

Which version of IE? Check Updates for newer version which might resolve it. Also all Updates installed since one may be a fix.

Otherwise it sounds like deep corruption which might be remedied by Repair Install if SFC can't handle it. It sounds like you cleaned it up thoroughly but search the infection to see if special tools are indicated. Often a wipe is best due to lingering corruption creep.

I did a removal of Iexplore and now have a different issue. I actually had to rename the 64bit version of iexplore exe using Linux. I was hoping I would get an error that would show mw what or why explorer.exe was calling Iexplore.exe.

Well I no longer have iexplore.exe eating up memory. there are now 3 instances or Explorer.exe and one is using up all available ram. There is something infecting this machine I am sure of it.

It is no longer a need to fix but more of a need to know what I am dealing with. I cannot repair install as it cant set up to reboot and fails to move past the primary gathering. I have backed up all the data and will wipe it out Monday if that's the last recourse. I would like to figure out whats doing this.

 

[NoelDP]

...and Scheduled Tasks??

 

[mohavepc]

Check the Scheduled Tasks - I've seen malware sitting in there that MBAM has missed

I think I am getting closer. Upon opening scheduled tasks I get an error of "The Remote Computer Was Not Found" I am assuming it was not found because in clean startup there is no networking running.

However in clean boot I cant read the data to see what tasks are scheduled. I will keep trying however and let you know.

Thanks for the ideas

 

[Layback Bear]

Do you have 7-Zip installed?

I did have 7-Zip do something very similar to one of my computer.
Everything would start pulsating about every sec. and then I would have a huge amount of browsers open.
Only shutting down and boot again would stop the action.

Mine would only do this when I uploaded or downloaded a zip file.

 

[gregrocker]

What exactly is the reboot problem you think prohibits a Repair Install? Have you tried running one? Error?

Have you run SFC, if necessary from disk CMD?

 

[mohavepc]

What exactly is the reboot problem you think prohibits a Repair Install? Have you tried running one? Error?

Have you run SFC, if necessary from disk CMD?

I have indeed run SFC with no issues coming up and when I run an inplace upgrade it tells me it cannot prepare the system to reboot into the next phase.

The exact error is as follows. after completing the gathering phase a window pops up and says

"Windows could not prepare the computer to boot into the next phase of Installation. to install windows, restart the installation."

 

[gregrocker]

Such an error sometimes clears after the reboot.

Can we see Disk Mgmt? Run a Startup Repair

How does Clean Boot prevent viewing or disabling all Scheduled Tasks?

 

[mohavepc]

Such an error sometimes clears after the reboot.

Can we see Disk Mgmt? Run a Startup Repair

How does Clean Boot prevent viewing or disabling all Scheduled Tasks?

After several reboot error is still there. I have run 4 disk checks all with reboots and 2 from install disk with same result. Startup repair finds no issues from disk or not 4 times now


Clean boot does not start the schedule task service ergo it does not load the file. I can boot in regular mode and kill all explorer.exe's then I can run task scheduler. I disabled all the tasks but after reboot still same issue so I don't believe it's in scheduled tasks.

Snips attached.

 

[NoelDP]

I think you'll need to sort out the Scheduled tasks problem first - but if the MMC console won't open you'll have to go into the XML and see if you can edit it there.
Ok to edit task's xml file in c:\windows\system32\Tasks? - Server Fault may help a little

 

[NoelDP]

... sorry - I missed that you'd managed to get into the control!

 

[mohavepc]

I think you'll need to sort out the Scheduled tasks problem first - but if the MMC console won't open you'll have to go into the XML and see if you can edit it there.
Ok to edit task's xml file in c:\windows\system32\Tasks? - Server Fault may help a little

Please see above Noel but thank you. the issue is not in any running or scheduled tasks as I have disabled all tasks in that console one I was in regular boot.

 

[NoelDP]

Check Event Viewer - see if that gives any clues - if you want; feel free to upload the Applications and System event logs and I'll see if there's anything that hits me.

 

[mohavepc]

Here are the logs. I did see a disk corruption that I will correct tomorrow with a disk check however I believe that was caused by me shutting down tasks as scheduled task manager now says that the tasks are corrupted. I am more likely going to have to reinstall 7 but with the reboot issue I may not be able to do that. Tomorrow is another day. I am going to go home and take the missus out to dinner for her Bday. I will check in tomorrow and see if there are any ideas. Monday I will move forward.

Thanks for trying on this guys and I will let you know how it turns out.
Time to close the store doors and go get ready for my date

Have a great rest of your weekend.

 

[NoelDP]

SuperAntiSpyware is failing to load at boot - could that be causing the problem? - try uninstalling it and using their removal tool (if they have one!)

The Afa Card Reader Service service failed to start because "The system cannot find the path specified" -which could mean a number of things, such as a missing file, or a missing registry entry... reinstalling the drivers may help.

There seem to be a number of controller errors on DR0 - it may be worth checking the drive connections, and running Seatools or the manufacturer's test utility over the HD.
The only other point of note is problems with AVG - I would uninstall it and run the removers over the system (including also ones for any previously-installed AV). Install MSE as a temporary/permanent replacement until the system is stable at least.


That's really about it - it 's not as bad as I was expecting it to be.

 

[ICIT2LOL]

Perhaps I missed something but a chksdsk with those switches /f /r came up nothing ??

Personally I would run this even if out of pure curiosity,
Download Kaspersky Rescue Disk 10

If I am out of line please someone say so.

 

[gregrocker]

If I was stationary I'd google the error to study results.

Will try to get to it later tonight when I get home.

 

[mohavepc]

Perhaps I missed something but a chksdsk with those switches /f /r came up nothing ??

Personally I would run this even if out of pure curiosity,
Download Kaspersky Rescue Disk 10

If I am out of line please someone say so.

Not out of line at all
I did indeed run KRD and AVG Rescue, both came up clean. I will try the other suggestions real quick and see what gives. Thank you