Explorer.exe causes Iexplore to open multiple instances and high mem

Hello my friends:

I am working on an Acer all in one touch that had a minor malware infection that is now clean.

Websearch was found and cleaned by malwarebytes.

I have scanned with the following and found no issues. Malwarebytes, eset standalone scanner, Superantispyware tech edition stand alone, ADW, TFC, Mbar root kit detector, Kaspersky rescue dvd, AVG Rescue DVD.

What happens is this.
When booted up and using a clean boot no less the pc runs for a few minutes then something invokes Iexplore. then another and another I have seen a max of 7 running and one will be at max memory use.

If I kill Iexplore another opens. if I kill explorer.exe first THEN kill iexplore (all of them) windows levels off and runs normally except I have no desktop or menus.

I have tried sfc /scannow and it fixed a few things on 3 runs but no change in IE behavior.
I have run 3 scandisks no errors no repair no change in IE
I tried to do a repair install and it tells me it cannot set up the machine to restart and exits.

This is an Acer 23" touch all in one with i5 and 4gb memory. I am currently backing up data and settings.
Please let me know what tool you would like run and I will do so Sat before I Give up on Monday and wipe the damn thing out.

Thanks

Check the Scheduled Tasks - I've seen malware sitting in there that MBAM has missed

gregrocker said:

Did you reset IE? Try uninstalling and reinstalling in Features

Which version of IE? Check Updates for newer version which might resolve it. Also all Updates installed since one may be a fix.

Otherwise it sounds like deep corruption which might be remedied by Repair Install if SFC can't handle it. It sounds like you cleaned it up thoroughly but search the infection to see if special tools are indicated. Often a wipe is best due to lingering corruption creep.

I did a removal of Iexplore and now have a different issue. I actually had to rename the 64bit version of iexplore exe using Linux. I was hoping I would get an error that would show mw what or why explorer.exe was calling Iexplore.exe.

Well I no longer have iexplore.exe eating up memory. there are now 3 instances or Explorer.exe and one is using up all available ram. There is something infecting this machine I am sure of it.

It is no longer a need to fix but more of a need to know what I am dealing with. I cannot repair install as it cant set up to reboot and fails to move past the primary gathering. I have backed up all the data and will wipe it out Monday if that's the last recourse. I would like to figure out whats doing this.

...and Scheduled Tasks??

NoelDP said:

Check the Scheduled Tasks - I've seen malware sitting in there that MBAM has missed

I think I am getting closer. Upon opening scheduled tasks I get an error of "The Remote Computer Was Not Found" I am assuming it was not found because in clean startup there is no networking running.

However in clean boot I cant read the data to see what tasks are scheduled. I will keep trying however and let you know.

Thanks for the ideas

Do you have 7-Zip installed?

I did have 7-Zip do something very similar to one of my computer.
Everything would start pulsating about every sec. and then I would have a huge amount of browsers open.
Only shutting down and boot again would stop the action.

Mine would only do this when I uploaded or downloaded a zip file.

gregrocker said:

What exactly is the reboot problem you think prohibits a Repair Install? Have you tried running one? Error?

Have you run SFC, if necessary from disk CMD?

I have indeed run SFC with no issues coming up and when I run an inplace upgrade it tells me it cannot prepare the system to reboot into the next phase.

The exact error is as follows. after completing the gathering phase a window pops up and says

"Windows could not prepare the computer to boot into the next phase of Installation. to install windows, restart the installation."