Damned IExplore.exe virus

[jae]

For some reason I can't get rid of this iexplore.exe virus on my Aunt's computer. Its the one with the invisible ads. Every 5-10mins two iexplore.exe process will start. The parent is an legit svchost.exe. Ofcourse if you kill iexplore.exe and try to delete it, it just reappears. This all happened after she got the Windows Recovery virus.

I have her running Avira now, she was running MSE before. Nothing will get rid of this iexplore issue. It even starts up in safe mode! I've tried Avira, MBAM, ESet Online, SuperAntiSpyware, Spybot S&D, and some small tools from bleepingcomputer.

 

[airdata]

Have you tried resetting the browser ?

Try using an updated hosts file, and try running a scan with hitman pro ( surfright.nl ).

 

[Zargon]

system restore?

I've been cleaning the fakesysdef virus alot and I've had to use kaperskys boot disc to get it clean enough to do system restore

 

[jae]

I had tried resetting IE8 and reinstalling it yesterday night, which didnt work.

After finding out the virus was called Whistle Blower, I found a tool by kaspersky that 'cured' it 15-20 mins after I made this thread; tdss.exe I think it was called.

Volsnap.sys was infected. Avira claimed it repaired this file yesterday.. but it lied! Lol

Sent from my PC36100 using Tapatalk

 

[chemwiz]

Combofix kills it pretty efficiently, too. But it doesn't run on a 64bit OS.

 

[LiuKangBakinPie]

Combofix kills it pretty efficiently, too. But it doesn't run on a 64bit OS.

yes it does.

op have you removed the malware? If not please run hijack this and post the logfile

 

[chemwiz]

Glad you mentioned that, I see it's made for Vista and Win 7 64bit now. Thanks LiuKangBakinPie!

 

[LiuKangBakinPie]

Glad you mentioned that, I see it's made for Vista and Win 7 64bit now. Thanks LiuKangBakinPie!

no problem mate. Thought the same thing couple of months back until I got told the same lol.

But remember to patch up the exploits first before running a scanner. Otherwise the open door is still there

 

[LiuKangBakinPie]

Or just download sandboxie and let her run her browser in that and remove her admin privileges

 

[LiuKangBakinPie]

I had tried resetting IE8 and reinstalling it yesterday night, which didnt work.

After finding out the virus was called Whistle Blower, I found a tool by kaspersky that 'cured' it 15-20 mins after I made this thread; tdss.exe I think it was called.

Volsnap.sys was infected. Avira claimed it repaired this file yesterday.. but it lied! Lol

Sent from my PC36100 using Tapatalk

no it didn't lie. That utilities remove rootkits. But it doesn't remove infections thats hiding in the system restore.
Did you manage to remove it? If not run hijack this and post the log so I can have a look at it