Which is the legitimate Internet Explorer?

[Nicola Attico]

Windows XP SP2

I found out that a process c:\windows\system32\shareddll\iexplore.exe
recursively creates a file autorun.inf on all my usb devices.......

Whicj process is it? Is it a legitimate process?

I believed that Internet Explorer was in c:\program files\internet
explorer\iexplore.exe

I posted my HJT log here, in case you want to take a look:

http://forums.techguy.org/malware-removal-hijackthis-logs/776697-infection-help-generic-atr-my.html

Thanks,

Nicola Attico

 

[Nicola Attico]

this is the correct path, sorry

c:\windows\system32\dllcache\iexplore.exe

 

[Gerry]

Nicola

The location of iexplore.exe coincides with what exists on my computer.
The copy at that location is a spare copy.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Nicola Attico]

I have a autorun entry of c:\windows\system32\dllcache\iexplore.exe in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run from company OTAN

Do you have anything similar

This process systematically writes an autorun.inf file on my usb
drives.....

But McAfee doesn't detect any abnormality......

What do you think?


Nicola

 

[Gerry]

Nicola

I have no entry referring to iexplore.exe to load when my computer
boots. I do not want Internet Explorer to load when my computer boots so
that suits me.

In Google OTAN get many responses. Too many really figure out it's
relevance. This one I wondered about:
http://www.otan.us/DistanceLearning/cdlpListServJoin.cfm

When you refer to an autorun entry are you referring to an item
displayed using the programme Autoruns?

One way forward would be to disable (not delete) the entry in Autoruns
and observe for effect.

You could also run something like Spybot S & D.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Nicola Attico]

Yep! Sysinternals Autoruns...

Nicola

I have no entry referring to iexplore.exe to load when my computer
boots. I do not want Internet Explorer to load when my computer boots so
that suits me.

In Google OTAN get many responses. Too many really figure out it's
relevance. This one I wondered about:http://www.otan.us/DistanceLearning/cdlpListServJoin.cfm

When you refer to an autorun entry are you referring to an item
displayed using the programme Autoruns?

One way forward would be to disable (not delete) the entry in Autoruns
and observe for effect.

You could also run something like Spybot S & D.

--

Hope  this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~



Nicola Atticowrote:





- Show quoted text -

 

[Nicola Attico]

What about c:\windows\system32\dllcache\iexplore.exe, is it the same
dimension that c:\program files\internet explorer\iexplore.exe ?

In my case the first is 2,112 KB and the second is 91 KB

Do you believe I can delete the file c:\windows\system32\dllcache
\iexplore.exe without any harm ?

Nicola

 

[Gerry]

Nicola

Do you have Internet Explorer version 6 or version 7?. Mine is version
7.

c:\windows\system32\dllcache\iexplore.exe
Version 7.0.6000.16735 635,848 (621 kb)

c:\program files\internet explorer\iexplore.exe
Version 7.0.6000.16735 635,848 (621 kb)

c:\windows\ServicePackFiles\i386\iexplore.exe
Version 6.0.2900.5512 93,184 (91 kb)

The copy in the dllcache does seem to be an odd size. What version is
it?

This McAfee note claims McAfee removes the Trojan
http://vil.nai.com/vil/content/v_141387.htm

However, you do need to turn off System Restore temporarily to remove
infected files the existing restore points.
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.aspx

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~