Expert: Brian Benosky - 7/8/2010

Question
Morning Brian-

Thought we were on to something here. Esetsmart picked up four bugs
such as adware adon, Java trojan downloader, autrorunspy ambler, etc
and eradicated them. However, it did not pick up the iexplore trojan. I still get pop-ups, volume gets turned off and the ixplore(and explorer.exe)shows up 3 times in my task manager even when NO programs are open.

From the little I've read, the explorer file is supposed to show up only in the program files location. When I do a search, mine shows up in a folder as Cdrive and then a long series of letters and numbers.

As an aside, when I reboot my computer the black "safe screen" still shows up momentarily before continuing.

Hoping that we're not beaten yet.

Steve F.

By the way, where on the Island are you?

Answer
Hi Steve

I'm in Suffolk(Yaphank), you?

You are definitely infected with the Worm, and it's a smart little bugger.  Keeps springing back to life on reboots and manages to evade eradication.  You have avast installed, so let's use it's best feature...the boot scan.  Basically, it scans the system files BEFORE they get loaded.  To set it to do that, right click the avast icon, select start avast Antivirus, open Menu, and choose 'Schedule boot-time scan'.
The black screen you see is the XP/Windows Recovery Console choice screen put there by ComboFix.  It should flash up there for 2 seconds.  It's put there in case system files become corrupted.  You can choose to boot into it to run a repair of Windows.
Finally, if you wish, I can be reached at numbersix6@yahoo.com.  When cleanups go on, instead of using AllExperts, I find it easier and quicker to use direct email.  Up to you, as I will answer one way the other.

Brian