IEXPLORE.EXE virus Manual Removal

This is actually an old infection and this can be easily killed so I ignored sharing this one before.  However, some units here in our office has been again infected by this virus that is why I have to manually kill those again as our antivirus seems to not recognize this one.

What is IEXPLORE.EXE?

This is actually the executable filename of Microsoft Internet Explorer.  But since some virus propagator decides to be a little naughty, they named the process the same name.  If I am creating a virus, I might name a virus with a certain Microsoft processes as well so it can fool a lot of people thinking it is legal.

Since this virus has the same processes’ name with that of Internet Explorer, how will we know if what you are seeing in the Task Manager is the virus or the real Internet Explorer?  Simple, if there is no open Internet Explorer, then it is a virus.  If there is an open Internet Explorer, close it. After closing Internet Explorer and there still is an instance of IEXPLORE.EXE, then that is a virus.

What does this virus do?



Like with most of the viruses, it eats a lot of resources which will slow down your unit.  Once free resources is very low, you will have problem accessing anything.  Some signs of a very low free resources is inability to display properly UI of anything in your computer (missing section of title bar, forms became transparent in some section),  inability to connect to shared folders in the network, etc.

Understanding further this virus:

a.  It creates an autorun.inf file in root directory with these instructions:

[AutoRun]
open=backupuser.exe
shellexecute=backupuser.exe
shell\Auto\command=backupuser.exe

Note:  To view everything, go to Folder Options and select “Show hidden files and folders” and untick  “hide protected operating system files“, and also untick “Hide extensions for known types“.

In the root of the drive, you will see a hidden exe with an icon of a standard folder named backupuser.exe.  If you will not untick “hide extensions” as mentioned above, you will be fooled into thinking that that exe is a folder and of course double-clicking it will result to further infections.

b.  It lodges itself among the services (click Start button, Run, type MSConfig, Enter, and go to Services Tab) bearing the name Windows_XP (clever huh?).

c.  The actual service can be seen via services (click Start, Run, type Services.msc, Enter) and if you double-click it, it will point you to the other file portions inside \Program Files\Common Files\Microsoft Shared\MSInfo:

d.  In the current processes (right-click taskbar, Task Manager, Processes Tab), it hides under the name IEXPLORE.EXE (as mentioned above).

e.  In registry, it creates the necessary entry for services to be loaded:

Is manually killing this virus hard? 

No!  That is why I never thought of including this in the previous manual virus removal tutorials.  You can actually remove this without any 3rd party tool.  Here we go:

Steps on manually removing IEXPLORE.EXE virus:

a.  Open Task Manager, go to Processes tab  and look for IEXPLORE.EXE then right-click, End Process Tree.

b.  Make adjustments to Folder Options as explained above.  Go to root drive and delete autorun.inf and backupuser.exe.  Navigate to the folder shown in the image and delete the files I have circled below:

Note: another virus uses this location to hide.  If you see a Recycled.scr entry as well, delete it.

c.  Remove the entry in Registry (as shown before) via Regedit.

And that is it!  Happy hunting!