Multiple IE Processes

  • Thread starter Thread starter Bill
  • Start date Start date
B

Bill

I have WIN2K Pro with all the updates, and shortly after
boot, I can see in the processes tab that 'aupdated.exe'
runs, then 'netdc.exe or netda.exe' begins and shortly
after that, an instance of iexplore.exe is started, then
another, etc. until I may have 30 or 40 instances started
and begin getting virtual memory limit warnings. A file
search does not show aupdated.exe or wupdated.exe. Anyone
know what this is and how to fix it?
Using Norton A/V checking for live updates daily and
scanning computer daily.

Thanks for any help.
Bill
 
Make sure you are also current on all of your crticial updates from
Microsoft Update [never from an email attachment] and try a parasite site
scanner and removal tool such as SpyBot Search and Destroy which also has an
advanced mode/tools that can show system processess and startup programs
that can help troubleshoot.

Ty booting into safe mode with and without networking to see if the problem
persists or not. If the problem goes away then you probably do have an issue
with a startup program/service/driver. The link below explains more about
parasites and where to get SpyBot but be sure to also get the latest update
from their website. --- Steve

http://www.microsoft.com/security/protect/
http://www.mvps.org/winhelp2002/unwanted.htm
 
I saw the same thing on a W2K Pro machine today also. Multiple instances of
iexplorer.exe are created when netdc.exe or netda.exe are running in the
task manager. This virus or trojan is also spread by roaming profiles - I
replaced the computer with another W2K Pro computer, and logged in with a
roaming profile that was used on the infected machine and the same thing
happened on the new computer. McAfee's VirusScan 7.1 with the latest dat
did not netdc.exe or netda.exe as a known virus, and Spybot with the latest
update did not detect the file as spyware.

I'm not sure how the computer initially became infected, but the user did
have other spyware on their PC, as well as AIM. On the infected computers,
netdc.exe and netda.exe were both found in C:\winnt\system32. After
deleting the files manually from that directory, they reappeared upon
rebooting.
 
Back
Top