Unknown malware injecting into browsers

Learn about Computer Security Virus/Malware Removal Assistance
1

I’m having a problem that may be related to Comodo.

I installed Comodo two weeks ago, and it’s awesome. But, I started noticing that I have a problem on my computer. I’m constantly being notified that an unknown program (with random numbers and letters in the name) “has modified the memory of iexplorer.exe in memory” (and does the same thing to Firefox too… it depends on which browser I’m using). Comodo tells me that this is likely a virus or worm or spyware.

So, I went to Housecall to do an online scan, which I usually do every few weeks. I ran the scan and… suddenly about 20 minutes into the scan, IExplorer just closed down with no messages of any sort. I looked at the Firewall (which I hadn’t exited before running the scan), and it had about a dozen messages about blocking an attacker that had tried to scan ports.

Okay, so I shut down the firewall (cmdagent.exe was still running, because I can’t figure out how to shut that down), and ran the scan again. Again, IExplorer simply vanished about 20 minutes into the scan. I tried Firefox. Instead of just shutting down, Firefox crashed, also about 20 minutes into the scan.

I guess the firewall is preventing Housecall from running. Or maybe it’s not the firewall’s fault and the virus is doing this. I don’t know. I just know that I ran Housecall about a week before installing Comodo, and it ran just fine.

I really need to be able to run Housecall. Is there a way to completely disable Comodo for a while, without uninstalling it? I looked all over but I can’t figure it out. It even runs when I’m in Safe Mode.

2

Unless I’m missing something, this should be easy:
right mouse click on CPF on the task bar, click on Adjust Security Level, and select Allow all

3

I tried it. It’s still shutting down in the middle of the scan. :frowning:

I ran other scanners (Bit Defender, etc.) and they picked up several viruses/malware, but I’m still having the original “modified memory” problem, so I guess there is something else.

4

I don’t think it’s the firewall that’s causing the problem… If it were, Allow All would rectify that, as it causes the firewall to be bypassed or ignored during the time the Security Level is set that way. And as you say, there’s some pretty clear indications that you have been infected with one nasty or another…

We have a board here within the forum, where you can post for help in identifying and removing malware. I am moving your post there as it seems more applicable.

LM

PS: Be sure to read this post
https://forums.comodo.com/virusmalware_removal_assistance/required_information-t4866.0.html
for information to be included here (to help identify the problem).