1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Ie7 keeps opening pages by itself

Discussion in 'Malware and Virus Removal Archive' started by mazaprin, 2010/06/02.

Page 2 of 3
  1. 2010/06/05
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    I ran HJT again and removed these two entries. Turned OFF System Restore ( rarely use it, I set it to only 1% of HD capacity), I prefer to use Acronis True Image and I do a full system Image backup to an External HD every week, I don't believe in internal HD backups nor incremental ones).

    By the way, I have Spybot (no Tea Timer nor active protection just for manual updates and scans so it does not interfere with Norton Security Suite), SuperantiSpyware and Malwarebytes (only manual updates & scans) and SpywareBlaster (pasive protection)

    I still don't know if all these tests and scans fixed the problem, I did not find any malware or Troyan (Norton blocked the bab(1)htm on june 1 but I doubt it had anything to do with the IE issue since I have this problem since beginning of May) bad enough to create this IE issue. My computer may seem clean but I will have to wait a couple days and browse within AOL going to webpages to see if something triggers IE to open and refresh the same page all over again with multiple blank pages (in tabs) but I can terminate that chain reaction by rapidly opening the task manager and terminate AOL and then go to proccesses and terminate "iexplore.exe" and since this happens inside the AOL browser (I don't recall it happening while navigating directly on IE) when I close AOL and kill the iexplore.exe it terminates it and then I open AOL again and continue browsing.

    I have considered upgrading to IE8 but... I have read on other Forums about people having this very same issue with IE8 and even with Firefox and IE8 has still some bugs to be taken care of acording to what I have read online so many people say IE7 is still better than IE8 for now.... othe rpeople said that by upgrading to IE8 they resolved this issue but I don't have any guarantees that it will solve mine and if not I don't know if it will be possible for me to uninstall IE8 and go back to IE7 (I have to research this).
    I will kep you posted in the next couple of days as to whether this issue have been fixed or not but thanks a lot anyway for all your help.
     
    mazaprin,
    #21
  2. 2010/06/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very well :)
    I'll mark this thread as resolved and you let me know, if any new issues arise.
     
    broni,
    #22


  3. to hide this advert.

  4. 2010/06/05
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    Hi, the issue has not been resolved. I just browsed in AOL some article and upon closing the page IE opened again and started to open pages one after another. I don't know what is causing this, if it is asome virus or Trojan none of the antivirus and antimalwares have detected it yet. It could be some new virus that we don't know about yet.

    I just installed ThreatFire (4.7) upon reading Email from PC World recommending it (I had it couple years ago but uninstalled it). Maybe Threatfire can track any suspicious movement by an invader or one that is already hiding in my system. But for now I am still with the issue.
     
    mazaprin,
    #23
  5. 2010/06/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Well, no worries, we'll check further.

    First, update MBAM, run fresh scan and post its log.

    If you still have GMER file, delete it and...

    Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
    Alternative downloads:
    - http://majorgeeks.com/GMER_d5198.html
    - http://www.softpedia.com/get/Interne...ers/GMER.shtml
    Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
    Do NOT use the computer while GMER is running!
    When scan is completed, click Save button, and save the results as gmer.log
    Warning ! Please, do not select the "Show all" checkbox during the scan.
    Post the log.

    IMPORTANT! If for some reason GMER refuses to run, try again.
    If it still fails, try to UN-check "Devices" in right pane.
    If still no joy, try to run it from Safe Mode.
     
    broni,
    #24
  6. 2010/06/06
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    Hi, I ran into the same problem with GMER (even with "Devices" UN-checked), after running for 2.5 hours (after scaning SSDT and AIT/EAT) with ThreatFire and Norton Antivirus disabled (so they could not interfere) something made the computer to REBOOT and the scan would not finish. Tried again in SAFE MODE and the same happened after aprox. 1 hour into the scan. I am presently running a fresh scan with Malwarebytes and I will post results here.
     
    mazaprin,
    #25
  7. 2010/06/06
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    When you're done with MBAM, retry GMER in safe mode, but this time with only "Sections" checked.
     
    broni,
    #26
  8. 2010/06/06
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    Here is a fresh MBAM Log from today. I will try GMER in Safe Mode with "sections" only tonight and post it later.

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4172

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 7.0.5730.11

    6/6/2010 3:28:56 PM
    mbam-log-2010-06-06 (15-28-56).txt

    Scan type: Full scan (C:\|D:\|)
    Objects scanned: 253409
    Time elapsed: 1 hour(s), 24 minute(s), 32 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    mazaprin,
    #27
  9. 2010/06/06
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok :)
     
    broni,
    #28
  10. 2010/06/07
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    Hi, I tried to run GMER ( "Sections" only) in Safe Mode and it only scanned for 1 minute and then stopped and only showed two entries. This is a very nasty tester every time I use it when it finished and I close the program my PC freezes and I have to reboot manually (with the PC button) and then press F8 and choose "Most Recent Good Configuration That Worked" and boot from there (just in case). After this I will post the same scan of "Sections" only but in normal mode (from desktop). Here is the Log from Safe Mode:

    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-06-07 11:48:20
    Windows 5.1.2600 Service Pack 3
    Running: v566e8lm.exe; Driver: C:\DOCUME~1\HERIBE~1\LOCALS~1\Temp\fwtdqpog.sys


    ---- Kernel code sections - GMER 1.0.15 ----

    ? SYMDS.SYS The system cannot find the file specified. !
    ? SYMEFA.SYS The system cannot find the file specified. !

    ---- EOF - GMER 1.0.15 ----
     
    mazaprin,
    #29
  11. 2010/06/07
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    I tried to post the GMER log done from desktop ( "Sections" only) and it seems it is too long because I got this message from the Forum:

    The text that you have entered is too long (887298 characters). Please shorten it to 55000 characters long.

    Is there some way that I can attach this Log so you can open it elsewhere?
     
    mazaprin,
    #30
  12. 2010/06/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    broni,
    #31
  13. 2010/06/08
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    mazaprin,
    #32
  14. 2010/06/08
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Looks fine :)

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #33
  15. 2010/06/08
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    No offense at all intended Broni and i appreciate everything that you have done to help me but it seems we are repeating everything again, the same tests all over and I doubt we will find anything new with them. Can we try something else?
     
    mazaprin,
    #34
  16. 2010/06/08
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    We're repeating all steps, because I need to check, if your computer didn't get reinfected.
    There is no other way, but re-check.
     
    broni,
    #35
  17. 2010/06/08
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    OK, I understand but give me 2 or 3 days because I need to check if the issue was solved or not (so we don't waste our time repeating all) because this morning I browsed with AOL and checked the news articles, entertainment, etc and nothing happened with IE so I want to make sure that the issue was fixed or not by browsing during a couple days to see what happens and if the issue is still there I will download the combofix again.
     
    mazaprin,
    #36
  18. 2010/06/08
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No problem as long, as you promise, you'll let me know...hehehe
     
    broni,
    #37
  19. 2010/06/08
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    The reason I ask for a couple days is that yesterday I received (it popped up when I closed AOL) some software update from AOL and it installed automatically and today I browsed with AOL and had no issues with IE so...
    I don't know if that AOL update fixed some bug on their browser (which also uses IE within it) that triggered IE to start refreshing or opening pages.

    Maybe AOL realized the problem due to complaints from customers and fixed it, I really don't know and that's why I need a couple days to keep browsing to try to re-create the issue to make sure it is fixed or not. If I don't have any more issues with IE since today then we can assume that it was an AOL issue and the AOL update fixed it.
     
    mazaprin,
    #38
  20. 2010/06/08
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Sounds like a plan.
    Just let me know and thanks for the update :)
     
    broni,
    #39
  21. 2010/06/11
    mazaprin

    mazaprin Inactive Thread Starter

    Joined:
    2003/11/14
    Messages:
    99
    Likes Received:
    0
    Hi Broni, I am pleased to inform you that I have tried to re-create the IE issue by agressively browsing in AOL and all seems normal again since the AOL software update 2 days ago.

    All of our tests and scans with different tools did not find any infection or malware bad enough to have created that issue and despite that my PC was clean in all aspects and I have triple defenses like SpywareBlaster, Spybot, SuperAntispyware and Malwarebytes (all of them used pasively) along with Norton Security Suite and if it not were for that AOL update to fix some bug on their browser that somehow triggered IE to start opening infinite pages, we might have never found the culprit.

    All these people that say they are having the same issue with their Firefox and IE8 I believe they also had AOL browser as the culprit and if not, then it must have been some update for these browsers gone bad but the point here is that the issue was NOT caused by any Virus,Trojans or Malwares.

    Since the AOL software updates come automatically every now and then (or when there is some breakdown or malfunctions on their browser), maybe all these people that are having the same issue may have received the AOL update recently that fixed their problem.

    I will post a link of this post in the other forums where they are listing this same problem for them to be aware of this solution.

    I thank you very much all your help and expertise and appreciate your patience. Thanks !! :)
     
    mazaprin,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...