Member Avatar for jabberwocky

IE is launching 2 windows for me, every time i startup and now and then with no
particular frequency...it tries to launch a URL (same in both windows) in the form of an I.P. but always "Page Not Found" or "HTTP 404" (or something similar). I've read a previous thread belonging to someone whose IE launched on startup, followed the instructions u gave him (Run Hijackthis) but I could not find the problem lines he had in my log.
Any ideas?

p.s. My default browser is firefox - don't know if it's of any relevance. I've also tried finding suspicious keys in my registry but no luck yet.

  • 3 Contributors
  • 3 Replies
  • 202 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by jabberwocky

Dani AI

Generated

Symptom profile fits a small start‑up/homepage hijack or a resident process that spawns Internet Explorer directly (so Firefox being the default is not a blocker). was right to suggest anti‑spyware checks and was right to ask for a diagnostic log — the HijackThis output confirms both unusual autorun entries and altered network settings, which narrows the investigation to two tracks: (A) a startup/toolbar trojan that launches IE, and (B) network/DNS redirection that forces IE to open a specific IP.

Suggested containment and triage (in order):

  • Isolate the machine from the network to stop callbacks.
  • Run a full, up‑to‑date antivirus + a reputable anti‑malware scanner from Safe Mode; if those can’t clean, use an offline rescue scanner or bootable rescue image.
  • Capture what actually spawns IE by using a process/tree viewer and an autorun inspector from a clean admin environment; those will show the full command line and parent process, which is the key to identifying the culprit.
  • Repair common network meddling: check proxy settings and the hosts file, restore DNS to obtain automatically (or to known-good ISP DNS), and reset the network stack.

Quick useful commands (run from an elevated prompt):

ipconfig /flushdns
netsh winsock reset
netsh int ip reset

Deeper checks and cautions:

  • Inspect scheduled tasks, Run/RunOnce keys and services for unfamiliar entries; benign names can be faked so verify file locations and digital signatures before deleting.
  • Use Autoruns (Sysinternals) to disable suspicious startup entries and then reboot to test impact; do not delete files until there is a confirmed backup or image.
  • If a rootkit is suspected (scanners fail, processes hide), prefer an offline rescue environment or professional recovery — a repair install or reimage is often cleaner and faster than chasing persistent rootkits.

After cleanup, update OS and apps, change important passwords from a clean device, and keep regular backups.

Recommended Answers

All 3 Replies

Member Avatar for pcschrottie

It's probably a startpage-trojan. Do the usual thing -> run Adaware & Spybot, also do a complete check with an up to date antivirus software.
Check your startup folder: Start->run->msconfig->startup->uncheck unnecessary entries. If some of them are unknown to you, use google.


Michael

Member Avatar for caperjack

IE is launching 2 windows for me, every time i startup and now and then with no
particular frequency...it tries to launch a URL (same in both windows) in the form of an I.P. but always "Page Not Found" or "HTTP 404" (or something similar). I've read a previous thread belonging to someone whose IE launched on startup, followed the instructions u gave him (Run Hijackthis) but I could not find the problem lines he had in my log.
Any ideas?

p.s. My default browser is firefox - don't know if it's of any relevance. I've also tried finding suspicious keys in my registry but no luck yet.

post a hijackthis log in this thread .maybe

Member Avatar for jabberwocky

Logfile of HijackThis v1.99.1
Scan saved at 19:42:41, on 17/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\TPWRTRAY.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\msdos.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\msdos32.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\RAMASST.exe
C:\ScanPanel\ScnPanel.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Main User\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - Default URLSearchHook is missing
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\PDF Converter\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\PDF Converter\SCPDF\ExploreExtPDF.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PmProxy] C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [winlogin.exe] C:\WINDOWS\paintlog.exe
O4 - HKLM\..\Run: [Adobe] C:\WINDOWS\msdos.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [taskmgr.exe] C:\WINDOWS\msdos32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: ScanPanel.lnk = C:\ScanPanel\ScnPanel.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O15 - Trusted Zone: www.yeak.net
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) -
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{64F99983-0904-4279-8722-46095CA12E6B}: NameServer =
O20 - Winlogon Notify: FolderGuard - C:\PROGRA~1\FOLDER~2\FGuard32.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.