TechSpot

Firefox tab pops

By hyperdrive
Jun 12, 2008
  1. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    i've successfully reinstalled norton. internet phising protection seems to be working fine.

    Application.NirCmd is still detected by spywaredoctor.
    i was wondering if deleting the detected files would solve this, i won't do it yet unless instructed.

    what about the windows update files, is it ok to update now or wait?
     
  2. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    another thing i noticed after all the procedures we've done is that auto-run doesn't work anymore. when i insert a cd or dvd, and connect my external HDD there's no autorun anymore
     
  3. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    Good, I thought that would work

    What files is it detecting, can you show me the log. Or copy and paste what exactly it is finding.

    Go ahead and update as soon as possible. These may include some security updates that you have not been receiving because of the infection.


    We can try to change some settings in the registry, but before doing that it is a good idea to backup the registry. So please do these instructions in order, reboot then test the autorun.


    Backup your regsitry
    First, we need to backup your registry:
    Please go to Start > Run
    Paste in the following line:
    • regedit /e c:\registrybackup.reg
    Click OK.
    It won't appear to be doing anything, that's normal.
    Your mouse pointer may turn to an hour glass for a minute.
    Please continue when it no longer has the hour glass.


    Making a .reg file
    Open notepad and copy and paste the text in the quotebox below in it:

    Code:
    [b]REGEDIT4
    
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
    “AutoRun”=dword:0000001
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    “allocatecdroms”=”0″
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    “NoDriveTypeAutoRun”=dword:00000091[/b]
    Name the file as Fix.reg

    Change the "Save As" type to "All Files" and save it on the desktop.

    It should look like this: [​IMG]

    Double-click on it and when it asks you if you want to merge the contents to the registry, click yes/ok.
     
  4. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    i attached a file enumerating what the spyware doctor detects.

    the reg solution seemed to not work. autoplay still doesnt function when i insert a new cd and connect my external HDD
     
  5. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    im having new problems with my mouse pointer in firefox. this problem doesn't occur in IE.

    the mouse pointer returns back to the previous point when i move the mouse. it sort of snaps back in place when i move the mouse. i use the laptop's touchpad and also a usb mouse. the problem is the same so its not hardware related.

    also, in the menu dropdowns the selection moves by itself.

    it also doesn't occur everytime, sometimes i chance upon good functionality like now. when it acts up i just close firefox.

    this problem appeared after the windows update i was talking about.
     
  6. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    Let spyware doctor fix those as we uninstalled combofix already, it was a false positive.

    ----------------------------
    Enable CD-ROM autoplay

    # Open Windows Explorer by pressing the Windows + "e" key.

    # Right-click the desired CD-ROM and select Properties from the menu.

    # Select the AutoPlay tab.

    # Select each item from the pulldown list and for the Action to perform

    -----------------------------

    Enable autorun for other media types

    Start -> Run -> type regedit

    Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    "NoDriveTypeAutoRun"


    What is the value of "NoDriveTypeAutoRun"

    In hex it should appear 95 0 0 0
     
  7. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    it's 91 0 0 0 instead of 95

    i modified it
     
  8. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    95 is the default - disabled

    91 is enabled, I just wanted to see if the reg file worked properly. Please leave it as 91

    ---------------------------------------------------

    Select each device from windows explorer and select properties, there should be an auto play tab.
     
  9. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    i've tried it with the cd drive and the external HDD. it's still not working. i changed it back to 91.
     
  10. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    I am going to ask somebody else to have a look at the autoplay and firefox issues, but I will still be here.
     
  11. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    i've fixed the autoplay problem! yay! i used the autofix tool from microsoft. =D

    as for the firefox problem, another symptom appeared. when i login to gmail, the site refreshes without stop even before it reaches gmail.
     
     
  12. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

  13. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    well, the good news is on the firefox that the new version comes out this week so you will be uninstalling -reinstalling anyways. The other thing is to uninstall the update or check for more updates (kimsland can tell you how to find and delete the previous update)

    I am just going to list all your problems on this page:

     
  14. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    what updates? the ones from windows?
     
  15. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    yes just the most recent one that seems to be causing problems. but I would do this as a last resort
     
  16. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    i seem to be having no problems again with firefox. ill keep watch
     
  17. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    did you uninstall that update
     
  18. hyperdrive

    hyperdrive TS Rookie Topic Starter Posts: 37

    nope, i did not.

    the update contained numerous items, ie7 security updates, microsoft updates etc.

    i don't know which to uninstall if i were to do it.

    i did delete the application.nircmd in spyware doc though, and fixed the autoplay problems. might it have a connection with fixing the firefox problem?
     
  19. Blind Dragon

    Blind Dragon TS Evangelist Posts: 4,048

    possibly, I think there was a conflict somewhere with your security and combofix
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.