TechSpot

IE popups in Firefox

By ThatClownKid
Aug 17, 2008
  1. I know that they're have been numerous threads on this, but every time something is different.... so here goes....

    I use Firefox, and I have been getting pop ups with IE, even though I never use it. I'm pretty sure it's a trojan or malware. So I downloaded Hijackthis and did a system scan (see attached file). Please help, it is really annoying!

    I tried Norton.... bleh! All it did was slow my computer down more!

    Any help would be greatly appreciated, and take it easy on me, this is my first thread!

    Thanks and Peace
     

    Attached Files:

  2. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Norton - known for slowing down systems

    Did you already try fixing this yourself - it appears you may have removed some items already with Hijackthis?

    Follow these Viruses/Spyware/Malware, preliminary removal instructions and post back in this thread with the requested logs. There should be at least 3.

    1)MBAM log
    2)SAS log
    3)Hijackthis log (last step)
     
  3. raybay

    raybay TS Evangelist Posts: 7,241   +9

    Most likely, it is because you use Windows Messenger.
    Uninstall Firefox. Reboot. Defrag. Then reinstall Firefox. Firefox 2.0.0.16 is more bulletproof for this problem than is Firefox 3.0, as well.
    Then remove Windows Messenger with Add and Remove. Reboot and defrag, then reinstall Windows Messenger.
     
  4. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    What is SAS? And I ran the MBAM and found 10 problems (which I deleted). Then the pop ups reduced a lot but I still got the odd one. I'll attach the MBAM log.

    Thanks, and please keep replying! You guys on these (and other) boards seem really helpful!
     

    Attached Files:

  5. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    Oops SAS, is SuperAntiSpyware, my bad. I'll post the logs shortly.
     
  6. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    Okay, sorry for the delay... here are the logs.
     

    Attached Files:

  7. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    Ok, I know that I have been replying a lot, but they have been brief. SO I'll give a more detailed explanation of what's going on...

    I ran the two programs. The first one ,MBAM, said I had 10 errors and cleared them. After about an hour, popups came back, but not in full force.

    I ran the second one, SAS, and it said I had 120! It cleared them out too. Now the pop ups have dramatically decreased, but I'm still getting them. I read another thread on these forums from a little while ago (called IE popups from Firefox!), and the guy sounded like he had the same problems as me (except his sounded worse, for instance, my computer still runs fairly well).

    So finally, I uploaded the SAS and latest Hijackthis text files (it wouldn't let me upload the MBAM one again). Any help would be appreciated.

    Thanks
     
  8. SpiritWind

    SpiritWind TS Rookie Posts: 164

  9. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    I see you posted a couple of minutes ago, and I just logged on to check, so I'll try to catch you while your still online!...

    I will download Avast, but as I posted earlier, Norton only made my computer WORSE. I'll try Avast though.....
     
  10. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    I ran avast and sygate, but now Avast gives me pop ups saying "A virus has been found". I delete it, and they keep coming back! They download to WINDOWS or Temp or sytem32. Is anyone out there still?
     
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    It is interesting to see that the list of Tracking Cookies is several times longer that our entire HijackThis log!

    Are you posting the entire log?
    Have SuperAntiSpyware remove ALL of those Tracking cookies.

    Please explain or attach image of just what this is:
    Run all the program again according to Blind Dragon's directions:
     
  12. raybay

    raybay TS Evangelist Posts: 7,241   +9

    I would change to avir Antivir...
    As soon as you run the scan and delete, press the off button.
    Then restart in SAFE MODE (pressing <F8 repeatedly as soon as you press the on button> and run again. While in SAFE MODE, run SuperAntiSpyware as well as MBAM.
    You likely have an infestation that hides in memory or an image file or a animation.
    Then run the logs.
     
  13. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    Thanks for replying back guys, I thought I was all alone out here!

    Anyways, I did all the scans again, in safe mode, here they are....

    So far my computer has been good, but I am not celebrating yet! Do you see anything out of place?

    Thanks
     
  14. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    Oh and Bobbye, I don't get pop ups anymore, I think sygate stuffs those attempts. Then I just got all these different .exe files downloaded to my temp, Windows, and system32 folders, where they were immediately picked up by avast. They always had different names, and no matter how many I deleted a new one would show up.

    That was before the logs I ran a few hours ago though, and I am crossing my fingers hoping that everything is still okay in the morning.

    Thanks.
     
  15. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Additional information on the Windows Messenger: This is a legitimate process to be used by the Administrator of a network to communicate with the other systems on the network. However, it's format is used unethically, employing social networking, to 'fool' a user into doing something.

    To shut this down: Control Panel> Administrative Tools> Services> scroll down to Messenger Service> right click> Properties> change Start mode to Disabled> Stop the Service> Apply> OK.

    The follow with this: Right click on Start> Explore> Programs> Right click on Messenger> Rename> add 'old' to the end, like this messengerold.

    mbam cleaned the infected Registry entry. SuperAntispyware is clean and the HijackThis log looks good and clean an nice and lean!

    Blind Dragon will let you know if there is anymore to be done.

    Let us know if the problem recurs.
     
  16. ThatClownKid

    ThatClownKid TS Rookie Topic Starter

    Bobbye thanks so much, computer is running like a charm! :)

    Everyone else who posted, thank you too!

    :wave:
     
  17. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Since Blind Dragon hasn't reviewed your logs, technically, you're not in the clear, If the problem appears again, you should run the programs, post the new logs and have them checked. All I did was give you another path to turn off the Messenger which will prevent it from displaying in the future. That did not remove anything on your system.

    Your HijackThis log looked more like an abbreviated version than a full one. I don't usually get a chance to tell someone they don't look like they have enough running, but if I did, you would be one of them!
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...