Over the past two days my computer has been acting extremely strange. Yesterday night, Mozilla Firebird refused to allow me to view any website except Google. I was also able to get to image search, groups, etc. and everything else linked to on the main page with the exception of news. I couldn’t get anything by typing in a URL, and in IE I couldn’t get anything at all. I did a virus scan, and I ran AdAware and Spybot S&D, but found nothing. Today I haven’t had any problems, until about 9:30, when I wasn’t able to get anything in Mozilla or IE. I ran AdAware etc. and found nothing, but then IE spontaneously opened a window with an ad for a security and antivirus program. A few minutes later it opened another window, but didn’t load anything. I restarted the computer and I was able to access the internet again. I’m sure it isn’t a connection problem because I haven’t had any problems connecting with either of the other two computers sharing the connection, and yesterday’s strangeness with Google occurred even after clearing the cache. Any idea what’s happening or what I can do to fix it?
Sounds awfully like spy/ad-ware. You did update Spybot and Ad-aware before scanning, right?
It might be a winsock related problem…
A few things you can try: Another scanner (the last guy I talked to liked “Bazooka” scanner…) I prefer both Adware and Spybot myself, but I’ll sometimes visit PestPatrol’s online scanner. Their software costs $$$, but their scanner seems to catch a bit more, and it’ll show you what you’ve got for free, and even how to remove it manually. (I guess they count on the market sector that is unfamiliar with regedit.)
Anyhow: I’d also check if anything was inserted in the winsock chain. MS KB article 811259 shows you how to do this. In the section referring to msinfo32, if you see something other than the 10 entries listed there, figure out what software put that there, and uninstall it (if that’s an option), or find out how to specifically remove it.
Can you ping any other sites (by IP or by domain) when the problem happens?
Does mail (or IM, or newsreader, or whatever) work when IE and Firefox are down?
Does the problem happen for any other users on the system?
The IE windows opened spontaneously again. I haven’t had any connection problems so far today. One window has http://69.20.62.53/yyy4.html in the address bar, the other has http://www.pcpowerscan.com/index.html?2146 (the first one doesn’t display anything, but when I clicked on the link a second ago it closed the browser.) I’ll try the PestPatrol thing and check winsock later today if I have a chance.
I used the PestPatrol scanner and removed what I found, but there are still problems. I haven’t had any more connection issues, but IE keeps popping up targeted ads every two or three minutes. Any suggestions?
It also hijack IE. When I try to click a link it sometimes goes to an ad instead of what it is supposed to go to. Whenever it loads an ad, it goes to http://c.azjmp.com/az/ch.php?f=636&i=1918&sub=popup&pop=0&aux=&bypass= and then the ad appears.
At this point, there is no question that your browser has been hijacked. Think of it in human medical terms. You feel sick and so you go to your family doctor. He makes his examination and probably has a pretty good idea of the problem and may recommend a few more tests to be certain. One he is certain of his diagnosis, he sends you to a specialist for the specialized care you need.
That is where your computer is now. The diagnosis is certain; your browser has been hijacked. The specialist care is here:
http://forums.spywareinfo.com/index.php?showtopic=227
You will need to help the doctors fix the problem, so read and follow their instructions to get their help.