internet explorer..opens too many

hamaradam

I wonder whats up, when I go to open internet explorer, several of the home page come up, all ontop of eachother, I have had up to 22 just duplicating by itself then of course as so many are 'open' then the computer is too slow and stops. when I go to shut them (they are all blank) another little message comes up similar to can't find 'null' then if I click on that to close it after several of them, eventually the page I want to view (in the first place) is actually open by now but is underneath all of these...then whenI click on a link it does all this behaviour again...

NB I just had a new (2nd hand) CPU, tower, hard drive, mother board, graphics card put in.... so teething problems, just that I'd like to be able to use t'internet before next week when the man comes to check up on it....

cyberbob

Not too upto date with windows but my first thought would be that you have some sort of malware on the pc. So i would run a spyare program like spybot. As I said i've not run windows for years so others should be able tp point you in the direction of good spyware removers

savermonkey

Depending on your version you can have more than one home plage automatically open when you start internet explorer, this is set in the homepage settings:

Control Panel --> Internet Options --> General.
Look whats in the 'home page' section.

bluboy

You don't say what version of Windows or IE you're using (no one ever does:mad:).
As above (savermonkey)... or -
If you manage to close all instances of IE try opening a web page by typing it's address (e.g. www.google.com) into the 'Run' box (Start > Run...) for XP, or into the ' Search' box if Vista. This should hopefully open one instance of IE and ignore a stored (possibly dodgy) previous session .

hamaradam

Just a quick reply,thanks to the replies, I have done spybot, it found 3 trojans and something else - all of which I think I have removed...using the prompts...however I intend to come back to this and look at other recommendations, thanks for your time! just that I have to dash out unexpectedly,

also 'bluboy' i think it is a windows home edition or homeversion -I seem to recall trouble with this a long while ago.....and ended up being changed to office version wonder if its this causing problem as well....sorry if I am a bit of a div when it comes to supplying the right info:rotfl::rotfl:it could be IE 6 i think but not sure...will have to come back to you all soon, thanks to you all!! ah windows XP......it is....

aliEnRIK

hamaradam wrote: »

Just a quick reply,thanks to the replies, I have done spybot, it found 3 trojans and something else - all of which I think I have removed...using the prompts...however I intend to come back to this and look at other recommendations, thanks for your time! just that I have to dash out unexpectedly,

also 'bluboy' i think it is a windows home edition or homeversion -I seem to recall trouble with this a long while ago.....and ended up being changed to office version wonder if its this causing problem as well....sorry if I am a bit of a div when it comes to supplying the right info:rotfl::rotfl:it could be IE 6 i think but not sure...will have to come back to you all soon, thanks to you all!! ah windows XP......it is....

Download MALWAREBYTES (Click 'DOWNLOAD NOW')
http://www.download.com/Malwarebytes-Anti-Malware/3000-18510_4-10804572.html?cdlPid=10997763
UPDATE and FULL scan
Post the log here after its deleted everything

Download HIJACK THIS (Click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
reboot
SCAN and post the log so we can see whats running

hamaradam

aliEnRIK wrote: »

Download MALWAREBYTES (Click 'DOWNLOAD NOW')
http://www.download.com/Malwarebytes-Anti-Malware/3000-18510_4-10804572.html?cdlPid=10997763
UPDATE and FULL scan
Post the log here after its deleted everything

Download HIJACK THIS (Click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
reboot
SCAN and post the log so we can see whats running

Thanks, I have done this, malware (I can't find were its saved - so I will manually write what it says....I anticipated this would happen) also if i did find it not sure how to copy cut and paste onto here....

Vendor : trojan hacktool x 2
rogue link

category: File

documents and settings
administrator\my docs

documents and settings
owner\my docs

documents and settings
owner\favourites\M


Does this make sense...?

NB. Already the many documents I have saved have nearly all turned into something else ie what was once an important document is now a page of icons....

I have saved a list from 'hijack this' alas, I cant find where the list has saved to ..it said 'notepad' and I searched for it, but can't see where its gone,

Also the problem is still present, the internet explorer opening itself many many times of its own accord...

***just found the log for malware....stored in THAT, it says 'infected files' (documents) don't know if this helps....

aliEnRIK

open malwarebytes. goto LOGS and open the log (it should then automatically open NOTEPAD)
RIGHT click the notepad file and SELECT ALL
Right click and COPY
then onto here and right click and PASTE

Easy as pie

rescan with hijack and do as above

hamaradam

Malwarebytes' Anti-Malware 1.37
Database version: 2192
Windows 5.1.2600 Service Pack 2
29/05/2009 17:04:20
mbam-log-2009-05-29 (17-04-20).txt
Scan type: Full Scan (C:\|E:\|F:\|)
Objects scanned: 113629
Time elapsed: 18 minute(s), 47 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\administrator\my documents\downloads\WinXP\WPAkill\WPAkill\WPAkill.exe (Trojan.Hacktool) -> Quarantined and deleted successfully.
c:\documents and settings\Owner\my documents\downloads\WPA_Kill.exe (Trojan.Hacktool) -> Quarantined and deleted successfully.
c:\documents and settings\Owner\favorites\MP3 Download, music mp3 downloads. ALLOFMP3..url (Rogue.Link) -> Quarantined and deleted successfully.

hamaradam

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:53, on 30/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WPSC3PSW.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [WpsRePsw] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WpsRePsw.EXE
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} (OSInfo Control) - http://www.sis.com/ocis/OSInfo.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1243362921781
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 3822 bytes

hamaradam

By the way, Thanks aliEnRIK, very much, :beer:for simplifying how to do this! much appreciated. Whenever I ask the computer man he is reluctant to ever explain, impatient, and seems to get anxious as to why I am wanting to learn ...