Desktop

Ask something
Discussion Locked

malicious browser redirection

0 helpful
4 replies

by mr.d 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My coworker has a problem with malicious browser redirection on his home PC(ME).
It seems to be random. After booting up, Internet Explorer automatically fires up on its on and starts linking to the my.yahoo website. It may go for hours without anyactivity and then starts up again like it's on a random timer. If it successfully connects to my.yahoo, moving to another site results in a redirect back to my.yahoo. He found a text file in a yahoo folder with redirect instructions to my.yahoo and got rid of it. Didn't work - guess there were other files or new ones were generated somewhere else. Anyway, he is on a 56K dialup, so when the browser fires up immediately after booting it trys about twice per second to connect to my.yahoo unsuccessfully since a connection to the ISP hasn't been established yet. These efforts fill up the bottom of the screen with instances of IE each showing the expected "website not found" err msg. It's not possible to start any other apps while these attemptsare going on. Apparently, the program is so determined to make a connection that the only way to terminate the activity is by killing power to the PC. The startup folder and autoexec were checked for entries that might cause IE to start up - nothing. McAfee is run in the background. He installed and ran The Cleaner (moosoft.com) to clear any trojans. He then installed Zone Alarm. Problem still there. Task Manager just shows IE running, whatever initiated IE must have terminated on its own. If he knew what type of file to look for, a search and destroy from DOS could be executed. Any ideas?

4 replies

by thechas

Is there a yahoo icon in the system tray?

If so, that is likely the culprit. If he has yahoo's version of instant messaging turned on, that is probably what is trying to make the connection.

Use the msconfig utility from the run box to see what is loaded at startup.
Several items are stored only in the registry.
Use selective startup to disable the suspected program.

Has he tried removing the yahoo software?
I would also check the settings of the yahoo software. You may be able todisable the automatic connection, or at least get some control over it.

by mm212

Go to Start, Run and type in sysinfo or go to Start/Programs/Accessories/System Tools/System Information. Once there, go to Tools/System Configuration. Look through all the tabs to see what programs are loaded at startup. This program shows programsloaded from autoexec.bat, config.sys, Startup folder, Win.ini, System.ini and the registry. You can just uncheck an item to keep it from loading.

Disclaimer: If you aren't careful working with the registry when following the steps below, you could cause serious system problems that could require you to reload your computer. Be sure your backups are up to date.

Another way to find out what's starting at system start is to go to Start, Run and type in regedit.
Click on the plus-sign (+) next to each of the following folders in the left-hand pane.
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Then click on the folder named "Run"
In the right-hand pane you will see a bunch of programs that start when you start yourcomputer. If you see one that looks suspicious, click on it in the right-hand pane and hit your delete key. It will ask you to confirm. Verify that it's what you want to delete and click "Yes".
You will also find similar information under:
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
RunServices

and

HKEY_CURRENT_USER
Software
Microsoft
Windows
CurrentVersion

by mdelyea

The virus W95.mtx also causes this behavior and will not show up in task manager. Go to www.symantec.com for complete instructions for removing this virus. You will have to use another computer to go to symantec because W96.mtx blocks access to antivirus sites.

by mr.d

Many thanks for all the useful suggestions. The problem was actually solved by repositioning the monitor. Ok, I guess that deserves further amplification. My coworker noticed that the problem only occured after his wife had been using the PC (CompaqPresario). He stumbled upon the culprit when he tilted the monitor up thereby taking pressure off of the built-in internet key at the top edge of the keyboard. The weeks long problem was solved and he received a well deserved razzing.

This discussion is closed to new replies.