IE Opening on it's own

[Guest]

I have a laptop that I have been working on this week. I have run every
spyware remover that we have (Ad Aware SE, Spybot, MS Spyware Remover). They
are all up to date with defs and find, at most now, 4 pieces. It seems
though that something is still on there. If i just let the comptuer sit
there, I will comeback 10-15 minutes later and there will 3 or more IE
windows open, some that I can only kill using Task Manager. Does anyone else
ahve these issues or know what I need to do to find what is doing this?
Please help me. Thank you.

(e-mail address removed)

 

[Michael T]

How about BHODemon?

http://www.definitivesolutions.com/bhodemon.htm

 

[Michael T]

How about virus scans?

I would consider running one or more of these 'online' virus scans.

http://us.mcafee.com/root/mfs/default.asp
http://www.pandasoftware.com/activescan/
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://housecall.trendmicro.com/housecall/start_corp.asp

Note: There was at least one report that Panda On-Line scan 'seems' to catch
things that others won't/can't

 

[Guest]

We have Symantec here at the company, and I have run that scan 3 times and
come up with nothing.

 

[Mike Bevington]

What are the websites that open up?

We have Symantec here at the company, and I have run that scan 3 times and
come up with nothing.

 

[Guest]

It is random. The one that I do notice more than others starts with
terp17.com. I have searched for terp on the machine but found nothing.

 

[Michael T]

From www.terp17.com

What types of information does Company collect?
We collect the following information: the full Uniform Resource Locator
("URL") of the Web pages you view; your Internet Protocol ("IP") address,
which may include a domain name; the date and time for each page you view;
the name of and information about any advertisement that you clicked on;
searches you perform; links you click on; and computer and connection
information such as browser type and version, operating system, and
platform. We also transmit cookies to your computer so we can track the
pages of our Web site that you view and the order in which you view them.

 

[Don Varnau]

Hi,
I would run at least the online scan from RAV
http://www.ravantivirus.com/scan/ in addition to Norton. You might add
another online scan or two. See http://windowsxp.mvps.org/Scanners.htm for
some of the available scans.

Next step... let some experts look over a HijackThis log. Many of the
malware programs need to be rooted out manually.
Start at http://forum.aumha.org/viewtopic.php?t=4075 Then go to
http://www.aumha.org/a/quickfix.htm Work through the preliminary cleaning
steps then post a HijackThis log to the forum at
http://forum.aumha.org/viewforum.php?f=30

Hope this helps,
Don
[MS MVP- IE/OE]

 

[Sandi - Microsoft MVP]

A lot depends on *how* you run those programs, and how up to date they are.
Please check out the advice at the URL below:
http://inetexplorer.mvps.org/data/tshoot.htm

You need to consider running in safe mode (twice), making sure you have the
latest versions of the software, and if all else fails, posting a HJT log to
forum.aumha.org

--

__________________________________________
Hyperlinks used to ensure advice is current
Sandi - Microsoft MVP since 1999
http://inetexplorer.mvps.org

Visit the Internet Explorer Community
http://www.microsoft.com/windows/ie/community/default.mspx

 

[Tom Turbo]

I've got the same problem. On www.terp17.com I found an uninstaller - would
you recommend to execute that one? Or is this just another trap?
Thanks for your support...

 

[Jon Kennedy]

I wouldn't touch it with a 10-foot pole. Did you read the Terms and
Conditions? Look at section #4 to see what that program will do to your
system?

If you're having problems as described in this thread....

This may be caused by spyware/malware that's gotten installed on
your system. Use Ad-Aware and/or Spybot Search & Destroy to remove it.

Ad-Aware: http://www.lavasoftusa.com/
Spybot: http://www.safer-networking.org/en/index.html
Good sites on how to install and use Spybot -
http://www.safer-networking.org/en/tutorial/index.html
http://tomcoyote.com/SPYBOT/index1.php

Also download a winsock repair tool, to have just in case cleaning up
anything found breaks it -

Winsock repair tools:
LSPFix- all versions of Windows http://www.cexx.org/lspfix.zip
Winsock2 Fix- Win98, ME
http://www.bu.edu/pcsc/internetaccess/winsock2fix.html
LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip

More information here:
http://www.spywareinfo.com/
http://inetexplorer.mvps.org/Darnit.htm
http://www.doxdesk.com/parasite/ - runs a little script when loading page to
check for common parasites

If no joy, in IE go to Tools...Internet Options...Advanced tab, Browsing
section, uncheck "Enable third-party browser extensions", click Apply, click
Okay, reboot. If that solves your problem, then more troubleshooting is
needed to find out exactly which program, or Browser Helper Object (BHO) is
causing this problem. You don't want to leave it at that, as some BHOs are
useful or necessary - like Adobe Acrobat for reading .pdf files or an
essential component of Norton AV. Get BHODemon -
http://www.definitivesolutions.com/bhodemon.htm - read all about BHOs.
Disable all items, and then gradually replace one or two at a time to narrow
down the culprit.

Or if you have IE 6 SP-2 you can do this within the browser:
How to manage Internet Explorer add-ons in Windows XP Service Pack 2
http://support.microsoft.com/default.aspx?scid=kb;en-us;883256

If all the above fails, then the problem could be something new that the
spyware cleaners above don't have in their databases yet. In that case....
HijackThis direct download:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Tutorial on how to use HijackThis:
http://www.spywareinfo.com/~merijn/htlogtutorial.html
Then post it's output log to the forum here for analysis and feedback by the
parasite experts:
http://www.spywareinfo.com/forums/
Or the other HijackThis Logs forums listed here:
http://www.spywareinfo.com/~merijn/forums.html

Or try this program to get some of the most nasty malware:
CWShredder direct download:
http://aumha.org/downloads/cwshredder.zip

An alternate resource for all of this and more:
http://www.aumha.org/secure.htm