IE6, Firefox

[Chuck Davis]

Self: Computer Club volunteer
Friend: Computer Club volunteer
I, P, & J Computer Club members

Environment:
Windows XP Professional, Service Pack 2 with all available updates applied.
Three Administrative accounts, I, P, & J and one guest log on account.

Reported symptoms. When the user "P" chose Send Link from the drop down menu
on Firefox 1.5.0.5, Internet Explorer would open 58 copies in just seconds.
Used Group Close to close them rapidly. Also, Norton Anti-virus would
attempt to install on start up.

Actions:
1. Downloaded, installed and executed HijackThis. Removed 5 nasties. One
pointed to "rlvknlg.exe" After HijackThis removed related entries, I
successfully deleted it from the C:\Windows\System32 folder. and removed
entry for the "Relavant Knowledge" program using Add & Remove Programs. This
solved the repeated installation attempts of Norton Anti-virus 2005 on start
up.
2. In attempting to resolve the multiple opening (58 copies) of Internet
Explorer when clicking on File> Send Link in FireFox, I decided to download
and install Internet Explorer 7 (IE7), Microsoft's latest browser.
Installation would repeatedly fail at the last minute on "lack of
permissons."
3. Downloaded, installed, and scanned with MacAfee's Stinger. Clean
computer.
4. Downloaded, installed, updated and scanned with the free AVG Anti-virus.
Clean computer.
5. Downloaded, installed, updated and scanned with the free AVG
Anti-spyware. 13 insignificant programs removed.
6. Again IE7 failed to install due to lack of permissons.
7. Finally trundled the computer to a Friend's place for a different slant
on the problem. After several hours, Friend managed to use log on as "P" and
with his permissions successfully install IE7.
8. Friend downloaded and installed Firefox 2.0. Logging on as "J", friend
checked the Send Link facility, 58 copies of IE7 opened.
9. The Send link facility will work on "P"'s log on.
10. Friend finally found on the internet a discussion that seemed to
indicate that "J" will just have to copy and paste the URLs. Friend can't
remember location of the discussion.

I am posting this on the Windows XP Basic Newsgroup, IE 6 and the Firefox
Newsgroup.
I'm looking for a possible answer to J's dilema.

 

[siljaline]

Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/cleanup)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.atribune.org/forums/index.php?showforum=9)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forum.networktechs.com/forumdisplay.php?f=130)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)
(http://www.malwarebytes.org/forums/index.php?showforum=7)
(http://www.wilderssecurity.com/forumdisplay.php?f=26)
(http://makephpbb.com/phpbb/viewforum.php?f=2)
(http://forums.techguy.org/54-security/)
(http://forums.security-central.us/forumdisplay.php?f=13)
(http://castlecops.com/forum67.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)

Post back the URL where you posted your log, *not* the entire log.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Windows Security, AH-VSOP

Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address is invalid that we may all benefit.