Problems mass opening of internet explorer pages, continous running

yotagirl · 03-28-2009, 11:15 PM

Today, while on mapquest the internet explorer started opening internet explorer continously, last count that I could see was up to 93 windows, when it does that, the modem runs constantly, the pages are flashing white and black, and the words change colors. When it does this, you can't do anything at all and you can't close the pages unless you shut the computer completely down. Also, while using hotmail, it also freezes up and you have to open task manager just to exit and when you do that it says that internet explorer isn't responding and prompts me to close and restart.

Upon scan using Macfee, nothing shows on scans or on AVG. Earlier about 2 hours ago, it did show something about a trojan being detected but it was quaratined. I hope that I followed directions as explained if not just let me know and I will try it again. Thanks

Here is the DDS:

DDS (Ver_09-03-16.01) - NTFSx86
Run by Amy at 1:03:43.61 on Sun 03/29/2009
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1013.420 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Users\Amy\AppData\Local\Temp\Temporary Internet Files\Content.IE5\FUFR0LAC\dds[1].scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5411E
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5411E
uInternet Settings,ProxyOverride = <local>;*.local
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5411E
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Ask Toolbar BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
TB: Ask Toolbar: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\asksbar\bar\1.bin\ASKSBAR.DLL
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
uRunOnce: [Shockwave Updater] c:\windows\system32\adobe\shockw~1\SWHELP~1.EXE -Update -1103471 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; MS-RTC LM 8; .NET CLR 3.5.30729; .NET CLR 3.0.30618)" -"http://www.miniclip.com/games/fowl-words-2/en/"
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: convergysworkathome.com\www
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-us.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {E7D2588A-7FB5-47DC-8830-832605661009} - hxxp://livenj02.custhelp.com/8102-b424h/rnl/java/RntX.cab
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL,avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-1-4 325128]
R2 nmsgopro;GoProto Protocol Driver for NMS;c:\windows\system32\drivers\nmsgopro.sys [2006-9-27 28672]
R2 nmsunidr;UniDriver for NMS;c:\windows\system32\drivers\nmsunidr.sys [2006-10-19 7424]
R3 IntelDH;IntelDH Driver;c:\windows\system32\drivers\IntelDH.sys [2008-4-28 5504]
S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184]

=============== Created Last 30 ================

2009-03-11 08:47 7,680 a------- c:\windows\system32\spwmp.dll
2009-03-11 08:47 4,096 a------- c:\windows\system32\msdxm.ocx
2009-03-11 08:47 4,096 a------- c:\windows\system32\dxmasf.dll
2009-03-11 08:47 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-03-11 08:47 268,288 a------- c:\windows\system32\schannel.dll

==================== Find3M ====================

2009-03-26 10:40 246 a------- c:\users\amy\appdata\roaming\wklnhst.dat
2009-02-03 22:36 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-02-03 22:36 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-01-20 21:02 56,912 a------- c:\users\amy\g2mdlhlpx.exe
2009-01-15 02:11 827,392 a------- c:\windows\system32\wininet.dll
2008-11-23 13:58 86,016 a------- c:\windows\inf\infstor.dat
2008-11-23 13:58 51,200 a------- c:\windows\inf\infpub.dat
2008-11-23 13:58 86,016 a------- c:\windows\inf\infstrng.dat
2008-09-18 15:32 174 a--sh--- c:\program files\desktop.ini
2008-09-18 15:19 665,600 a------- c:\windows\inf\drvindex.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 1:05:45.96 ===============

yotagirl · 03-29-2009, 04:14 PM

bmp. Wondering how long it normally takes to receive help. Haven't done this before.

Ried · 03-30-2009, 05:41 AM

Hello yotagirl and welcome to TSF.

As explained in the sticky topic you've already read New Instructions - Read This Before Posting for Malware Removal Help

Quote:

2. Please be considerate of the fact that the people helping you are all volunteers, and in many cases usually have a job, and a limited amount of time to help, and therefore can only do so much. If no one has replied to your thread within 72hrs after you posted, please reply in your thread with the words BUMP, please to move it forward.

DO NOT Bump the thread unless 72 hours has passed. We work from oldest to newest posts so your wait will be longer if you bump it forward before the 72 hours is up. We look for 0 reply, or 1 reply threads to respond to.

There's a whole world wide web of people seeking help, and only a handful of qualified people to do so.

One of our Analysts will get to your thread as soon as possible. We appreciate your patience.

yotagirl · 03-30-2009, 09:26 AM

Sorry Reid, I misunderstood what I read then.

Ried · 03-30-2009, 09:45 PM

Hello yotagirl,

You currently have 2 Anti Virus programs installed, which is never a good idea. You need to choose and run only 1, and uninstall the other, but do not do that yet...Which AV quarantined something? There should be a report in your Anti Virus program that says what was quarantined. Could you please find out what it was and post that info in your next reply.

yotagirl · 04-01-2009, 07:13 AM

It was thru McAfee Security Center, it will not let me copy and paste it so I will just type what it says:

3/29/2009 1:06.48s Real Time Scan New Malware (trojan) Quaratined

Details: One or more items were detected on your computer.

Detection Name: New Malware.j (Trojan)

File: C:\Users\Amy\Appdata\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IES\JUA49601\dds(1).pif

Process: C:\Program Files\Internet Explorer\iexplore/exe

Process Description: Internet Explorer

Ried · 04-01-2009, 03:31 PM

McAfee detected the scanning tool that we use. No worries there, it was a false detection.

Are you still getting many IE's opening like crazy? Have you recently installed any new software?

yotagirl · 04-01-2009, 10:55 PM

No, I haven't done anything different. It has happened maybe 8 times in the last 6 months maybe less maybe more. I haven't downloaded anything. It hasn't done it since the day that I sent the message on here. It also runs slow at times and then also it seems like the modem is always running. I know about computers somewhat but I don't know everything. Thanks

Ried · 04-02-2009, 03:07 AM

As I'm not seeing any malware in any of these logs, it appears to be OS related and you would be better served discussing these issues with the folks in the Windows Vista Support section.

yotagirl · 04-02-2009, 07:29 AM

Ok, Thank you

03-29-2009, 04:14 PM	#2 (permalink)
yotagirl Registered User Join Date: Mar 2009 Location: Georgia Posts: 7 OS: Windows Vista	Re: Problems mass opening of internet explorer pages, continous running bmp. Wondering how long it normally takes to receive help. Haven't done this before.

03-30-2009, 09:26 AM	#4 (permalink)
yotagirl Registered User Join Date: Mar 2009 Location: Georgia Posts: 7 OS: Windows Vista	Re: Problems mass opening of internet explorer pages, continous running Sorry Reid, I misunderstood what I read then.

03-30-2009, 09:45 PM	#5 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 28,143 OS: WinXP Home, Vista, Windows 7 64bit	Re: Problems mass opening of internet explorer pages, continous running Hello yotagirl, You currently have 2 Anti Virus programs installed, which is never a good idea. You need to choose and run only 1, and uninstall the other, but do not do that yet...Which AV quarantined something? There should be a report in your Anti Virus program that says what was quarantined. Could you please find out what it was and post that info in your next reply. __________________ Member of ASAP since 2005 Member of UNITE since 2006 Microsoft MVP - 2010 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

04-01-2009, 07:13 AM	#6 (permalink)
yotagirl Registered User Join Date: Mar 2009 Location: Georgia Posts: 7 OS: Windows Vista	Re: Problems mass opening of internet explorer pages, continous running It was thru McAfee Security Center, it will not let me copy and paste it so I will just type what it says: 3/29/2009 1:06.48s Real Time Scan New Malware (trojan) Quaratined Details: One or more items were detected on your computer. Detection Name: New Malware.j (Trojan) File: C:\Users\Amy\Appdata\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IES\JUA49601\dds(1).pif Process: C:\Program Files\Internet Explorer\iexplore/exe Process Description: Internet Explorer Last edited by yotagirl; 04-01-2009 at 07:15 AM. Reason: wasn't finished

04-01-2009, 03:31 PM	#7 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 28,143 OS: WinXP Home, Vista, Windows 7 64bit	Re: Problems mass opening of internet explorer pages, continous running McAfee detected the scanning tool that we use. No worries there, it was a false detection. Are you still getting many IE's opening like crazy? Have you recently installed any new software? __________________ Member of ASAP since 2005 Member of UNITE since 2006 Microsoft MVP - 2010 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

04-01-2009, 10:55 PM	#8 (permalink)
yotagirl Registered User Join Date: Mar 2009 Location: Georgia Posts: 7 OS: Windows Vista	Re: Problems mass opening of internet explorer pages, continous running No, I haven't done anything different. It has happened maybe 8 times in the last 6 months maybe less maybe more. I haven't downloaded anything. It hasn't done it since the day that I sent the message on here. It also runs slow at times and then also it seems like the modem is always running. I know about computers somewhat but I don't know everything. Thanks

04-02-2009, 03:07 AM	#9 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 28,143 OS: WinXP Home, Vista, Windows 7 64bit	Re: Problems mass opening of internet explorer pages, continous running As I'm not seeing any malware in any of these logs, it appears to be OS related and you would be better served discussing these issues with the folks in the Windows Vista Support section. __________________ Member of ASAP since 2005 Member of UNITE since 2006 Microsoft MVP - 2010 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

04-02-2009, 07:29 AM	#10 (permalink)
yotagirl Registered User Join Date: Mar 2009 Location: Georgia Posts: 7 OS: Windows Vista	Re: Problems mass opening of internet explorer pages, continous running Ok, Thank you