I have been having a problem recently, while running Firefox if I click on a link sometimes an additional tab will pop up as well as the one that I wanted to go to. Usually the second tab will be an ad, sometimes all that will appear in the address bar is about:blank and still other times Avast will trigger an alert, saying in blocked a harmful site. I have run scans with Avast, Malwarebytes, Spybot and SUPERAntispyware and none of them have detected a problem, yet the problem persists. Attached are my most recent malwarebytes log as well as the two OTL logs. Any directions you could point me in as to what I might be dealing with and how to remedy it would be greatly appreciated.
hey i suggest you follow this guide and wait for a malware expert to check those logs. they will give you further instructions on how to proceed.
http://forum.avast.com/index.php?topic=53253.0
there is one more log they need to be able to help you. its the aswmbr log.
good luck
Essexboy has been notified to assist with the OP. Thank you.
Could you confirm that this does not occur in IE
Is it only firefox ?
Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2
[*]Ensure all Firefox windows are closed.
[*]To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
[*]When prompted to run the scan, click Yes.
[*]GooredFix will check for infections, and then a log will appear.
Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
Hope I did everything correctly. Attached is the logs you requested. I haven’t noticed the problem in IE, though I rarely run IE that much. I did take it out for a spin, just to kick the tires and see if anything would happen, and I didn’t notice any problems with it when I did. MY problems seem to be limited to Firefox at this point, at least that is the only place I have encountered them.
OK I will now need to check the FF addons
First we will try Firefox in safe mode http://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode
Do the problems still occur in safe mode ?
If no then restart Firefox normally
Disable all Addons
Still no problem?
If all is good then enable the addons one at a time checking between each for the extrra tabs
As soon as they apear disable the last addon that you started and let me know which one it was
If the still occur in safe mode then let me know
I went into Firefox and restarted it in safe mode with no add ons, as soon as the Firefox window opened there was another window that opened with it, one of the many ads that pop up.
OK next phase I feel, what version of FF do you have
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
- IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
- Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
- Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
- If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Here is the Combofix log.
What version of Firefox do you have ?
Also are the ads of a specific type ?
I am running Firefox 13.0.1 currently. The ads that pop up, when they come through fall into ads for money making schemes (such as Abbey’s Blog/easykits.org), though sometimes the additional tabs come up as empty pages with about.blank in the address bar, or that the site has timed out. A few of the times Avast has prevented the additional page, recognizing it as JS:ScriptIP-inf[Trj.], but scans of my hard with Avast have come up with nothing.
I am just going to download Firefox to see if I can replicate this
just got one of the alerts, when avast does catch something, this is what pops up
Infection Details
URL:htt p://cpv.srv-ad.com/srv/index.php?pubi…
Process: C:\Program Files (x86)\Mozilla Firefox\f…
Infection: JS:ScriptIP-inf [Trj]
not sure this will help or not, but figure the more information the better
Please make the url posted above non-clickable as above. Clicking link above securi says invalid web site, so I clicked your url and got the attached warning from avast!
OK lets clear your java and temp caches
Clear Cache/Temp Files
Download TFC by OldTimer to your desktop
[*] Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
[*]It will close all programs when run, so make sure you have saved all your work before you begin.
[*]Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
[*]Once it’s finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.
Okay, downloaded and run. Sorry about the issue with the URL, still relatively new at this.
Could you now run Firefox to see if the alerts persist
Sure, I usually have Firefox on at work anyway, so I will run it for a while and see if the problem persists.
Yes, I have still have had a few of those additional windows pop up, mostly the ones with about:blank in the address bar. I have not received any alerts from Avast since running the program, but those didn’t pop up all that much before, so it could be they stopped or I just haven’t been lucky enough to get one yet.
Been keeping track of the sites that have popped up in additional tabs this evening. I received no alerts from Avast, but here is what popped up between 4pm and 11pm my time this evening.
hxxp://www.en.tv-in-pc.com/?source=ccfb09vjzde6llbe58nsthyqfb&player=P2P40921274&tid=P2P40921274
about:blank
about:blank
hxxp://www.satellitedirect.com/?hop=pplmedia
about:blank
hxxp://cem.easykits.org/index3.html
Again, I don’t know if this will help, but those sites had been some of the ones that popped up in the past as well.