Internet Explorer pops up and connects to random sites

the very same I did yesterday?

I wasn't sure you ran it, as the log wasn't posted. I'd like to see a screenshot of what you see when the IE windows popup.

Lets try something else as well:


AVP Tool by Kaspersky

IMPORTANT: Save these instructions so you can have access to them while in Safe Mode.

Download the AVP Tool by Kaspersky from Here & save it to your desktop. Be aware that this is a large file…. approximately 60mb.

• Reboot your computer into Safe Mode
  

  You can do this by restarting your computer and continually tapping the F8 key until a menu appears
  Use your up arrow key to highlight Safe Mode then press Enter

  
  
• Double click the setup file to run it
  
• Click Next to continue
  
• Accept the License agreement then click Next
  
• It will by default install to your desktop folder. Click Next
  
• Once installed it will open a box. Click the Automatic scan tab
  
• Under Automatic scan make sure the following are checked:

• Hidden Startup Objects
  
• System Memory
  
• Disk Boot Sectors
  
• My Computer
  
• Also any other drives (Removable that you may have)

Leave the rest of the settings as they appear

• Click on Scan at the top right hand corner
  
• It will automatically neutralize any objects found
  
• If some objects are left un-neutralized, click on Neutralize all
  
• If you receive a message that an item cannot be neutralized then choose the Delete option when prompted
  
• Once finished click the Reports button at the bottom
  
• Name the file Kas & save it somewhere convenient like your desktop
  
• Copy/paste only the detected Virus\malware from the report. It will be at the very top under Detected & post those results in your next reply
  

  Note: This program will self uninstall when you close it so save the log before closing it

NEXT:



Please download Dr.Web CureIt . Save it to your desktop:

• Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
• This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, select Complete scan.
• Click the green arrow [external image: Posted Image] at the right, and the scan will start.
• Click Yes to all if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click File and choose Save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
• Please post the Dr.Web.txt report in your next reply
• Close Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.



Please let me know how things are running after doing the above.

two shots of popup behaviour..

Okay. Lets see what those two scans above turn up..

Kaspers killed a few baddies: Autoscan: completed 6 minutes ago (events: 8, objects: 377626, time: 02:09:08) 10.09.2010 01:50:36 Task started 10.09.2010 02:36:30 Detected: Exploit.JS.Pdfka.cqz C:\Documents and Settings\T2\Local Settings\Temporary Internet Files\Content.IE5\KNFSIWYV\asshole[1].pdf/data0000 10.09.2010 02:38:09 Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\T2\Local Settings\Temporary Internet Files\Content.IE5\VNM93GNN\selekt_co_cc[1].htm 10.09.2010 02:41:49 Deleted: Exploit.JS.Pdfka.cqz C:\Documents and Settings\T2\Local Settings\Temporary Internet Files\Content.IE5\KNFSIWYV\asshole[1].pdf 10.09.2010 02:42:01 Deleted: HEUR:Trojan.Script.Generic C:\Documents and Settings\T2\Local Settings\Temporary Internet Files\Content.IE5\VNM93GNN\selekt_co_cc[1].htm 10.09.2010 07:52:01 Task stopped 10.09.2010 07:53:05 Task started 10.09.2010 10:02:13 Task completed

Dr. Web says: sfcure01.sys;C:\WINDOWS\system32\drivers;Probablement Trojan.Packed.191;Irréparable.Supprimé.; sfcure01.sys;c:\windows\system32\drivers;Probablement Trojan.Packed.191;Chemin invalide pour le fichier ;

Adobe and the help center popped up right after the last scan/action.

Do the following:

TFC
Download TFC to your desktop

• Close any open windows.
• Double click the TFC icon to run the program
• TFC will close all open programs itself in order to run,
• Click the Start button to begin the process.
• Allow TFC to run uninterrupted.
• The program should not take long to finish it's job
• Once its finished it should automatically reboot your machine,
• if it doesn't, manually reboot to ensure a complete clean

Let me know if things are still acting up. Do you know if you have the latest version of Adobe installed? The latest version is 9.3.4.

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic