Thunderbird opens sex (?) site in Firefox

Hello, ken545, security expert in spybot forum, sent me to this forum… (after fixing other malware problems in my computer)

My problem with networking is that the other day, 2 computers in my home office network were doing the same thing: Whenever I opened Thunderbird, about 10 Firefox windows would open, starting FF if not already open.

The url was: http.//post.kareeza.com/[lots of numbers here, ending differently in each window], each window was just black.

It did this during one day, and then the next day it was gone! I understand something may be compromised in the network, and that the router should be reset carefully, and someone in this forum could help me do this?

Thank you for looking into this,

Bernard

ps: in case it helps, my post in spybot forum is here, showing malware problem with 3rd computer on network:

http://forums.spybot.info/showthread.php?70520-Can-t-email-returned-messages-show-an-IP-address-that-s-not-mine

My concern is the network more than the router, I fear the great help you received was done in the knowledge it was a standalone system they were dealing with, I can't see anywhere at the start of the help that you had said you were on a network, and as such you were not instructed to remove the system from the network before starting the process of scanning etc, it was only at the end I noticed this mentioned (apologies if I missed an earlier mention).

I am no pro, but my limited understanding is that if in a network situation, the 1st thing is to isolate the system from the network, so there is no chance of the infection(s) passing over the network to the other system(s) and infecting them, which is my suspicion here, then checking the other systems for this possibility before connecting back to them again, so my gut says all the systems should be isolated and then scanned independently, and cleaned if necessary, but more importantly given the all clear before returning to the network, this should stop any cross contamination from happening, without this as soon as a clean computer is added to an infected network it becomes infected again.

My advice is raise this query with Ken, and see if he feels my concerns are valid or not, but as an FYI to ANYONE reading this (not just the OP), is when in a network make sure the person helping you is made aware of this before starting any work, their time is valuable, and they are very busy guy's and gal's, so giving them ALL info about the setup you have can make a big difference in how they approach it, which ultimately not only saves them time (having to do the job only once), but also saves you time, and frustration.

As to the router, I have never heard of an infection hitting such a device, but again I am no pro, and I guess anything is possible, should you want to try and see about this, my gut says upgrade (if available) the firmware, or if not available reflash the firmware it already has, it's the quickest surest way I can think of resetting it to it's factory state (from a clean system). and making sure there is nothing hiding in there to stop this happening, this is an extreme worst case thing that I don't think is happening (or even possible at this stage in infections), but if you want a belt and braces approach, this would be it IMO.

So have a quick word with Ken about this, and go from there is my best advice ATM.

Your correct, but didnt find out until half way cleaning this one that the other two computers had problems also. I just posted to him and asked if the other two had problems now or if they were ok.  Either way i think he needs help just resetting the router back to defaults, I have seen in the past to where a router can get infected.  If when he replies back and says the other two have problems with redirects I will have him pull them offline and have him post for each one .

Yes I did suspect you knew nothing of the network until finished, which is why I said above in a general note about such things, to all readers if they looked in, to make sure they tell you guys everything about the setup so you can deal with it in the way you know is best, but I have never heard of a router being infected before, but it doesn't surprise me.

I will certainly remember it's now a very real possibility when trying to find issues, and I'm guessing that you can't scan it with software to check, and clean like a PC as it's a separate entity, anyway your instruction to reset the router is spot on, it just needs to add the timing of this, which is hold it in for 10 seconds or so before releasing it, I'll make the info here with a link, but will leave it for you to decide when the appropriate time is to do this, just incase it makes a difference to what you do, but Thanks for that info though, new one on me.

Anyway, below is a link from Verzion on how to reset the router, but check with Ken when it is the best time to do this, if there is concern about the router still being a problem, you would need to contact Verzion and see if they can give you the firmware file to flash to the router, more so if it's a newer file, that should certainly set it all back to the factory state, as it will wipe the current firmware, which should remove anything still messing about in there, but do note the comments about networks etc as this may warn you what to write down for setting up again when done, hope this helps.

Resetting your router to factory settings

Thanks guy.  Most times when a user posts that they have one or two other computers on a home network and there all being redirected to the same site, its usually the router.  You cant scan the router for malware but just resetting it back to manufacturer defaults and then setting it up again does the trick.

Thanks for that link, I will give Bernardr a heads up

Thank you for the link 8210Guy, I'm going to make sure no network settings have been customized (ESSID names, router pw, port forwarding, according to the verizon video) and then I'll be resetting!

Bernard

NP Ken, I'll certainly add that info to the memory pile (my head lol), assuming it doesn't go in a faulty slot lmao, Thanks for the info.

NP Bernard, you're in great hands with Ken, hope this helps you get the final niggles sorted now, good luck.