I recently started having a problem with internet explorer

ThrashZone · 19 Oct 2014

Hi and welcome to SevenForums,
The default opening page for Internet explorer of all versions is msn
Until a user changes it to a new home page,

Definitely run Adwcleaner and post the text scan report,
After doing that refer to some of these,

Clean boot to remove unnecessary items from the Startup section,
https://www.sevenforums.com/tutorials/179159-troubleshoot-application-conflicts-performing-clean-startup.html
Troubleshooting for win-7,
https://www.sevenforums.com/tutorials/220165-troubleshooting-steps-windows-7-a.html

Export Favorites to html file before resetting Internet explorer/ just to be safe.
https://www.sevenforums.com/tutorials/86795-internet-explorer-import-export-favorites.html

Tutorial of Resetting Internet explorer,
https://www.sevenforums.com/tutorials/1222-internet-explorer-reset.html
Accessing Internet Options from the Start menu search,
Reset process first opening Internet explorer
Manage add-ons applies to all versions of ie,
http://windows.microsoft.com/en-us/internet-explorer/manage-add-ons#ie=ie-10-win-7
http://windows.microsoft.com/en-IN/windows7/How-to-manage-add-ons-in-Internet-Explorer-9

crashhat · 19 Oct 2014

# AdwCleaner v4.000 - Report created 19/10/2014 at 20:48:13
# DB v2014-10-19.11
# Updated 12/10/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Berta - BERTA-HP
# Running from : C:\Users\Berta\Downloads\adwcleaner_4.000.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Berta\AppData\Local\Slick Savings
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\Users\Berta\AppData\Roaming\Mozilla\Firefox\Profiles\r11mzr06.default\user.js

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.9

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344

-\\ Mozilla Firefox v32.0.3 (x86 en-US)

[r11mzr06.default] - Line Deleted : user_pref("startpage.ntsearch_url", "hxxp://search.yahoo.com/search?ei=utf-8&fr=spigot-nt-ff&type=0&ilc=12&p={searchTerms}");

*************************

AdwCleaner[R0].txt - [3364 octets] - [19/10/2014 20:45:47]
AdwCleaner[S0].txt - [2971 octets] - [19/10/2014 20:48:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3031 octets] ##########

ThrashZone · 19 Oct 2014

Hi,
Thanks for the update,

Use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
See this tutorial on how to download and run Malwarebytes,
Malwarebytes Anti-Malware Free
Also use the Custom scan option not the Threat scan,

Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to remove anything it finds

http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

crashhat · 20 Oct 2014

I did a malware scan of the computer the other day and didn't find anything

UPDATE: It just happened again and a site called reiprovensystem.com loaded up. This is an ad right?

ThrashZone · 20 Oct 2014

Malware scan with what exactly ?

crashhat · 20 Oct 2014

ThrashZone said:

Malware scan with what exactly ?

I used the microsoft malicious software removal tool.

I installed malwarebytes, I did a custum scan and checked every box even the rootkit box and it found 1 non malware item. C:\program files (x86)\openDownloaderManager\wajam_instal.exe

ThrashZone · 20 Oct 2014

From my post #11
Clean boot what were the results,
Click Start and type in the search box
msconfig
Startup section take a screen shot of this page for a complete list,
Repeat for the Services section,
On the bottom left Check the box to Hide All Microsoft services,
See the links above my signature on how to take and upload screen shots here if you need too,
Cheers.

Anak · 20 Oct 2014

Hi everyone! :)

I'm helping crashhat over here, I don't believe the two problems are related, but I'm not so sure.

In going over the AdwCleaner report there are some items that may continue to cause problems.

Folder Deleted : C:\Users\Berta\AppData\Local\Slick Savings

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extension\mhkaekfpcppmmioggniknbnbdbcigpkk *(this is Slick Savings)*

[r11mzr06.default] - Line Deleted : user_pref("startpage.ntsearch_url", "hxxp://search.yahoo.com/search?ei=utf-8&fr=spigot-nt-ff&type=0&ilc=12&p={searchTerms}");

Slick Savings and Spigot can be delivered as a combined Potentially unwanted Program (PuP) and even though AdwCleaner removed these items it may not have removed everything. From what I've seen in searching, these two are particularly virulent.

There are steps to follow in order to completely remove both:
Remove Slick Savings virus (Removal Guide)
Remove SearchSettings.exe by Spigot (Virus Removal Guide)

To answer crashhat's last question, reiprovensystem.com is an ad, and from the looks of it, it looks like a ponzi scheme to get one to send money for little in return.

I just saw crashhat's post. wajam_instal.exe is another nastie.

crashhat · 20 Oct 2014

I downloaded hitman pro, duid a scan and it fount 2 things but I had to buy the product to remove the threats so I uninstalled it.

cant I just do a system recovery to remove everything?

PeaB4YouGo · 21 Oct 2014

crashhat said:

I downloaded hitman pro, duid a scan and it fount 2 things but I had to buy the product to remove the threats so I uninstalled it.

cant I just do a system recovery to remove everything?

I suppose that depends on how long you've had this issue and how far back any of your backups go...