Solved Browsers starting up at boot up

[AirPower4ever]

So I was at my friends house and he told me of a problem which I looked in to. Really weird, never seen this. The issue is he had mentioned his system has been really slow when opening browsers. He demo'd and I saw it too. He uses IE9 and Firefox. Both were really slow. So I poked around;

* Hard drive - not full, only about 50%
* Did A/V scans; Norton, TDSS Killer, Malwarebytes, Malwarebytes Anti - Rootkit , Hitman Pro, Kaspersky Boot (nothing shows up)
* Cleared out IE9 temp files
* Start folder had nothing, nor nothing in msconfig

Then I opened the taskmanager and this is what I saw; 3 instances of IE9 open. So I closed IE9 and then two went away; however one stayed. Could not shutdown that task, said something about the threads. So I copied his Favorites and uninstalled IE9. So now he had Firefox only. Rebooted and guess what, even before we touched the system after boot, I ran taskmanager again and it showed Firefox running.

If I launched Firefox a second item would show up and after about 2-3 minutes Firefox would just freeze.

So anyone here ever seen this and know what's going on? What I may do to help out? I do not see him that often so if I someone has a suggestion I may have to respond in a couple of days.

As always, I am hopeful someone in here has seen this and can resolve it. His system is Windows 7 Home Edition. Thanks

 

[ThrashZone]

Clean boot,
http://www.sevenforums.com/tutorials/179159-troubleshoot-application-conflicts-performing-clean-startup.html
Review Jacee’s instructions to run Adwcleaner here,
Ignore the title of the thread,
http://www.sevenforums.com/system-security/309998-how-can-i-kill-avg-search.html

 

[AirPower4ever]

Well, I cannot do the "clean boot"; not until next week or so, but I can have them run the AdwCleaner right now if you want to see the log? I can get that today and paste it? Or do I need to do the clean boot first?

 

[ThrashZone]

By all means run the Adwcleaner and post text log,
The forum has a upload option for attachments and Text is an option to use,
See the link above my signature,
Cheers.

 

[UsernameIssues]

Well, I cannot do the "clean boot"; not until next week or so, but I can have them run the AdwCleaner right now if you want to see the log? I can get that today and paste it? Or do I need to do the clean boot first?

You might want to ask them to install TeamViewer and you can set it up so that it runs all of the time. That should let you remote in and get info for this thread while they are not using the computer. With TeamViewer, you can even tell the remote computer to reboot into the safe mode and TeamViewer will still let you reconnect.

 

[AirPower4ever]

Thanks everyone, I will look in to all this. I got to run the AdwCleaner (compared it to mine, huge difference) and here it is.

 

[ThrashZone]

Wow that's a list,
You should review the Uninstall a program list fairly quickly for anything you don't recognize,
Obviously someone does not review install options before clicking on Next when downloading
As always please post any screen shots of the Uninstall a program list for other suggestions,
Cheers.
Someone might come by and request you run another scanner which these are very good but someone might see a specific listing or two in the Text file that needs a specific cleaner ?

You can use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
Uncheck the box to Activate the Free trial from the final install options,
http://www.malwarebytes.org/products/malwarebytes_free
http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

 

[AirPower4ever]

Yes, I looked into NCH and we are going to get rid of that. They do not even know what it does. My wife's friend does not watch what she installs so I already mentioned that we are going to have a pow-wow on this and it is not going to be pretty.

Most of all the toolbars are gone from the add/remove listing, but AdwCleaner shows otherwise. There is still some stuff left behind; I recognize the names. I can run AdwCleaner on those that I know, but the registry ones that have absolutely no name is what I am worried about. Off the bat I think these all have to be removed, but I want to make sure we don't jack up anything.

Yes, this is the worst I have even seen on a system. My intent is to hopefully get that weird IE9 running in taskmgr resolved. But let me know and thanks everyone.

 

[ThrashZone]

Just out of curiosity what security suite is being used,
The last two scanners I posted Malware.... and Superanti... are very good as secondary scanners although the Pro version of Malware... is very cheap for a life time license real time protection and many people here on SevenForum use it,
But the Primary security tends to vary among users here.
Cheers.

About ie9,
Reset and delete personal settings is the best way to fix it/ many of these items are commonly set as personal settings.

 

[AirPower4ever]

Thanks guys, they use Norton Internet Security Suite 2013. Yes, I forgot, I did scan their system with Malwarebytes, nothing came up. Check at the beginning of the thread for all the ones I ran; I did run the two types of Malwarebytes and everything said clear. Up to this point anything I ran said clear.

I did do a reset to IE9 and I even uninstalled it. Then the problem moved to Firefox; once we rebooted without touching the system we can see in the taskmgr that Firefox was already running. It is really weird, if I install IE9 then IE9 starts to run. Let me see if I can get a couple of pictures.

 

[ThrashZone]

Use msconfig and see if anything snuck into the startup section,
Norton might have become corrupted as well as Malwarebytes,
Are we talking about the Pro version of Malwarebytes or the free version ?
Freebie needs to be manually updated,
You might laugh but Superantispyware is very good.
It's very important Not use the machine while using the Full scans.

 

[AirPower4ever]

I just installed Malwarebytes that night I worked on it. Free version that is. SuperAntiSpyware I use as well and it is no joke for me, love it. I typically use in this order
Kaspersky RD
SuperAntiSpyware
Malwarebytes
Hitman Pro _one time use

I just forgot when I was there, gotta do that in the coming weeks. I did look in msconfig and nothing was in there that said to launch IE9. When uninstalling IE9 went back to taskmgr and there was Firefox now running. Went to msconfig and nothing in there either. I'll definitely run SAS when I get the next chance when we meet. That will give us more time to look over that AdwCleaner log.

 

[A Guy]

I'm no security expert, but have a look here:

Remove the Search.certified-toolbar.com Browser Hijacker

A Guy

 

[Britton30]

Yes do run the delete part of Adwcleaner, you've quite a smorgasbord of crap there.
http://www.sevenforums.com/system-security/266465-help-mocaflix-virus-3.html#post2193299

 

[AirPower4ever]

OK, finally was able to see my friend. Here is what it is doing. I did the "clean boot" step one and when it rebooted Internet Explorer was still running. Here is a screen shot on what it is doing.

Then if I try to end the process I get this (pic called error message)

I have not done the rest of the things adwcleaner found; figured this was step one to try.

What do you guys think?

 

[Britton30]

Yes do run the delete part of Adwcleaner then check again.

 

[A Guy]

I'm going to assume you have an infection. IE running always is a major red flag. This is looking like a security issue rather then a browser problem. It may be a good idea to post a new thread in the security forum. You can post a link to this thread there as well to bring them up to speed. Usually they will request you to run certain tools then post the logs for analysis. I don't have the expertise to be sure to suggest the right methods even though I have some ideas. A Guy

 

[UsernameIssues]

I've seen threads like this before and I'll repeat my suggestion that the remote computer have TeamViewer (or the like) installed so that this issue can be resolved quicker. The remote computer can be set to not sleep while these issues are being worked.

It is not a good sign that iexplorer could not be terminated via task manager.

 

[AirPower4ever]

OK, I'll give my friend a talking to about setting this up the teamviewer and getting this thread over to the security post.

BTW, I also did this. I created a new user and the same thing. Also I saw that there were two instances of Flash Player just for Firefox so when I got home I fired up my system and same thing. Normal?

I also booted in safe mode (both in no networking and also with networking) and I.E. was not running.

Thanks again everyone, next time I can get my hands on the computer is about a week as they are traveling.

 

[A Guy]

Flash has it's own flash pepper flash, and you have installed flash as well, so yes, that is normal.

If IE was not running in Safe Mode, then you might try scanning outside of windows with a rescue cd

Comprehensive List of 26 Bootable Antivirus Rescue CDs for Offline Scanning ? Raymond.CC

You might try a clean start as well, since IE was not running in Safe Mode. See if it runs in a clean start.

http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

A Guy