Solved I recently started having a problem with internet explorer

[crashhat]

So I've had firefox for awhile now and IE recently started randomly opening by itself. any idea why this is happening and how to fix the problem? I have AVG by the way and I've scanned the computer and theres no viruses so I'm lost.

 

[richc46]

Did you select IE as the default browser?
http://windows.microsoft.com/en-us/internet-explorer/make-ie-default-browser#ie=ie-11-win-7
Even if you did not, make sure that it is not the default.

 

[crashhat]

I'm pretty certain that firefox is my default browser.

 

[richc46]

Check it to be totally sure and then report back.

 

[crashhat]

If I open up IE I get asked if I want to make IE my default browser

 

[richc46]

Follow procedure to make Firefox default browser
After you follow procedure, see if problem persists
If it does one answer, can be seen in this article. Some websites open
IE, even if not the default.
https://support.mozilla.org/en-US/kb/how-make-web-links-open-firefox-default

 

[PeaB4YouGo]

I think it's important to ask: What webpage comes up when IE starts? I have a game launcher that shows news about my game, and when I click to view a specific article, it opens IE (my default is Chrome). The page that comes up may be a clue to what is opening the browser.

 

[crashhat]

Follow procedure to make Firefox default browser
After you follow procedure, see if problem persists
If it does one answer, can be seen in this article. Some websites open
IE, even if not the default.
https://support.mozilla.org/en-US/kb/how-make-web-links-open-firefox-default

I set firefox as my default when I installed it

 

[crashhat]

I think it's important to ask: What webpage comes up when IE starts? I have a game launcher that shows news about my game, and when I click to view a specific article, it opens IE (my default is Chrome). The page that comes up may be a clue to what is opening the browser.

Random sites that I have never hear of load up when IE pops up. I think they might even be ads?

 

[richc46]

Download and try this software. It will stop pop ups of ads
https://toolslib.net/downloads/viewdownload/1-adwcleaner/

 

[ThrashZone]

Hi and welcome to SevenForums,
The default opening page for Internet explorer of all versions is msn
Until a user changes it to a new home page,

Definitely run Adwcleaner and post the text scan report,
After doing that refer to some of these,

Clean boot to remove unnecessary items from the Startup section,
http://www.sevenforums.com/tutorials/179159-troubleshoot-application-conflicts-performing-clean-startup.html
Troubleshooting for win-7,
http://www.sevenforums.com/tutorials/220165-troubleshooting-steps-windows-7-a.html

Export Favorites to html file before resetting Internet explorer/ just to be safe.
http://www.sevenforums.com/tutorials/86795-internet-explorer-import-export-favorites.html​

Tutorial of Resetting Internet explorer,
http://www.sevenforums.com/tutorials/1222-internet-explorer-reset.html
Accessing Internet Options from the Start menu search,
Reset process first opening Internet explorer
Manage add-ons applies to all versions of ie,
http://windows.microsoft.com/en-us/internet-explorer/manage-add-ons#ie=ie-10-win-7
http://windows.microsoft.com/en-IN/windows7/How-to-manage-add-ons-in-Internet-Explorer-9
​

 

[crashhat]

# AdwCleaner v4.000 - Report created 19/10/2014 at 20:48:13
# DB v2014-10-19.11
# Updated 12/10/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Berta - BERTA-HP
# Running from : C:\Users\Berta\Downloads\adwcleaner_4.000.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Berta\AppData\Local\Slick Savings
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\Users\Berta\AppData\Roaming\Mozilla\Firefox\Profiles\r11mzr06.default\user.js

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.9

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v32.0.3 (x86 en-US)

[r11mzr06.default] - Line Deleted : user_pref("startpage.ntsearch_url", "hxxp://search.yahoo.com/search?ei=utf-8&fr=spigot-nt-ff&type=0&ilc=12&p={searchTerms}");

*************************

AdwCleaner[R0].txt - [3364 octets] - [19/10/2014 20:45:47]
AdwCleaner[S0].txt - [2971 octets] - [19/10/2014 20:48:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3031 octets] ##########

 

[ThrashZone]

Hi,
Thanks for the update,

Use these free tools to see if they find anything,
Manually Update them before running full scans,
Try not to use your computer while the scans are running, (one at a time of course).
See this tutorial on how to download and run Malwarebytes,
http://www.sevenforums.com/tutorials/338716-malwarebytes-anti-malware-free.html
Also use the Custom scan option not the Threat scan,

Please Do Not clean/ Delete or Remove Any detections before posting the scan results first before review especially Malwarebytes,
http://www.malwarebytes.org/products/malwarebytes_free
SAS is safe to remove anything it finds
http://www.superantispyware.com/?tag=SUPERANTISPYWARE
This one is the longest up to 4 hours, the others are only about 45 minutes,
http://www.microsoft.com/security/scanner/en-us/default.aspx

 

[crashhat]

I did a malware scan of the computer the other day and didn't find anything


UPDATE: It just happened again and a site called reiprovensystem.com loaded up. This is an ad right?

 

[ThrashZone]

Malware scan with what exactly ?

 

[crashhat]

Malware scan with what exactly ?

I used the microsoft malicious software removal tool.

I installed malwarebytes, I did a custum scan and checked every box even the rootkit box and it found 1 non malware item. C:\program files (x86)\openDownloaderManager\wajam_instal.exe

 

[ThrashZone]

From my post #11
Clean boot what were the results,
Click Start and type in the search box
msconfig
Startup section take a screen shot of this page for a complete list,
Repeat for the Services section,
On the bottom left Check the box to Hide All Microsoft services,
See the links above my signature on how to take and upload screen shots here if you need too,
Cheers.

 

[Anak]

Hi everyone!

I'm helping crashhat over here, I don't believe the two problems are related, but I'm not so sure.

In going over the AdwCleaner report there are some items that may continue to cause problems.

• Folder Deleted : C:\Users\Berta\AppData\Local\Slick Savings

• Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extension\mhkaekfpcppmmioggniknbnbdbcigpkk *(this is Slick Savings)*

• [r11mzr06.default] - Line Deleted : user_pref("startpage.ntsearch_url", "hxxp://search.yahoo.com/search?ei=utf-8&fr=spigot-nt-ff&type=0&ilc=12&p={searchTerms}");

Slick Savings and Spigot can be delivered as a combined Potentially unwanted Program (PuP) and even though AdwCleaner removed these items it may not have removed everything. From what I've seen in searching, these two are particularly virulent.

There are steps to follow in order to completely remove both:
Remove Slick Savings virus (Removal Guide)
Remove SearchSettings.exe by Spigot (Virus Removal Guide)

To answer crashhat's last question, reiprovensystem.com is an ad, and from the looks of it, it looks like a ponzi scheme to get one to send money for little in return.

I just saw crashhat's post. wajam_instal.exe is another nastie.

 

[crashhat]

I downloaded hitman pro, duid a scan and it fount 2 things but I had to buy the product to remove the threats so I uninstalled it.

cant I just do a system recovery to remove everything?

 

[PeaB4YouGo]

I downloaded hitman pro, duid a scan and it fount 2 things but I had to buy the product to remove the threats so I uninstalled it.

cant I just do a system recovery to remove everything?

I suppose that depends on how long you've had this issue and how far back any of your backups go...