johnb123 Posted December 5, 2009 ID:166786 Share Posted December 5, 2009 HiCan anybody help, running xp home, When I open IE8 and start typing into Google or going to one of my favourites several more IE8's open, on their own, on Google my home page. Running fsecure internet 2010. Scaned for virus using herc scan, ran malware on full scan even tried windows fix which took hours. All returned no problems. Tried firefox still same happens.Any ideas Link to post Share on other sites More sharing options...
mountaintree16 Posted December 5, 2009 ID:166787 Share Posted December 5, 2009 Hi John and welcome to the forums here Are you getting advertisements or just regular, multiple windows open at once?Please try a quick scan of Malwarebytes, as this is the recommended scan method in most cases.At any rate, you could be infected, I don't know that for sure though. You may want to have your system checked to make sure its not infected.Please read the following:We don't work on Malware removal in the general forums.Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.One of the expert helpers there will give you one-on-one assistance when one becomes available.Also, as a side note, please use the "Add reply" button at the bottom of the page or erase what the person before you said, as this makes the forum easier to read.Thank you! Link to post Share on other sites More sharing options...
johnb123 Posted December 5, 2009 Author ID:166818 Share Posted December 5, 2009 Hi Do not know full protocols yet but thanks for help so far, BTW just multipal windows of my home page Link to post Share on other sites More sharing options...
mountaintree16 Posted December 5, 2009 ID:166829 Share Posted December 5, 2009 You're welcome Full protocols for what, specifically?Well, that's a good sign that its not advertisements at least. It may or may not be a malware issue, but I don't really know either way. Maybe there is a setting in Internet Explorer that is wrong. If that's the case, hopefully someone can jump in here and advise you on that. I don't really know much about those sorts of things (at least not yet) unfortunately.It would be best for you to do what I told you in my first post and post in the forum. Just do as much as you are able to do Link to post Share on other sites More sharing options...
johnb123 Posted December 29, 2009 Author ID:177017 Share Posted December 29, 2009 HiNobody has answered yet but it apears to be a problem with a file called atapi.sys which may or may not be a problem. Causes redirects too which oter members seem to be having problems with. Fsecure are now on the case Link to post Share on other sites More sharing options...
noknojon Posted December 30, 2009 ID:177116 Share Posted December 30, 2009 Hp johnb123 -I think you are getting redirected due to lnfections - Please follow the directions underlined in Blue by mountaintree16 in post #2 above -Good luck - Link to post Share on other sites More sharing options...
johnb123 Posted December 30, 2009 Author ID:177365 Share Posted December 30, 2009 Hi Already done that 5th dec no replies and post has vanished from forum. Just thought would mention problems with redirects and atapi.sys. May help sombody. Also could be somthing called ckickjacking, look up on google, easier than explaining. Done all tests and scans includind mal, fsecure, autorun, hijack this all negative. Only program that picks up anything is gmer which first off freezes pc at device\ntpnp_pc10014, excluded devices ran scan again and it stopped at c:\windows\system 32\drivers\atapi.sys which it said was suspisious. File before the atapi was .txt c:\program files\workspace macro pro 6.0\wmphotkeys.exe. fsecure are on the job now, just adding this as it may help others. Link to post Share on other sites More sharing options...
mountaintree16 Posted December 30, 2009 ID:177371 Share Posted December 30, 2009 @ johnb123Please see extremeboy's post here: http://www.malwarebytes.org/forums/index.p...st&p=175128(And his post right above that one)You may PM him to request re-opening of your post if you'd like to go forth with removal, and I recommend that you do.And I'll reply to your PM soon. Been busy Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now