Thread: Automatic popup windows in IE

I think I have some spyware on my computer. Every time I open IE and load up a page, any page, another IE window pops up and quickly closes. What causes this to happen? Is there a relevant part of the registry I can look at to get rid of this problem?

Have you tried ad-aware benny?

Yes I know I could do that but naturally as a programmer I would like to know what's going on underneath the hood. Of course, Windows and IE are so stupidly complex that something simple like this isn't obvious. I'll bet Mozilla and Firefox don't have these problems.

Yes, HijackThis is a good tool for detecting malware.

Basically it works by scanning certain areas of your system Registry and other area where bad things are known to lurk.

But there's a warning - much of what it lists is either harmless or essential to the running of your system, so you really have to know what you're doing in order to know what to remove!

Some of the latest variants of a particular parasite known as CoolWebSearch (CWS) are especially difficult to remove, and cannot be removed using HijackThis alone.

They work by installing a "super-hidden" DLL file, which is loaded on WinXP systems with very strange permissions. This causes it to become invisible within Windows. But it can still be executed, and it will create a randomly-named BHO along with all the usual search / home page hijackings. Fix these and the randomly-named BHO only gives a few hours relief at best because the "super-hidden" DLL, the primary infection if you like, is still at large.

Another trick it uses is to add a new 'service' - visible in the services.msc functionality. Look for one called Network Security Services or one with a random, non-English characters in its name, and if present, disable it.

But before getting this agressive, try this. Download a little utility called CWShredder from my mirror here: www.angmail.fsnet.co.uk/angoid/CWShredder.exe. Save it to your Desktop. It was written by Merijn, the same Merijn of HijackThis fame.

Close ALL applications down, including and especially browser windows and Explorer windows, then run CWShredder. Let it run its course. When it has finished, you must reboot your system.

As an aside, make sure you're using Ad-Aware SE (6.181 is now out-of-date) and Spybot S&D version 1.3 (1.2 is no longer being maintained).

Here are some good forums where HijackThis logs are routinely analysed: Go here if you are still having problems or if you disabled the service mentioned previously.

www.spywareinfo.com (may be inaccessible due to an ongoing DDoS attack)
www.tomcoyote.org
www.suggestafix.com - under Viruses and Malicious Code

plus others.

As I often do, and in particular when dealing with threads on a subject like this, I would advise caution downloading and running an unknown .exe.