New windows opening on their own!

[RobinC]

I think that I've obtained a virus of some description as new windows keep opening of their own accord. I have got AVG and am running a scan on my computer but can't think why this is happening as I haven't been to any websites which have been flagged as dangerous.

[RobinC]

I've just done a scan which has finished and has stated that there is no infection on the computer.

[Geoff Wycherley]

Are you using a wirless keyboard and mouse?
A couple of weeks ago I had a problem with the drop down menus appearing for no accord, and some pages appearing. After following the normal methods of what the problem could be trying an old keyboard and mouse (cable type) it turned out it was a fault on the keyboard it must have been transmitting a faulty signal. Replaced the keyboard and mouse with new one and have had no problems since.

Just a thought

[RobinC]

Thanks for your reply, Geoff.

I should have put that I am using a laptop so hopefully the keyboard isn't a problem as the windows open sporadically.

[Peter Goodey]

Windows associated with what program? Internet Explorer windows (I bet you're using MS Windows)? Spreadsheet windows? Windows Explorer windows?

[RobinC]

Windows associated with what program? Internet Explorer windows (I bet you're using MS Windows)? Spreadsheet windows? Windows Explorer windows?

Sorry Peter,

I mean Windows Explorer windows.

[Peter Goodey]

I mean Windows Explorer windows.

That is weird. You do mean Windows Explorer which is the file manager and not Internet Explorer which is an internet browser?

[MarkJ]

I would download and run a malware remover, such as Lavasofts Ad-Aware or Spybot S&D. Not all malware is viruses or trojans - and some of the other problems are not always detected by anti virus software.

Do these "windows" contain anything - websites or DOS commands for example? If they are just the Windows Explorer windows, then I would suspect a sticking key or something, but if they are Internet Explorer windows (the browser) and contain websites which are opening without your control, then run one - or both if you like - of the programs I mentioned.
Be careful to ensure you download the correct programs - there are some fake, similarly named files out there which will not do the job and probably actually cause more problems!

Mark

[RobinC]

I mean Windows Internet Explorer and as Mark says, the windows contain websites which are opening without my control. I have downloaded a program called Malwarebytes which also ran a scan and appears to have done the trick as it found 3 infected objects.

I searched "internet windows keep opening" and someone suggested Malwarebytes in the answers to a query by someone who had the same problem.

[MarkJ]

Ideal. Malwarebytes is in the same sort of role as Ad-Aware, Spybot S&D, Spyware Blaster etc. They are excellent additions to any Windows users armoury and will usually pick up and remove stuff which an AV program doesn't. The good thing is that they can be added alongside your AV program (running two AV programs on a computer is not a good idea) - in fact, you can install these spyware removal tools side by side if you so desire without issues (certainly Spybot S&D and Ad-Aware run happily together and one will often pick up a bit of junk the other misses!)

The main thing is that the junk is hopefully gone :)

Mark

[RobinC]

Hello,

For some reason when I search for something on google, I often get re-directed to pages selling medication or web hosting.

Malwarebytes hasn't found anything but there must be something causing this?

I thought I'd better post this here as it might be connected.

[MarkJ]

Wonder if your previous problem had altered either your Hosts file or your DNS Server entry?

Both of those are known activities of various malware. I would check your DNS settings are those which your ISP (or yourself) recommend first as that is nice and easy. If all seems well, then you need to look at the Hosts file (which can be found in various places, depending on the version of Windows you have, but most likely in system32\drivers\etc, which is in the root Windows folder

Mark

[RobinC]

Thank you for replying so promptly, Mark.

I'm a complete novice when it comes to computers so I'm not sure how to check my DNS settings.

[MarkJ]

Assuming you are using Windows,

Start > Control Panel > Network Connections

In Network Connections, choose your local connection and then select Properties, then choose Internet Protocol (TCP/IP) and again, select Properties.

You will now be looking at a box which has two "radio" buttons at the top - one says "Obtain and IP address automatically" the other allows you to enter your own settings. Firstly, check that either the "Obtain Automatically" button is checked or that the settings in the second box are correct if that one is checked.

Now, further down you will see the DNS server settings. Again, these will either be "Obtain DNS Server address automatically" or "Use the following DNS Server address"
This is the setting most likely to have been changed. You will need to know the DNS server settings which your ISP provided you with when you joined them (assuming you use the ISPs standard DNS server). They will have given you the info regarding your DNS server, so use their details if you have them. If not, then there are a number of options - you can obtain the details from the ISPs website or use an alternative DNS server (there are plenty of free ones out there, but they all have their pros and cons)

Basically, what the DNS server does is to convert your website requests - e.g google.com (with the www. bit in front) - to the numerical value used by the internet (the so called IP address, a series of numbers seperated by dots e.g 192.168.0.1)
When you enter your www. address, your browser first checks to see if the site is mentioned in your Hosts file and, if it is, it can get the IP address from there which is quicker. Otherwise, it uses the DNS server to look up the IP address for the site you want. This is a simplified version of course - you also have cache etc involved, but for a basic explanation, it is OK.

The Hosts file usually doesn't contain much - in most cases it will be just a very simple entry or two. You should have

127.0.0.1 localhost

or something similar. Nothing else should be there as a rule - so if you see other entries, let me know.

Mark

[RobinC]

Mark,

I'm using Windows Vista.

The IP and DNS are both on "Obtain automatically" (so I haven't touched them), the second box of each is empty.

As for the Hosts file, I have the following listed:

127.0.0.1 localhost
::1 localhost
91.215.180.170 www.british-genealogy.com

I put the Brit-Gen listing in there due to having trouble getting on here.

[MarkJ]

OK, at least that seems fine. The localhost entries (the first is IPv4, the second IPv6, but you don't need to worry about that!) are perfectly normal. The IP for Brit-Gen was because of the access issues the other day - again, no problem.

The only other easy thing I can suggest for now is to update your AV program and re-run both that and your Malwarebytes to see if they can find an issue. There could be something still left behind.

It is worth just keeping an eye on when the problem occurs - some DNS servers will direct you to a page which can include "offers" etc if the website you are looking for is not available for some reason. However, those sites usually state that they are being displayed because the website you requested was not available.

Mark

[RobinC]

some DNS servers will direct you to a page which can include "offers" etc if the website you are looking for is not available for some reason. However, those sites usually state that they are being displayed because the website you requested was not available.

That's exactly what seems to be happening, I thought that the standard "Page 404 not found" would be displayed though?

[MarkJ]

Ah, it varies, depending on how your ISP has set up the DNS server and other factors. They may have decided to earn some cash by popping up ads on the "Page Not Found" page - amazingly, some folks do actually click on ads which appear on their screen. You could use another DNS server, but these things are going to happen (unless you are really, really keen and actually decide to set up your own DNS server...!)
A 404 error would be displayed for example if you tried to go to a page on my server which doesn't exist - my server would send that. But if you mistyped the address for my server, then the reply will come from your ISPs DNS server.

Try this -

My server is at www.kernowyon.co.uk
There isn't a page at www.kernowyon.co.uk/nothing

If you go to the /nothing page, you should get a 404 error

Now, if you had mis-spelled my address and plonked in -

www.kernoyon.co.uk

you should get whatever your DNS server decides to send you. In my case, it was

Address Not Found


www.kernoyon.co.uk could not be found. Please check the name and try again.
The browser could not find the host server for the provided address.




* Did you make a mistake when typing the domain? (e.g. "ww.mozilla.org" instead of

"www.mozilla.org")


* Are you certain this domain address exists? Its registration may have expired.


* Are you unable to browse other sites? Check your network connection and DNS server settings.


* Is your computer or network protected by a firewall or proxy? Incorrect settings can interfere with Web browsing.

[RobinC]

When I clicked on www.kernoyon.co.uk, I got:

"Oops! Internet Explorer could not find www.kernoyon.co.uk
Suggestions:
•Go to www.*kernowyon.*co.*uk
•Go to kernowyon.*com
•Go to www.*kernowyon.*org.*uk
•Search on Google:"

In this morning's case, I searched Google for 32 inch tvs and tried to click a link to Amazon, which is where the page diverted, however I found Amazon on my favourites list and the page opened as normal when I searched for 32 inch tvs.

My computer is protected by Windows firewall.

[MarkJ]

Have you tried clearing your cache? It is possible that whilst your PC was infected you were being redirected to other sites when attempting to access a site. If we say that perhaps you tried to access Amazon whilst you had the problem, then you would be sent to some dodgy site or other and that would be cached as the Amazon site perhaps. Then, once the problem was removed, you attempt to go to Amazon, and your computer looks in the cache, finds "Amazon" (the dodgy site version) and uses that as the site.

Clear the Internet cache and see if that sorts things. That is under the tools menu on your Internet Explorer browser. Look for Internet Options, then under the General Tab, locate Temporary Internet Files and click the Delete Files button.

Mark

[RobinC]

Thanks Mark,

I've done that now and will let you know if the problem persists.