Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

Question

Malicious URLs!

Oct 19, 2013 10:11AM PDT

Still rockin' good ol' Windows XP, S.P. 3.

Is it a virus, adware, something? All of the sudden I'm being inundated with malicious URLs according to Avast. Each time they're coming from "process: C:\WINDOWS\Explorer.EXE". They pop up and take over the screen with no way out until you hit the Windows key or bring up the task manager and end the process. Sucking up memory and CPU usage, slowing the system down to a crawl sometimes. I've run Avast and even Housecall to see what's up and have found basically nothing. Where's the little ****** coming from?! Thoughts?

Oh, apparently my system can't access Security Essentials, if that has anything to do with it.

Damn, been free from casualties for a decade. Sigh, it's just so sad, I'm a statistic now.

Thanks!

Discussion is locked

- Collapse -
Clarification Request
First, give us some clarification ...
Oct 19, 2013 12:51PM PDT

as to EXACTLY what is happening.

You tell us that - "... I'm being inundated with malicious URLs according to Avast. Each time they're coming from "process: C:\WINDOWS\Explorer.EXE".

HOW are you being told this? Avast normally pops up a red window that says a malicious URL has been blocked and YOU can set its duration (how long it remains on screen) through Avast's SETTINGS (main program window far right just below the X button for closing the interface). Once in Settings click on Popups in the menu down the left side and set how long YOU want each alert to show.

As that alert indicates, the malware on the web site you were going to was BLOCKED so it isn't a problem.

The reason the Explorer.exe process is mentioned is that most likely you are using Internet Explorer ( iexplore.exe ) which is integrated with explorer which is the file manager and also the GUI Interface. Try using a different web browser such as Firefox or Opera.

Something else you SHOULD DO is download and run Malwarebytes and Super Anti-Spyware because much of the malware associated with URLs is not a virus or a worm and your Anti Virus ( Avast or any other ) generally won't catch such malware.

- Collapse -
Clarification...
Oct 19, 2013 1:19PM PDT

Yes, the Avast red window pops up and at any given pop-up, it can keep pinging and pinging counting up quite a few times at any given go. Yes, they are blocked, at least some. I say some because sometimes I'll still get a full screen take over of my screen - but it will be blank, as in perhaps the site was blocked but the full-screen somehow gets through. Then I'll have to go into the task manager and kill the explorer.exe thread and all is well...for a while. These threads can be multiple at a time and up up to 50K of memory usage. If I don't kill them, then I'll get an error report pop-up over some time telling me explorer has crashed. Strange. Before I installed Avast, those full screens would in fact be anything from a screen full of newsfeeds to products now as I said, they are blocked but some still leak through, albeit blank.

I suppose I'll try the Malwarebytes and give it a go.

- Collapse -
Update...
Oct 20, 2013 10:41AM PDT

As you and 'wpgwpg' have stated, I'm doing the whole Malwarebytes and SUPER AntiSpyware scans. So far SUPER has found a couple Trojans that've been cleaned out, but damn if those full-screen pop-ups aren't still coming! As said before, since they have been blocked by Avast, they're coming up, "This program cannot display the webpage," but nonetheless they are still just as annoying. And I'm still getting the explorer errors/close program pop-ups also. Woo-hoo!

I guess my next step will be to do the scans in safe-mode but I guess I don't understand why that'll give any different results than what I'm getting now. Maybe it will. Mercifully.

Oh, if and when I get rid of this BS, will my system be back to its old perky self or will I have to do a complete re-install anyway?

- Collapse -
The scans should help get things back to normal ...
Oct 21, 2013 3:10PM PDT

and the reason for doing the scans in Safe Mode is that only necessary drivers and processes are usually loaded.

You might even want to download RKILL and run it from Safe Mode BEFORE running the two anti-malware utilities. RKILL is designed to shut down unnecessary and suspicious processes that don't even necessarily show up in task manager.

Here is a link that tells about it and how to use it and download it:
http://www.bleepingcomputer.com/download/rkill/

On that page be sure you also click this link and read through it for a better understanding:
RKill - What it does and What it Doesn't - A brief introduction to the program

Now, having said that it also sounds like you might be looking as some risque sites that are known to program interminable pop-up browser windows. That is fixed by avoiding the sites and shutting down all scripting in your browser.

- Collapse -
All is well, almost...
Oct 25, 2013 12:38AM PDT

I'd like to think I know how all this started to infect my computer, but, I got nothin'. No risque sites, no questionable downloads, no nothin'. Fact remains, it has happened. So sad.

Turns out, it was a root-kit gumming up the works. Woo-hoo! Had to do the rkill and a ton of other stuff to get this damn thing out of the system.

All seems normal, however, my computer is now far more sluggish than it has ever been. Before this happened I was zipping along but now it takes a few seconds for the computer to respond and get to where it's going.

Disease cured but the damage remains? Any thoughts on how to get that zip back in the works? After all this BS, I'm thinking about doing a whole reinstall but would really really really prefer not having to do that.

Thoughts?

- Collapse -
Answer
Some things you can do
Oct 19, 2013 10:34AM PDT