Adware opening browser with random urls

If by chance you don't have any anti-virus you can download a trial version of norton anti-virus at www.cnet.com. That always works for me.

The reason why most of these sites ask for those logs is to have a better overview of what files/folders you have and what's created recently. Although antivirus and antispyware help remove these malware, it's never able to detect 100% of all malware infected files.

If you still don't want to use other third party tools and post logs here, then I suggest providing more details like what site it's displaying and the name of the exe file(s).

I recommend running a secondary online virus scan since these may catch other things that your main antivirus have missed. You can use the Panda ActiveScan. It won't remove the infections for the free scan, but will tell you where the possible infections are and you can always remove it manually.

download a program called malwarebytes from download.com. its free and is the BEST app i have ever used to remove adware and spyware like you are suffering from. During the install perform the database update and run a full system scan. remove anything it finds. it does have a purchase button but it is still free.

This is from my further investigations:

1. It seems like the virus entered into my system by a USB drive having autorun.inf and after searching a lot i found that its called as recycler virus and still there is no permanent solution for it, there is a utility called flash disinfector available for free that just creates a files within USB drive to stop spreading this virus. but doesn't remove that virus even.

Ok regarding the actual question I posted I found the following on my machine:
1. there is a recycler folder in my c:, which contains some files but windows doesn't explore them even if I have settings to show all hidden files, on my systems the folder under recycler are having icon as recycle bin.
2. I tried to explore that folder using Winrar, and I could see all the files and folder in the recycler folder, but even in safe mode widows doesn't allow me to delete files under there.
3. So tried to navigate through registry to see if there is any file running form this location on startup or so, I found one entry with name as "Taskman" under

HEKY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON

but If i delete this entry in safe mode it reappears instantly even before closing the registry editor.

So this is all outcome.

Wellington, I already tried Malwarebytes , it also doesn't detects this. :(

Can you attach the Hijackthis log.

sry forgot to mention file names in last post:

the path is something like c:\recycler\<some random no.> [like outlook express generates for its identity folder]
and files under that are:
desktop.ini
MsMxEng.exe

I always keep creating and posting those hijack logs as my last option. If I cant find a solution in next 24 hrs then I will post that out.

No Prob's . No hurries for Hijackthis Log.

There few areas were you need to go through .
1.       Disable the  autorun of your server
2.       Check on schedule task whether any  strange task is running or not
3.       Check your Host file entries.
4.       Clear the temp files.

- disabled autorun
- checked scheduled task  none was suspicious still deleted all.
- Checke dhost file entries, all are ok.
- cleaned all temp files manaully and using ccleaner both.

What next..?

Which AV your using on your file server .?

I was having Symantec End Point protection, but after this problem I also tried trial version of Kaspersky AV for Server (6.0)

If you're going to post a logfile you're better off posting logfile from an OTL log. Let us know if you want to scan with OTL.

Hijackthis is not a very reliable diagnostic tool these days anymore.
TrendMicro hasn't done much improvements with their Hijackthis and a lot of nasties can now hide from the Hijackthis scan.

Did Kaspersky detect it?


Without any logs, it's hard to know exactly what files and registry entries are created with this infection as there are many infections and many variants that create the files you mentioned.

Could be this one for example:
http://www.bitdefender.com/VIRUS-1000544-en--Worm.P2P.Palevo.J.html

Or PWS-ZBot:
http://vil.nai.com/vil/content/v_143802.htm

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman"
Data: %Root%\RECYCLER\S-1-5-21-4616592079-8080907928-828616482-2104\[Filename].exe
The following file is added to the root of the drive:

Autorun.inf A folder is created with a directory name similar to the below:
%Root%\Temp[random numeral]Within this directory, the following files may be added:
Dekstop.ini [Filename similar to valid Windows
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\Taskman=]
C:\RECYCLER\S-1-5-21-1152485846-8946450785-746063897-9927\MSMXENG.EXE

Did you try to run Updated SEP one safe Mode. Hope it has to pick some.

neither kaspersky nor SEP detects in either normal or safe mode.. :( have already tried these in last 3-4 days itself.

Try Combofix and show us the log.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
 
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Use these utils/monitors to see if they help
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx Process explorer
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx Autoruns
http://majorgeeks.com/Active_Ports_d682.html Active ports

Be careful with autoruns as you can delete entries as well as a viewer, which if you delete something that you're not supposed to can lead to serious consequences