Empty windows appearing - why?

[Keygrip]

My computer sits humming away, 24 hours a day, 7 days a week - it has a DSL service plugged into the back and checks for e-mails every 5 minutes.

Couple of days ago I felt things were running slowly, yesterday, when I tried to reply to an e-mail, I got a message saying "Insufficient Memory". I turned the machine off - and back on again.

Now I keep getting dozens (and I mean - dozens) of empty windows appearing, with the line

http://vbs.searchwww.com/vbs.cgi - Microsoft Internet Explorer

<<edit: the whole line appears in the title, including the Microsoft reference. The Pprune software has made part of my typing into a hyperlink (that goes to an equally empty window)>>

in the title bar of the window. Nothing else - just that one line of text and an empty window.

Ideas?

System restore maybe?

Windows XP Pro.

[Keef]

Virus, perhaps? Or some evil bit of spyware?

I don't recognise that address, and I'm not about to click on it if it might be another one of the nasties...

Does the machine do it if you don't launch Internet Explorer?

Try downloading and installing Firefox - a different (and better) browser.

[Keygrip]

Have run Norton, have run Adaware/Spybot - Norton came up empty (as it runs twice a week anyway), Spybot found a bunch but killed 'em all.

The window thingies do come up with IE running - just with Outlook Express running.

When the Pprune software made the link from the address I wrote in the message I clicked it - took me to an empty window.

System restore next - see what happens.

Still open to suggestions though.

[BOAC]

Typing vbs.searchwww.com into Google takes me to a commercial search web page so I guess you have been 'hijacked'!

Typing vbs.searchwww into Google takes you to 2 pages of people with the same problem!

This may help?

[E-Liam]

Hi Keygrip,

Happy hunting...

http://www.doxdesk.com/parasite/SearchWWW.html

Cheers

Liam

---------------------------------------------------------------------------------
A member of the Alliance of Security Analysis Professionals since 2004.

[Memetic]

Clicking the link to http://vbs.searchwww.com/vbs.cgi (From the relative safety of my Linux machine ) brings up a "blank" browser window which contains this call to a java script:

Code:

<script language="JavaScript" src="http://pop.mircx.com/pop/search/script/10876407159388">
</script>

visiting mircx.com takes you to a site offering to shorten long urls so the string of digits here it points to the malware described in the post from Liam. Follow the removal advice in his post.

Then beware of activeX downloads!

Oh and if you have not already visit http://windowsupdate.microsoft.com

Have fun!

Memetic

[Keygrip]

Thanks for the answers guys - I'm still working on it.

I've found some of the stuff - struggling with the rest.

The link from BOAC takes me to a chat between a bunch of people who know what they are talking about (I'm not qualified to enter the conversation on this topic).

The mail from Liam is more productive - but has an edge of geekspeak about it. I'm waiting for a tame geek to stumble by and do the deed.

I'll let you know how it goes - thanks again for the advice.

[Bern Oulli]

E-Liam. Thanks for that link - I went there out of idle curiosity and discovered I had Internet Washer without knowing it.

[Keygrip]

All sorted - thank you very much, one and all.