Default browser is firefox but IE opens

[dodger741]

I am running win2000 - don't laugh. When I click on a link in Eudora or on some links in a web page, Firefox opens (Firefox/2.0.0.17) then IE opens (v6.02800.1106). Most times IE opens to about:blank but on one secure site when I clicked on a link IE opened to the login page wanting the user name a password again. Firefox is my default browser, the file types all point to firefox. My search for similiar problems and solutions found a solution of running a cleaning program called combofix had helped. I did run this but still have the problem. I can supply the log if useful. Don't know if this is a browser issue or a virus problem. Using trendmicro for virus protection.

[AnnMarie]

Ok, post the ComboFix log and I'll look at it for you.

[dodger741]

AnnMarie: Thanks for your interest in my problem. Following is the combofix log.

ComboFix 08-10-19.04 - roger 10/21/2008 15:09:18.1 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.521 [GMT -8:00]
Running from: C:\Documents and Settings\roger\My Documents\All Downloads\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\system32\Cache
C:\WINNT\system32\mdm.exe
C:\WINNT\t\
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((( Files Created from 2008-09-21 to 2008-10-21 )))))))))))))))))))))))))))))))
.

2008-10-02 15:43 . 08-10-02 17:23 <DIR> d-------- C:\Documents and Settings\roger\.housecall6.6

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-10-18 19:16 --------- d-----w C:\Program Files\QUICKEN
2008-09-15 21:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-21 03:16 278,742 ----a-w C:\WINNT\SpectraPLUS Uninstaller.exe
2008-08-21 03:16 --------- d-----w C:\Program Files\SpectraPLUS
2005-09-24 04:19 271 ---h--w C:\Program Files\desktop.ini
2005-09-24 04:19 21,952 ---h--w C:\Program Files\folder.htt
1999-12-07 12:00 32,528 ----a-w C:\WINNT\inf\wbfirdma.sys
.

------- Sigcheck -------

05-03-21 15:13 11264 ab176f2171db704d51b8809e8a5c38bd C:\WINNT\system32\CTFMON.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="ctfmon.exe" [05-03-21 15:13 11264 C:\WINNT\system32\CTFMON.EXE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\RunOnce]
"FlashPlayerUpdate"="C:\WINNT\system32\Macromed\Fl ash\NPSWF32_FlashUtil.exe" [07-03-27 15:04 190696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"NvCplDaemon"="C:\WINNT\system32\NvCpl.dll" [05-08-02 15:35 7110656]
"NvMediaCenter"="C:\WINNT\system32\NvMcTray.dl l" [05-08-02 15:35 86016]
"DU Meter"="C:\Program Files\DU Meter\DUMeter.exe" [05-02-01 19:28 1469952]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [06-12-28 22:52 3429904]
"nwiz"="nwiz.exe" [05-08-02 15:35 1519616 C:\WINNT\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [07-04-16 15:28 577536 C:\WINNT\soundman.exe]
"Synchronization Manager"="mobsync.exe" [03-06-19 11:05 111376 C:\WINNT\system32\mobsync.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [03-06-19 11:05 186640]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 28672]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2003-04-05 147456]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "C:\Program Files\Qualcomm\Eudora\EuShlExt.dll" [05-11-14 16:15 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"vidc.mpg4"= C:\WINNT\mpg4c32.dll
"vidc.mpg2"= C:\WINNT\mpg4c32.dll
"vidc.mpg3"= C:\WINNT\mpg4c32.dll
"vidc.GEOX"= C:\WINNT\system32\GeoCodec.dll

R2 LcSvrAdm;ELSA Administration Service;C:\ElsaWin\bin\LcSvrAdm.exe [06-03-20 13:34 147456]
R2 LcSvrDba;ELSA DBA Server;C:\ElsaWin\bin\LcSvrDba.exe [06-03-20 13:16 233472]
R2 LcSvrHis;ELSA Historie Server;C:\ElsaWin\bin\LcSvrHis.exe [06-03-20 13:28 217088]
R2 LcSvrPAS;ELSA PASS Server;C:\ElsaWin\bin\LcSvrPas.exe [06-03-20 13:17 368640]
R2 VSGate;ELSA Vaudis Service;C:\ElsaWin\bin\VSgate.exe [06-03-20 13:53 81920]
R3 LcSvrAuf;ELSA Auftragsverwaltungs Service;C:\ElsaWin\bin\LcSvrAuf.exe [06-03-20 13:23 1302528]
R3 openhci;Microsoft USB Open Host Controller Driver;C:\WINNT\system32\DRIVERS\openhci.sys [03-06-19 11:05 24784]
R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys [03-06-19 11:05 49776]
S1 gemwdm;AMD PowerNow! (tm) Technology;C:\WINNT\system32\DRIVERS\gemwdm.sys [03-07-21 09:28 11776]
S3 AMDMSRIO;AMDMSRIO;C:\DOCUME~1\ADMINI~1\LOCALS~1\Te mp\{55638DD9-D5A9-11D3-B74B-204C4F4F5020}\AMDMSRIO.sys [ ]
S3 RushTopDevice;RushTopDevice;C:\Program Files\MSI\Core Center\RushTop.sys [ ]
S3 yukonw2k;NDIS5 Miniport Driver for Marvell Yukon Ethernet Controller;C:\WINNT\system32\DRIVERS\yk50x86.sys [05-09-19 08:41 240384]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2005-10-23 C:\WINNT\Tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1130048379.job
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [03-04-05 23:52 ]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\roger\Application Data\Mozilla\Firefox\Profiles\2g9ruret.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
.

************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 15:12:14
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2008-10-21 15:14:51
ComboFix-quarantined-files.txt 2008-10-21 23:14:49

Pre-Run: 219,326,943,232 bytes free
Post-Run: 220,495,122,432 bytes free

101

[AnnMarie]

There is no malware in that log and ComboFix has removed some valid files.

Download The Avenger from here to your Desktop and unzip it.

Open notepad and copy and paste all the text in the codebox below into it. Save the file as AvScript.txt

Files to move:
C:\Qoobox\Quarantine\C\WINNT\system32\mdm.exe.vir|C:\WINNT\system32\mdm.exe
C:\Qoobox\Quarantine\C\WINNT\Web\default.htt.vir|C:\WINNT\Web\default.htt

Start The Avenger by opening the Avenger folder and doubleclicking on Avenger.exe. Click on Load Script from File (Folder Icon) in the top lefthand corner and open AvScript.txt. Your script should appear in the dialogue box.

Next, put a checkmark next to "Scan for Rootkits" but make sure that "Automatically Disable Any Rootkit Found" is unchecked for now. We may use this option later on if a malicious file is found.

Click on the Execute button and click Yes when you are asked if you are sure you want to execute this script. Click Yes when you are asked if you want to reboot now. The Avenger will restart your computer.

When you have rebooted, a logfile will open that has recorded all the actions that The Avenger performed (this log file is saved to C:\avenger.txt). The deleted files will be backed up and saved to C:\avenger\backup.zip.

Once your computer has rebooted, please post back the contents of C:\avenger.txt.

Also go here and read about some apps being hard coded to use IE. When you have done this, scroll down to the instructions on how to force Firefox to set itself as default (make sure that Firefox is closed when you run the command).

Let us know if this helped.

[dodger741]

AnnMarie:
When I clicked on the "download avenger here" the link didn't work. If I copy and past the link to a new window it works. Maybe this is related to my problem although IE didn't open.

Moving the default.htt.vir file didn't work because the Avenger file path only has 1 WINNT in it. I can copy it to the directory if you like or correct the script. Thought I should ask first.

I have previously gone through the manual setting of the browser instructions. I was going to use the 3rd party tool "DefaultBrowser" but it said it was only for XP. The link to the other tool seemed to be broken. I checked my file type settings and have included them below:
URL: Internet Shortcup open = rundll32.exe shdocvw.dll,OpenURL %l (note displays IE image as extensions icon)

N/A URL:CallTo Protocol open = rundll32.exe msconf.dll,CallToProtocolHandler %l
N/A URL:File Protocol open = "C:\Program Files\Mozilla Firefox\firefox.exe" %1(note displays IE image as extensions icon)
N/A URL:File Transfer Protocol open = C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
N/A URL:Gopher Protocol open = C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
N/A URL:HyperText Protocol open = C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
N/A URL:HyperText Protocol with Privacy open = C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
N/A URL:LDAP Protocol open = "C:\Program Files\Outlook Express\wab.exe" /ldap:%1
N/A URL:MailTo Protocol open = C:\PROGRA~1\Qualcomm\Eudora\Eudora.exe /m %1
N/A URL:News Protocol open = "C:\Program Files\Outlook Express\msimn.exe" /newsurl:%1
N/A URL:NNTP Protocol open = "C:\Program Files\Outlook Express\msimn.exe" /newsurl:%1
N/A URL:RLogin Protocol open = rundll32.exe url.dll,TelnetProtocolHandler %l
N/A URL:Snews Protocol open = "C:\Program Files\Outlook Express\msimn.exe" /newsurl:%1
N/A URL:Telnet Protocol open = rundll32.exe url.dll,TelnetProtocolHandler %l
N/A URL:TN3270 Protocol open = rundll32.exe url.dll,TelnetProtocolHandler %l

HTA HTML Application open = C:\WINNT\system32\mshta.exe "%1" %*
HTC HTC File edit = C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE "%1"
HTM Firefox Document open = C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
HTML Firefox Document open = C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -requestPending -osint -url "%1"
HTT HyperText Template edit = C:\PROGRA~1\MICROS~2\OFFICE11\FRONTPG.EXE "%1"
HTW HTML Document open = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
HTX Internet Database Connector edit = "C:\Program Files\Microsoft Office\OFFICE11\FRONTPG.EXE" "%1"

The Avenger Log is as Follows:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows 2000

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File move operation "C:\Qoobox\Quarantine\C\WINNT\system32\mdm.exe.vir |C:\WINNT\system32\mdm.exe" completed successfully.
File move operation "C:\Qoobox\Quarantine\C\WINNT\WINNT\Web\default.ht t.vir|C:\WINNT\Web\default.htt" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.

[AnnMarie]

Moving the default.htt.vir file didn't work because the Avenger file path only has 1 WINNT in it. I can copy it to the directory if you like or correct the script. Thought I should ask first.

Yes my bad. Sorry about that dodger741. I have fixed the script so just run it again.

I was referring to the below instructions:

Force Firefox to make itself the default

If Firefox already thinks that it is default, exit Firefox completely, go to "Start Menu -> Run" and enter this into the text box:

firefox.exe -silent -setDefaultBrowser

Have you tried this?

[dodger741]

I ran avenger again with the modified script, log follows. I did run the set default command with no effect on my problem. The avenger log had an error on the first file but I think it is because it moved it last time.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows 2000

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\Qoobox\Quarantine\C\WINNT\system32\mdm.exe.vir " not found!
File move operation "C:\Qoobox\Quarantine\C\WINNT\system32\mdm.exe.vir |C:\WINNT\system32\mdm.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File move operation "C:\Qoobox\Quarantine\C\WINNT\Web\default.htt.vir| C:\WINNT\Web\default.htt" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

[AnnMarie]

Yes those files have been successfully restored now. I dont recommend that you keep ComboFix. Go to Start > Run and type:

ComboFix /u

and click OK. This will uninstall it.

Various versions of Firefox have had various bugs which have been fixed in later releases. If I were you, I would be inclined to start over. Have you tried downloading the latest version of Firefox, uninstalling the version you have and rebooting.

Make IE your default now and reboot to make sure the changes are registered. Next, install Firefox 3 and set it as default. Reboot one more time and let me know if this made any difference.

[dodger741]

Well, its different. I uninstalled combo, uninstalled firefox and just to be sure I set IE to my default browser via IE. Rebooted and thought I would experiment with IE before downloading firefox and installing. What I found was that IE would not open when trying to launch it via clicking on a shortcut link that happened to be in an email I had received. Then downloaded firefox and installed. Tryed the same thing and everything looked good. Walah... must be fixed. Then I tried using my quicken to download my latest transactions and had a similiar problem as before. The thing that drove me nuts with my original problem was that when trying to download my quicken transactions it would go along and when I clicked download, it would open up explorer and ask me to log in again. When I did it would eventually work but I had to set the dates manually for my downloads - a real pain. Well now it is different. When I click the final step in the process to download as before, it doesn't open IE but rather does nothing. Kind of like IE acted when I after the uninstall of firefox but before the reinstall. To me it sounds like it is trying to do the same thing (open IE) but it doesn't work because of the new problem - links don't respond in IE.

[AnnMarie]

Try this. Close IE and go to Start > Run and run the following commands one after the other and hit Enter after each line.

regsvr32 shdocvw.dll
regsvr32 urlmon.dll
regsvr32 comcat.dll
regsvr32 actxprxy.dll
regsvr32 Shell32.dll
regsvr32 Oleaut32.dll
regsvr32 Mshtml.dll
regsvr32 jscript.dll
regsvr32 vbscript.dll

Run each line individually. After each run, you should see a short message stating the command was successful. Now reboot and let me know if IE can open from links now.

[dodger741]

Ran the commands and rebooted. Had to set IE as default browser. Clicking on link in my Eudora did nothing when IE not already running. With EI running at my home page, clicking the Eudora link redirects IE as expected. When viewing cybertechhelp.com and clicking on say the "subscription" link on this display page it opens a new window to display the info, not a new tab.

[AnnMarie]

? IE6 doesnt support tabbed browing unless you are using a toolbar. If so, sorry but I cant help with addons and I cant help with Eudora issues either. I dont have this software and have never used it. Are you still having problems with IE opening links on web pages?

[dodger741]

Remember that my original problem was using firefox and having IE open. I am using IE now and still having problems with it working correctly which leads me to think it is somehow the culprit. Here is an example.

I created a shortcut on my deskto pointing to http://www.cybertechhelp.com/ . With IE closed and clicking the shortcut I get a windows box which says "Program not found box saying "Windows cannot find IEXPLO~1.EXE This program is needed for opening files of type 'URL:HyperText Transfer Protocol with Privacy" Choices are ok, cancel and locate. When I do the locate and point it at C:\WINNT\system32\dllcache (where iexplore.exe) is located, it says it can't find it. Now opening IE to my home page and clicking the desktop shortcut, it redirects IE to the correct page.

Another example when I am in Quicken and loged in to securly transfer my transactions, clicking on a link which is https://www.netteller.com/x/hbAccoun...tName=Checking works but clicking on a link https://www.netteller.com/x/DeliverC...57b61921%2EQFX causes another EI browser to open at the login page. Now you might say this is a Quicken problem but I don't think so since it seems to react very similiarly to the example above. I only include this info in that it might give you a clue as to my problem, not to troubleshoot Quicken. Note I have replaced the bank name by x in this example.

[dodger741]

AnnMarie: An update. I noticed the file associations point to C:\Program Files\Internet Explorer. When I use the windows box described above to "locate" it and point it to this directory it also says it can't find it but it is there.

[dodger741]

AnnMarie: Another update. With all the timezones I thought I would play further. What I did was using the "file types" under Folder Options, for URL:HyperText Transfer Protocol, URL:HyperText Transfer Protocol with Privacy and ULR:Gopher Protocol I changed the "open" pointer from "C:\PROGRA~1\INTERN~1\IEXPLO~1.EXE" -nohome to "C:\Program Files\Internet Explorer\iexplore.exe" %1. Now the desktop shortcuts and links in Eudora work properly. Seems like progress. I checked my Quicken problem and it acts the same as earlier which is doesn't do anything when I click on the the link (https://www.netteller.com/x/DeliverC...p%2F..57b61921.) that is supposed to open up a box asking me if I want to open or save the file. Is there something special about this link? This problem is different (worse for me now) than when we started. It used to open up IE in a seperate window asking me to login. When I did and came back to the original page in quicken and clicked, the open/save box would open and I could proceed.

I then set firefox as my default bowser and had the same results with quicken. I set IE to ask me if it should be the default browser and said yes. It proceeded to change the URL types back to "C:\PROGRA~1\INTERN~1\IEXPLO~1.EXE" -nohome which doesn't work with the desktop links now. Is this a clue?? Also is there a file extension I need to change that is related to the link that doesn't work while trying to downlad my transactions?