CMD pops up and then automatically opens my firefox

[Havo_k]

Everytime I start my computer, cmd flashes up and automatically opens my browsers and then redirects me to http://gamezdoka.org/

I have malwarebytes installed (premium member)and I have scanned my computer several times but its not finding any threats.

Any help will be gratefully received and appreciated

 

[ronintexas]

There is one of two areas where this is happening - either you have a scheduled task that runs a batch file at startup, or there is a batch file in the startup folder.

 

[Havo_k]

There is one of two areas where this is happening - either you have a scheduled task that runs a batch file at startup, or there is a batch file in the startup folder.

Startup folder for all users is empty. The start up folder of my main user account only has EVGA Precision in it.

How do I go about checking a batch file that is scheduled to run? This just started happening today and I have had malwarebytes for 2-3 months now.

 

[mdd1963]

Comodo's 'Autoruns' or TrendMicro's HiJackThis will, for sure, show you what is scheduled to start at logon/bootup, etc..; anything looks suspicious, click it off!

 

[aks_1337]

Start > Run > type: msconfig
Go to the "Start up" tab and disable all programs that are displayed here (with exception of anti-virus)

Reboot PC and it should be solved.


Extra step: Download/install Malwarebytes' Anti-Malware, perform a Threat Scan to see if anything nasty is lurking on your computer.
Delete everything it finds & reboot pc.

 

[ronintexas]

In control panel, search for "Schedule Tasks".

In task scheduler, it will display everything that is scheduled. It may take some searching to find the task that is enabled - it will say "At system startup" or "at log on of any user".

 

[Havo_k]

Start > Run > type: msconfig
Go to the "Start up" tab and disable all programs that are displayed here (with exception of anti-virus)

Reboot PC and it should be solved.


Extra step: Download/install Malwarebytes' Anti-Malware, perform a Threat Scan to see if anything nasty is lurking on your computer.
Delete everything it finds & reboot pc.

I didn't want to disable everything in my start up because most of programs that are in there i want them to be there.
However, I saw "Windows command processor" and when I expand this I saw three files : conhost, mozilla firefox and windows command processor (aka cmd)
I disabled that and voila the problem is solved. I was hoping to delete whatever it was causing it but I only can disable that.

Here's a screenshot:
http://puu.sh/cX1XG/26dc6363f4.png


On another note, Im using:
Malwarebytes anti malware (premium subscribed)
AVAST free one for now (premium expired).

 

[mdd1963]

Disabling it is good enough, it will lay dormant/useless until finally meeting it's fate in a later format/Windows 10 install!

(You might be able to find some youtube instructional videos for how to delete the appropriate registry keys from within a Linux bootable rescue CD, if you are so inclined..)

 

[Havo_k]

Thank you everyone. All of these comments were really helpful.

 

[Longrange1977]

I just had this as well, To kill it for good, I deleted startup entry for "oovx.net" in sysinternals.

The task manager entry has now gone. It may be a random name, but the timestamp was the only item from yesterday (it only appeared today)

Only question left is where did it come from?

 

[ronintexas]

There are web installers out there that have "add-ons" that try to install while you install your program. Most common example is Adobe Flash Player tries to install the online scanner from McAfee while you install Flash....you have to look over these installers closely, some will "hijack" your home page, search engines or install payload that you don't want on your computer....be very careful!

 

[zabrien]

That's what we all get for Downloading a Russian rip of a game

like, I dunno say...

Far Cry 4

 

[tech_99]

For those of you who can't remove it from your computer: use Autoruns. Open the program and search for oovx.net or CMD. Or you can follow this removal guide: http://deletemalware.blogspot.com/2014/11/remove-ooovnet-pop-up-on-startup-and.html

I hope this helps!

 

[zabrien]

I was able to remove it via the Regedit and scheduled app instructions, both, not just one