Strange computer problem - DPChallenge Forums

02/13/2012 03:53:57 PM · #1

Very rare for me to be asking for computer help, but I've got a bizarre problem I have never seen before. On my netbook, which runs Windows 7 home premium (32bit), I get popup dialogs via Windows asking for authentication from whatever site I am at, even those sites that don't require an account or logging in. It does it in both Firefox and internet explorer. Under IE, it happens so quickly and frequently that I can't do a thing. On Firefox it seems to be more intermittent. It does not seem to be malware like behavior, and the sites that are requesting the authentication are part of the domains I am visiting at the time. Here's some screen shots from Firefox:

...and one from IE:

anyone seen such a thing before?

LN13

Canon EF-S 15-85mm f/3.5-5.6 IS USM

02/13/2012 04:01:46 PM · #2

makes one wonder if you have been infected......
(or at least your netbook)

I'd run MalwareBytes

PGerst

Canon EOS-20D

Tamron SP AF 28-75mm f/2.8 XR Di for Canon

02/13/2012 04:02:21 PM · #3

Seems like malware to me as well. Did a search for some of those domains....didn't look too good.
Check for entry in network places.

IAmEliKatz

Nikon D5

Nikon AF-S Nikkor 70-200mm f/2.8G ED VR II

02/13/2012 04:03:13 PM · #4

Originally posted by larryslights:

makes one wonder if you have been infected......
(or at least your netbook)

I'd run MalwareBytes

I agree..

I usually just boot up into safemode with network and run MBAM and it usually kills any problems I have.

Nikon AF-S Zoom-Nikkor 28-70mm f/2.8D IF-ED

02/13/2012 04:10:37 PM · #5

Running a scan with AVG right now and it's not coming up with anything. I'll try MB next.

hihosilver

Nikon D200

02/13/2012 04:12:29 PM · #6

Are you using a third party internet filter service?

hihosilver

Nikon D200

Nikon AF-S Zoom-Nikkor 28-70mm f/2.8D IF-ED

02/13/2012 04:19:25 PM · #7

I have seen these prompts for flash or streaming connections when the authentication isn't recognized and prompts the user for verification. If you type in any user name or password, then the connection will pass through.

Message edited by author 2012-02-13 16:19:37.

02/13/2012 04:20:50 PM · #8

Originally posted by hihosilver:

Nope, does not accept a bogus password. Running a quick scan with MB now. Not turning up anything so far.

LN13

Canon EF-S 15-85mm f/3.5-5.6 IS USM

02/13/2012 04:28:21 PM · #9

did you clear your cache & cookies?

although, it is odd that it's hitting IE & FF. That's what makes me think you've got some critters in there.

02/13/2012 04:32:40 PM · #10

MB didn't turn up anything. about to see if I get the dialogs in safe mode.

cowboy221977

Canon EF-S 10-22mm f/3.5-4.5 USM

02/13/2012 04:34:48 PM · #11

I had a prob similar to that and it was quite annoying.....It turned out to be a worm...It took my virus protection about a month to find it.

02/13/2012 04:37:20 PM · #12

Seems to not happen in safe mode, so something is loading up. Might just be time to nuke it from orbit and do a fresh install. Well, I take a lot of precautions and it's been many years since my computer had any malware. I guess It's a pretty good record.

02/13/2012 04:40:51 PM · #13

it would appear your digital certificates issued with windows have been corrupted

oops should have looked at the pics lol

easy fix i can think is to go mac.....

haha in all seriousness not touch pc's since my degree go mac

Message edited by author 2012-02-13 16:42:57.

Osiris1975

Canon EOS-600D/T3 Rebel

Canon EF 50mm f/1.8 II

02/13/2012 04:42:47 PM · #14

This smells like a keylogger to me.

02/13/2012 04:45:19 PM · #15

Originally posted by Giles_uk:

it would appear your digital certificates issued with windows have been corrupted

That makes sense. And I knew someone would eventually chime in with "get a Mac". Someone always does. I think I'll flip that around whenever Mac users have problems.

tome

Canon EOS-5D Mark II

02/13/2012 04:46:31 PM · #16

Long time indeed since I've dealt with these. Sort of expected that MB would come up with nothing. Try using Resource Monitor to identify the process, since it appears both in ff and ie. From there on, depends on what you find. It's possible that it will be a svchost.exe - try using pstools to identify the particular service (and file. If you find a strange executable, you can try googling for the name of the exe and look for removal instructions :).
A bit rusty these days :).

Nikon AF-S Zoom-Nikkor 28-70mm f/2.8D IF-ED

02/13/2012 04:49:49 PM · #17

It's just my spare computer. I think the best thing is to wipe the drive and reinstall Windows7. Then I know I've gotten it.

hihosilver

Nikon D200

02/13/2012 04:50:12 PM · #18

Are you using a proxy server or other web security connector to connect to the internet?

If a site is requesting an NTLM authentication for a flash connection or an http connection for streaming services, then you will have to configure whatever web security connector you are using to allow for the traffic to pass through. For a flash connection, your web security needs to skip the NTLM authentication. For an HTTP connection, you may need to add the connector's ip address to the security tab of the web browser.

02/13/2012 04:53:36 PM · #19

No, it happens when connecting from various locations and there is no proxy server involved.

02/13/2012 06:00:33 PM · #20

Originally posted by Yo_Spiff:

Originally posted by Giles_uk:
it would appear your digital certificates issued with windows have been corrupted

That makes sense. And I knew someone would eventually chime in with "get a Mac". Someone always does. I think I'll flip that around whenever Mac users have problems.

so you'll get to use that once in a blue moon then and most likely be user error

my get a mac comment was heavily sarcastic :)

cowboy221977

Canon EF-S 10-22mm f/3.5-4.5 USM

02/13/2012 06:19:16 PM · #21

down with the mac......I love my windows pc

02/13/2012 06:40:44 PM · #22

Originally posted by cowboy221977:

down with the mac......I love my windows pc

have you ever used a mac? i mean properly used?

i was pc all through growing up the early days of the interent first 2 years of my computer science degree and then worked for a huge IT firm specialising in unix servers and the world changed for me after that ive been mac these last 8 years and never looked back, sat here with two 17mbp's one im on here doing images the other currently playing warrior, what a great film it is so far :)

ive had two batteries replaced out of warranty no questions asked by apple cant fault them

mcaldo

Samsung GX-10

Pentax SMC-F 50mm f/1.7

02/13/2012 08:16:31 PM · #23

Originally posted by Yo_Spiff:

No, it happens when connecting from various locations and there is no proxy server involved.

If it's your spare lap and backup is not too time consuming, probably reformatting is the way forward.
In my experience, ESET is probably the most efficient antivirus and anti-malware, also because if nothing else works you cna ask them to connect in remote and try and fix it manually.

cowboy221977

Canon EF-S 10-22mm f/3.5-4.5 USM

02/13/2012 08:20:06 PM · #24

Originally posted by Giles_uk:

Originally posted by cowboy221977:
down with the mac......I love my windows pc

have you ever used a mac? i mean properly used?

i was pc all through growing up the early days of the interent first 2 years of my computer science degree and then worked for a huge IT firm specialising in unix servers and the world changed for me after that ive been mac these last 8 years and never looked back, sat here with two 17mbp's one im on here doing images the other currently playing warrior, what a great film it is so far :)

ive had two batteries replaced out of warranty no questions asked by apple cant fault them

I build all of my computers (to my specs)...I do need to get a laptop...but really don't need one right now...I cant build a mac. They are a little proprietary.