Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Every few minutes the computer starts the default browser (in this case Firefox 3.6) with a spam address (e.g., medicalhints dot com) which leads to a landing page filthy with advertisements.

How do I find out which process issued the command to fire up the default browser (to this address in particular, or any address in general)?

It's probably a trojan or adware.

I tried investigating which process is responsible, but I only got svchost, which is the Windows generic service runner. I used process-explorer (from Sysinternals) - which showed that Firefox was started by svchost, which doesn't help much.

share|improve this question

Process Explorer will show you which services are running in that particular instance of svchost, in the Services tab. Look for anything unusual.

(I have a guess that it could be Task Scheduler. Third-party services rarely run inside svchost.)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .