Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Every few minutes the computer starts the default browser (in this case Firefox 3.6) with a spam address (e.g., medicalhints dot com) which leads to a landing page filthy with advertisements.

How do I find out which process issued the command to fire up the default browser (to this address in particular, or any address in general)?

It's probably a trojan or adware.

I tried investigating which process is responsible, but I only got svchost, which is the Windows generic service runner. I used process-explorer (from Sysinternals) - which showed that Firefox was started by svchost, which doesn't help much.

share|improve this question

1 Answer 1

Process Explorer will show you which services are running in that particular instance of svchost, in the Services tab. Look for anything unusual.

(I have a guess that it could be Task Scheduler. Third-party services rarely run inside svchost.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.