Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a computer that sends out queries to weird URL's every 2 to 5 seconds.

The URL's are as follows :

http://ikspat2me.org/smith/index2.php

http://mixerwatergate.org/smith/index2.php

http://cdromscomplex.pro/smith/index2.php

TrendMicro OfficeScan finds no viruses. MalwareBytes scan gave no results. HijackThis logs are clean. AVG AntiRootkit found no rootkits. Registry run/run-once entries are clean, and there are no programs in Startup folder.

Additionnaly, Microsoft Network Monitor is unable to trace the process from which the requests are made. Sometimes it gives no source process, sometimes it says it is "System", sometimes "TMProxy.exe" (which is a TrendMicro component).

Anyone have any clues as to what may be causing this ? Is reformat my only option (there is a lot of known, clean software (temp. monitors and other electro-mechanic hardware specific utilities, provided by their manufacturer)) ?

Thanks for any help or advice.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I am nearly certain you have some form of infection.

I would ensure nothing undesired is starting up with your machine. So, type in MSCONFIG in the RUN box and edit the start up tab.

Also, check scheduled tasks to ensure nothing is running every so often.

Remember, software like this can run 'stand alone' and so may not even be on your hard drive, but on removable drives such as USB (and how many AV's scan USB drives?).

share|improve this answer
    
I'm also certain it's an infection, just can't find it ;) And, whoops, forgot about msconfig. Checking it out right now. As for USB drives, there are none plugged in. –  T. Fabre Jan 4 '13 at 8:52
    
What your describing is undesirable more than malicious; I would therefore expect AV to have a hard time to find it. However, it is running, so also check what processes are running in Task Manager as this may help. And don't forget Scheduled Tasks. –  Dave Rook Jan 4 '13 at 8:53
    
Lastly, when does this happen? Is a program always open when it occurs? It could also be a browser plugin which is doing this, so try a different browser, or disable all plugins for a while. –  Dave Rook Jan 4 '13 at 8:56
    
Got it, I don't know how I missed it (well, I do actually, runas /user:administrator regedit.exe, forgot to check in Run entries for other users), I'll keep you posted on if it worked. As for the process, it doesn't show up in task manager at all. –  T. Fabre Jan 4 '13 at 8:56
    
Glad it worked for you. –  Dave Rook Jan 4 '13 at 8:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.