Hey CT - IMO this is definitely malware, most likely a persistent rogue cookie. I would suggest to keep trying with different scanners; try [url=http://www.superantispyware.com/:1ma0ox6v]SUPERAntiSpyware[/url:1ma0ox6v] and [url=http://www.microsoft.com/security/scanner/en-us/default.aspx:1ma0ox6v]Microsoft Safety Scanner[/url:1ma0ox6v].

What browser is being used by default?

Once we get that information we may be able to suggest using settings to ban cookies from certain sites.

Cheers....Jim

Okay CT - The difficult aspect of this is trying to identify which cookie(s) are to blame.

Open Firefox and go to [b:2undf4ak]Tools>Options[/b:2undf4ak] and then open the [b:2undf4ak]Privacy [/b:2undf4ak]tab.

Now you will see options for handling cookies. Click on the [b:2undf4ak]Show Cookies[/b:2undf4ak] button and review what is listed there.

There are a couple of things you can try:

Delete all cookies and then disable the options to [b:2undf4ak]Accept cookies from sites [/b:2undf4ak]and [b:2undf4ak]Accept third-party cookies[/b:2undf4ak]. See if that stops the 'jumping'. There will be side affects with those options disabled, not serious ones; log-on to 'member' sites will not be persistent so the user will need to log-on each visit. Other user-specific settings will be lost. But it should also let you know if a cookie (or cookies) are responsible.

*You can use the 'exceptions' feature to "allow" known safe cookies, and particularly those which are related to sites which require log-on (while still blocking all others).

Or, if you can identify the rogue cookie(s) you could leave those options enabled and just "Block" the rogue cookie(s) via the 'exceptions' feature.
[click on the[b:2undf4ak] Exceptions [/b:2undf4ak]button to access that feature]

Did you find anything with the other scanners?

Cheers....Jim

You are most welcome CT.

Let us know how you get on please.

SUPERAntiSpyware Does It Again!!!!!!

Great to hear all is now well CT. Thanks for letting us know.

[quote:evn8glzp]People often argue that Malwarbytes' is superior to SUPERAntiSpyware, but from my experience, the best practice is to keep them both as they seem to nicely complement eachother.
[/quote:evn8glzp]Agree 100% FD. There is nothing to pick between them, both are excellent. SAS will often flag more items after MBAM has cleaned and MBAM will often flag more items after SAS has cleaned, so to argue over which is best is pretty silly. As with all such security products conventional wisdom applies; no single program is going to identify 100% all malware.......but these two come closer than most.

[quote:evn8glzp]have you tried out Microsoft Safety Scanner?[/quote:evn8glzp]
No, I haven't FD. Haven't actually been presented with an infected machine for some time......my 'clients' must be getting the message...finally!!! LOL

MS Safety Scanner does not operate in quite the same manner as the other two. Before using either SAS or MBAM all one need do is update the definition database (unless, of course, there has been a major program update in the meantime). However, MS Safety scanner expires every 10 days, after which time the user needs to download the full program all over again. The download is 70+ MB, so MS Safety Scanner is definitely a ....download on-demand only proposition.

Cheers.....Jim

[quote:37p8lzbm]Of course, as Dave once said:

The number 1 security tool you have available at any cost? The one between your ears![/quote:37p8lzbm] Yes, Dave tends to use all my best material!!

[quote:37p8lzbm]I also have Hitman Pro[/quote:37p8lzbm]
But it is not free, at least not for removal....is it?

[quote:37p8lzbm]I always wondered about this type of scanners, does the scan engine update that often that you need to redownload the whole thing every time[/quote:37p8lzbm]
I believe it has something to do with portable versus installed (both Dr. Web & MS Safety Scanner are portable). Although, why the portable apps could not include a button link to manually download updates is beyond me.

[quote:18shybzp]since I'm not a programer, can't say if and how difficult it would be to just update the defs[/quote:18shybzp]
Me too, but I use Sumatra portable for simple PDF reading and whenever that starts it offers me updates (if/when there is one available). So I can only assume it would be feasible and not too difficult.