Browser error - Urgent

[wanamingo]

Ive run into a very odd problem.... A user at the company I work for is getting intermittent error messages that just say

User Terminated - Black print all white backing, very plain, and ominous.

For example If I go to Dell.com the page spends a long time loading and then displays that message. The odd part is the rejection comes from an IP address registered to a company called IPPrime in Newark NJ. So after that message is created in the address bar it looks something like this

http/168.111.223.256sadlkjfhw vaiudyr872356qr78cnyaiwsduhci;hqax348p2yn9zh;qawicbjp3y6478bt53c gaw3kfjgev2qo638q7r

Just gibberish from an address in Jersey. Another reason to avoid NJ.

Ive tried resetting the browser (Internet Explorer 8) and doing a malware scan (1 result). I want to try a non-destructive restore(I figure the registry might be fudged from the Trojan) or another browser.

Any advice?

PS Google has nothing on this error just a Firefox bug report with the exact same symptoms.

 

[nikorr]

If possible, run #1 and #2.
http/www.tomshardware.com/forum/8263-63-simple-free-guide-removing-malware

 

[wanamingo]

Yeha I ran rkill our own symantec AV and malwarebytes. I even installed chrome which has the same errors! Only happens on some sites....

I tried reinstalling IE8 and the problem still persists.

 

[hang-the-9]

Check with your ISP. It almost looks like a re-direction virus or spyware, but not quite.

This is only one one PC? Is that computer on the same network as the rest as far as the proxy or gateway go?

You may want to wipe the drive and re-install Windows on that computer, that will rule out any local issues, then expand the trouble-shooting to the ISP and maybe that NJ company, ask why this message may be coming up. Sounds like a company the ISP would use to route traffic across their backbone, at least according to the name.

 

[aford10]

I would start by checking the Host file.

Can you get a screenshot of the error?

 

[hang-the-9]

I would start by checking the Host file.

Can you get a screenshot of the error?

If it was in the hosts file it would not be intermittent though.

 

[aford10]

Is it intermittent, as in, Dell.com will load sometimes, and not others? Or is it intermittent, as in Dell.com will always fail, but other sites load ok?

If this only happens on 1 PC in the network, for multiple profiles (yours and theirs), then the issue is local to the PC. There's a malware guide in my signature for removing infections.

 

[wanamingo]

the host file is fine, nothing but the modifications we need.

I thought I had fixed the problem by removing and installing internet explorer but it reappeared recently. Malware sweeps have fixed the problem but it appears as though its still trying to reroute some web pages then fails with the "user terminated" message.

The only reference to the error message ive found through googling is this firefox support question http/support.mozilla.com/en-US/questions/895076

And the user is using internet explorer 8 in an XP environment. Its almost like theres an old registry value trying to connect through a proxy.

 

[wanamingo]

Well it was a virus but MBAM didnt pick it up, it took a mix of TDSS killer and SAS.

 

[aford10]

Thanks for the update.