Hi, everyone.
We just had new Windows 10 machines installed at work. (Dell Optiplex 3040)
Our old PC's were Windows 7 and I always used Firefox as my browser. Never had any issues on W7.
The new PC, however, is opening Firefox to http://hp.hfindingformspro, every night while the PC sleeps. Every morning when I come into work and wake my PC, Firefox has opened to that website. MSN has always been my homepage. Any ideas?
Thanks.
Does the same thing happen if the computer/s are shut down overnight?
Have you tried right-clicking the Tab bar, click Menu Bar and Bookmarks Toolbar, on the Tools tab click Options then change the Home page. I'd open MSN then copy the URL to paste where prompted. I also like to right-click the Tab bar and Customize to add the Title Bar to the top.
I'd also open Task Manager and check Startup to see what is loading automatically, remove those not wanted.
View Event ID 1 and 42 for Wake and Sleep
"They are Event 1 and Event 42 (wake and sleep, respectively).
Open the Event Viewer and expand "Windows Logs" then click on the 'System' event log.
Right-click, and then choose "Filter Current Log".
Input the event id 1 and 42 number into input box above the "Task category" input box.
In the "Event sources" window, click the drop-down and put a check-mark beside "Power-Troubleshooter" and "Kernel-Power" and then click "OK.
You will see listing of wake & sleep events and look at the the "General" tab at the very bottom for each Event ID 1 for wake events the wake source will be shown it will be display at the "Wake Source: " entry.
See this description and read the last paragraph. Finding Forms Pro Tab - Chrome Web Store. I would call this malware.
https://www.hybrid-analysis.com/samp...ironmentId=100
No, not while shut down, only while on, or asleep. Startup looks good, nothing unusual.
Last night, while at my computer, at 5 after 8:00, the website popped up. I closed it, and left work. This morning, I wake the PC and the website remained closed. So it looks like after I close it once, it will not do it again until another 24 hour cycle. Works like clockwork.
You need to run MBAM to start with and then use FRST. Download Farbar Recovery Scan Tool If this is isolated to a single machine it can be chalked down to bad user habits. If wide spread across multiple machines, then all computers need to be isolated to remove the infection including servers. Read & Run Me First Malware Removal Guide (incl. Spyware, Virus, Trojan, Hijacker) | MajorGeeks.Com Support Forums
Looks like the extension that is causing that page is installed in FF. Otherwise the Frst.txt log does not show anything else of question.
Quote