How I Resolved the Browser Launching to Unsafe site “ururgisha[.]net” on Startup

Recently, I confronted an unsettling issue where a Command Prompt window would flicker on startup, immediately followed by my browser opening to a suspicious website—specifically “ururgisha[.]net.” After some investigation and troubleshooting, I managed to resolve the problem, and I’m eager to share the steps I took in hopes that it might help others facing a similar predicament.

Step 1: Investigate the Windows Registry for Startup Entries

The first task in my troubleshooting journey was to examine the Windows Registry to check for unexpected startup programs.

1. I accessed the Registry Editor by pressing Win + R, entering regedit, and hitting Enter.
2. Once the Registry Editor was open, I navigated to the following path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
3. Within that section, I discovered an entry resembling “YourUserName” along with a command string that read “cmd.exe /c start www[.]dongdonger[.]org.”
4. I promptly deleted this entry by right-clicking on it and selecting the Delete option.

Step 2: Check Task Scheduler for Suspicious Tasks

Next, I turned my attention to the Task Scheduler, which can also harbor unwanted tasks that trigger on startup.

1. I opened Task Scheduler by pressing Win + R, typing taskschd.msc, and pressing Enter.
2. In the Task Scheduler window, I browsed through the “Task Scheduler Library.”
3. I located a task that was named after my user account.
4. After right-clicking on the task and selecting Properties, I checked the Actions tab and confirmed that it was configured to execute “cmd.exe /c start www[.]dongdonger[.]org.”
5. I then deleted this troublesome task by right-clicking it and selecting Delete.

![Task Scheduler Screenshot](https://preview.redd.it/365llbgpkxee1.png?width=1506&format=png&auto=web