Re: Default home page
jimscott97_at_hotmail.com
Date: 03/24/04
- Next message: liorde: "Need help with Win98se and worm Protoride.B"
- Previous message: Nictu: "Is this a virus??"
- In reply to: Jeremy Kimball: "Re: Default home page"
- Next in thread: jelly: "Re: Default home page"
- Reply: jelly: "Re: Default home page"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 23 Mar 2004 22:04:22 -0800
Thanks...I am getting closer. I ran everything described
here and prior to re-booting, everything works fine. I
can connect to google, msn, yahoo and I have control over
my home page.
HOWEVER, when I log-off or re-boot it comes back. This
leads me to believe that something is still there at
reboot..
Any further suggestions?
Jim
>-----Original Message-----
>Jim, I just got through cleaning this nasty bugger out...
>
>First, grab a copy of HijackThis! It will help you clean
out all the
>registry entries and such.
>
>What is happening is this:
> 1. on bootup, a file at %
windir%/system/systeminit.exe is run (first key
>you'll need to nuke with HijackThis)
> 2. the evil systeminit.exe creates a series of web
links on your
>desktop, a file called "sstyle.css" in %windir%,
> and a file called "sys.exe" in /Documents and
Settings
> 3. Kill these files mentioned (back them up if
you're worried I'm wrong)
> 4. Run HijackThis. Fix all R-rated entries (they
should all have
>thebestse mentioned in the text)
> 5. Scroll to the bottom of the list, remove the
systeminit Run key, as
>well as the sstyle.css key
>
> Run windows update, get every damned patch, reboot
and cross your
>fingers! :)
>
> Jeremy Kimball
>
>"Jim" <jimscott97@hotmail.com> wrote in message
>news:1211401c41110$186c34b0$a501280a@phx.gbl...
>> Something got on my machine and defaults my home page
and
>> any attempt to get to any search engine (google, msn,
>> yahoo) with www.thebestse.com..Which I believe now
stands
>> for "the best search engine"..
>>
>> I tried anti-spyware, regedit, etc.,etc..I also see
that
>> when I type www.google.com the following url executes
>> "http://run.gibnetmaster.com/download/index.html"..
>>
>> Can anyone suggest any cures to get rid of this?
>>
>> Thanks
>> Jim
>
>
>.
>
- Next message: liorde: "Need help with Win98se and worm Protoride.B"
- Previous message: Nictu: "Is this a virus??"
- In reply to: Jeremy Kimball: "Re: Default home page"
- Next in thread: jelly: "Re: Default home page"
- Reply: jelly: "Re: Default home page"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
