Porno Site

From: Chris Jenner (Chris.Jenner_at_Fly.Virgin.Com)
Date: 12/13/03

  • Next message: David Neil: "MY DOCUMENTS ACCESS" 
    Date: Sat, 13 Dec 2003 02:48:32 -0800

    It sound like a varient of the Trojan Horse Virus
    StartPage-Q. It seems to want to infect key systems
    executables, such as msinfo.exe. When the an infected app
    runs these executables it make the changes to the registry
    and creates two files on the HDD (%WINDIR%\Default.css
    (1260bytes) and %WINDIR%\Web\oslogo.bmp (1260bytes). I
    found that deleting these files and making the registry
    changes below should reverse its effects, but if you do
    not have an uptodate antivirus system then the problem may
    return. I have not checked recently but Sophos were
    working on a fix, so I imagine that most of the major anti-
    virus players out there should have a fix by now. But
    still try the entries below. (If you copy them into a text
    file and change the .txt to .reg and then run that file it
    will make the changes for you.)

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
    "Search"="http://www.microsoft.com/isapi/redir.dll?
    prd=ie&ar=iesearch"
    "SearchURL"="http://www.microsoft.com/isapi/redir.dll?
    prd=ie&ar=iesearch"

    [HKEY_CURRENT_USER\Software\Microsoft\Internet
    Explorer\Main]
    "Start Page"="http://intranet.vaa.vtg/"
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?
    prd=ie&ar=iesearch"
    "Default_Search_URL"="http://www.microsoft.com/isapi/redir.
    dll?prd=ie&ar=iesearch"
    "Default_Page_URL"="http://intranet.vaa.vtg"
    "Search Bar"=""

    [HKEY_CURRENT_USER\Software\Microsoft\Internet
    Explorer\Search]
    "CustomizeSearch"="http://ie.search.msn.com/
    {SUB_RFC1766}/srchasst/srchasst.htm"
    "SearchAssistant"="http://ie.search.msn.com/
    {SUB_RFC1766}/srchasst/srchasst.htm"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer]
    "Search"="http://www.microsoft.com/isapi/redir.dll?
    prd=ie&ar=iesearch"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
    Explorer\Main]
    "Default_Page_URL"="http://Intranet.vaa.vtg"
    "Default_Search_URL"="http://www.microsoft.com/isapi/redir.
    dll?prd=ie&ar=iesearch"
    "Search Page"="http://www.microsoft.com/isapi/redir.dll?
    prd=ie&ar=iesearch"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
    Explorer\Search]
    "SearchAssistant"="http://ie.search.msn.com/
    {SUB_RFC1766}/srchasst/srchasst.htm"
    "CustomizeSearch"="http://ie.search.msn.com/
    {SUB_RFC1766}/srchasst/srchasst.htm"

    >-----Original Message-----
    >Everytime I turn on my computer a sex website shows up on
    >my desktop and also makes itself my default homepage. The
    >site is http://sex.Free4Porno.Net/search2.HTML How do I
    >stop this. Please help.
    >.
    >

  • Next message: David Neil: "MY DOCUMENTS ACCESS"