Big Internet problem

[Lord Deprav]

Ok so I have a problem with my internet. I am on cable on use Internet Explorer. I have a yahoo e-mail address. I use yahoo as my home page. Now I have an issue where I cannot access yahoo. If I type in yahoo.com some weird site comes up. Its like a search engine. I have tryed to go to different yahoo things and have been successful but even when I click on links to go to yahoo...it takes me back to that site. I have tryed resetting my home page and everything. Anyone out there that can give me help or advice I would truely appreciate it!

Thanks Deprav

[Tsa`ah]

Sounds like scum ware.

You have most likely inadvertently installed a patch into IE that re-routes certain pages such as yahoo.

If you have lava soft ad-ware remover, run it. If not, down load it.

You may want to try using a different browser first as a control. If yahoo load, it is only affecting IE, if not, it will affect them all.

[Lord Deprav]

ok No I have used ad-aware and it seems like it cleaned up lots of my files. I had over like 60 spyware files on my computer. And it seems like it did an ok job. But now I am running into the problem I cannot get yahoo's page to load. It just comes up a blank page.

Deprav

[theotherjohn]

turn off system restore
restart comp in safe mood
run adaware and a real virus scan
restart computer as normal
turn on system restore

if that does not work you have a malicious program that is writing information to the h keys in local machine

[Edited on 11-30-2003 by theotherjohn]

[Lord Deprav]

Originally posted by theotherjohn

if that does not work you have a malicious program that is writing information to the h keys in local machine

[Edited on 11-30-2003 by theotherjohn]

That may be the problem. I will try the other way too... But I am not sure how to get my computer into safe mode since I have XP. Is it just as simple as inserting a floppy and going from there?

[theotherjohn]

Originally posted by Lord Deprav

That may be the problem. I will try the other way too... But I am not sure how to get my computer into safe mode since I have XP. Is it just as simple as inserting a floppy and going from there?

Click Start, click Shut Down, and then, in the drop-down list, click Shut down.
In the Shut Down Windows dialog box, click Restart, and then click OK.
When you see the message Please select the operating system to start, press F8.
Use the arrow keys to highlight the appropriate safe mode option, and then press ENTER.

[Back]

Or, you could save yourself all that headache and just buy a Mac.

[Lord Deprav]

Hmm appears I have a trojan horse downloader winshow

[theotherjohn]

Originally posted by Lord Deprav
Hmm appears I have a trojan horse downloader winshow

go to the home page for your virus scan and read about removal instructions for that virus

[HarmNone]

Poor Deprav. You have really been cursed with problems lately. Hope you can get this one fixed easily. :(

HarmNone

[Skirmisher]

Aha, my cousin had something like that. It would hijack his internet connection and send him to some weird site that looked like a personal web home page. Really odd stuff is out there thats for sure.

Please do keep us updated as to your own situation? I'm interested in knowing how it gets resolved.

[Lord Deprav]

I jad 177 contents infected and 174 are healed. I cannot find anything about this virus on the home page. Of course it appears that these 3 files are the ones that are the problem. Although evertime I retry it the same files tend to be popping up.

[HarmNone]

Have you tried just putting the one of the file names into Google and seeing what you come up with? Perhaps there is information out there on them.

HarmNone does not know if this will work

[theotherjohn]

Originally posted by Lord Deprav
I jad 177 contents infected and 174 are healed. Although evertime I retry it the same files tend to be popping up.

those 3 files may be showing up because your h keys in local computer are telling them to

It is very important to know what you are doing when you are missing with the registry. If you dont feel comfortable dont do anything.

What I am telling you below could miss up your entire system. You make the choice to do it or not

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionRun

In the right pane, delete the value:

file 1
file 2
file 3

or any file that has similiar name to 3 files that are not getting healed

Navigate to the key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionRunServices

NOTE: This key does not exist on all the systems.

In the right pane, delete the value:

same as above

Exit the Registry Editor.

[Lord Deprav]

Hmm I didn't see anything with viruses name under those panels. Let me copy where the virus is located and what it is called.

Belt.exe Tojan horse Downloader.Stubby.A located in:
C:\Documents and Settings\myname\Local Settings\Temp\Belt.cab:\Belt.exe

Maybe that would be a little more specific?

Deprav

[theotherjohn]

Originally posted by Lord Deprav
Belt.exe Tojan horse Downloader.Stubby.A located in:
C:Documents and SettingsmynameLocal SettingsTempBelt.cab:Belt.exe


I would go into the registery and delete anything that had belt.cab in it

Remember though I am doing this without seeing anything and missing around in the registery can screw up your computer

[theotherjohn]

Originally posted by Lord Deprav
Belt.exe Tojan horse Downloader.Stubby.A located in:
C:Documents and SettingsmynameLocal SettingsTempBelt.cab:Belt.exe


I would go into the registery and delete anything that had belt.cab in it

Remember though I am doing this without seeing anything and missing around in the registery can screw up your computer

[Wezas]

I had a problem similar to that, Ad-aware is a definate, also there are some other software packages (free) that you could use. They're basically Browser Hijack stoppers. It sounds like the search engine your browser uses has been changed, so "Browser Hijack Blaster" or any of these other softwares may help you.

[Skirmisher]

PC World (yah I read it, sorry if I quote it alot) has some utilities that may help if not this time, then for future reference.

http://www.pcworld.com/downloads/index/0,00.asp

1) Trojan Remover V4.7.4 (shocking, it removes trojan horses) (http://www.pcworld.com/downloads/file_description/0,fid,8171,00.asp)

2) Browser Hijack Blaster (This I believe stops malicious programs from changing your homepage or search engines without your consent) (http://www.pcworld.com/downloads/file_description/0,fid,22955,00.asp)

3) BoDetect V 3.5 (another Trojan Horse eliminator) (http://www.pcworld.com/downloads/file_description/0,fid,5463,00.asp)


They have lots more downloads available too. Good luck again.

[Lord Deprav]

Thanks Skirmisher and Wezas. I gave up last night when it started all over again. I tryed deleting all the files in the directories but it still pops up. Its like I delete it and then check my virus scanner and within an hour it pops back up I will try those other methods and see how they work. Thank you all I appreciate this so much!

Deprav

[Tsa`ah]

Harm had good advice.

Google it.

http://www.computing.net/security/wwwboard/forum/7431.html