Preserved Topic: Virus? Trojan? I don't know what the hell it is, but it's very annoying... (Page 1 of 1)

OK...I have just come across a...something...on a friend's system. I don't know if it's a trojan or a virus or whatever, and it only affects Internet Explorer. It doesn't allow you to change your home page to anything but http://home.whatzit.com and all DNS errors are routed through it too. I've come across many keys for it in regedit, deleted or altered them, and then they're all back again the next time you load IE. Very annoying, becuase this page loads a million and one pop ups when it loads, and if a DNS error comes up on any of them it loads the whatzit DNS error page, which brings up more pop ups. It doesn't allow you to run any kind of AMP package properly, which is the worst part.

Have you ever heard of anything like this, becuase I can't get rid of it for all of me.

You will most likely find a folder or file in your windows folder that is powering this little blighter, i have foudn plenty inthe past, and danm they are annoying, just look for something that looks out of place and have a peek around.

you've downloaded and run Ad-Aware on his machine right?



.:[ Never resist a perfect moment ]:.

yep...didn't find a thing

you've downloaded and run Spybot Search & Destroy on his machine right?

Start Page Guard ( http://www.spywareinfo.com/downloads/spg/ ) will fix it too, but it's also good for preventing it from happening again ...


Bug-free software only exisits in two places
A programmer's mind and a salesman's lips

Try looking through their add/remove programs window. I've seen lots of this stuff. It's usually disguised as some program that "improves" their internet experience and all that crap and most users unwittingly install it and it can be a pain in the ass removing it.

I had one system where I had to reinstall the damn OS before I could get rid of the blasted thing. See, not only does it reset your home page, but it also makes itself your DNS server and redirects DNS errors to the site. In fact, it had even set itself up as the proxy server, which totally killed the customers internet service becuase our ISP doesn't allow any of that bullshit.

All I can say it good luck.

And if you find a good way to get rid of it, please let me know.

I found something REALLY odd a couple of nights ago. It came up with one of those error boxes to end a program that is no longer responding to end it. It was for something called BigMac.exe. As soon as I ended it, the computer shut down. I got the worse feeling about it but on restart things were fine. I found the file under D:\WINDOWS\BigMac.exe The file description was "This stuff is pretty good" or something like that. Deleted the bugger.....but my modem does suspiciously try to connect to the internet when it is not told to, set to, or needs to.

"You don't know how paralysing that is, that stare of a blank canvas, which says to the painter: you can't do a thing." - Vincent Van Gogh

Get a virus scanner...

http://vil.mcafee.com/dispVirus.asp?virus_k=99595

I'd bet money Spybot will fix your prob there(it also has immunize features), we couldnt do without it in the net Cafe where I work its great !
One thing in work we can't figure out is why some of the computers stop access to hotmail.com and stop msn msngr from running until the machine is wiped, some sort of anti-MS virus ? (I kinda like it) But when every customer uses Hotmail .......
(all pcs have spybot + norton av).

Whats an AMP package ?