Tech: Browser home page problem

Subject: Browser home page problem
From: GUEST,Tomtom
Date: 10 Feb 02 - 11:44 AM

Somebody sent me an attatchment which I stupidly opened and as a result I´ve got a home page on my browser that I´m not able to remove no matter what I try. I´ve changed the address, emptied my casche of all cookies and temp. files and tried to revert to the default site or blank but no matter what I do, this page reappears after I restart windows. Any ideas what I can do??

Subject: RE: BS: Browser home page problem
From: Willie-O
Date: 10 Feb 02 - 12:14 PM

Try upgrading your browser if is an upgradable version. (IE up to 6.0, Don't import your bookmarks et. al., save them separately and start fresh.)

And take whatever you know about the original msg & attachment, and search symantec.com for a cure. Cause you got yerself a virus there mate. If it was the more common persistent-porn-home-page problem, clearing the cookies would fix it.

Good luck. Now ya know--everything you receive from your friends was not necessarily sent by them.

W-O

Subject: RE: BS: Browser home page problem
From: JohnInKansas
Date: 10 Feb 02 - 01:28 PM

Your symptoms sound like the Troj/JetHome virus we encountered recently. Norton "broke" the virus, so it couldn't reset our home page, but the "broken" virus code gave us a persistent error message. It took some substantial cleaning before we got completely rid of it.

Unfortunately, this is one (if it's what got you) that requires editing the Registry for complete removal.

The Sophos site above gives the clearest description, but you may want to also consult Norton's site for more complete cleanup instructions. Norton calls this virus js.seeker.

Note that even the Norton instructions are incomplete. You need to get into regedit and search for all occurences of the "target" homepage that the virus substituted. You can probably safely delete any "key" that contains the name of the "new" homepage.

John

Subject: RE: BS: Browser home page problem
From: JohnInKansas
Date: 10 Feb 02 - 01:50 PM

A little more info:

This virus puts a "shortcut" in your Windows Startup folder, so that it can "reinstall" the homepage everytime you boot Windows. Look for a .dll that doesn't belong there. The name varies, and in addition to those given in the Sophos and Norton sites, you might find "sp.dll" or something else.

Right click on the suspect .dll and check properties to see what file it "points to," and then delete both the shortcut and the "target."

This will probably prevent the virus from "re-executing," but it will have set the unwanted home page in your registry, and to get fully clean you will need to edit the registry as well. If you are not comfortable editing the registry, you can probably just reset your homepage and ignore - at least until you can get some help.

Once you have stopped the shortcut in Startup from resetting, and deleted the "real" .dll that the shortcut points to, you should be able to restore your original homepage.

A caution: if your computer is set up for multiple users, you must repeat the process for each user. This thing can splatter itself all over a machine.

John