THANK YOU!
It sounds like you've been infected with the Webcounter.cc variant.
Here's an excerpt of what it is:
Quote:
Behavior
Adware.SearchCounter changes Internet Explorer's search and home pages, redirects network traffic, and displays browser popup windows.
Symptoms - Attempts to connect to auto.search.msn.com are redirected to in.webcounter.cc.
- The default search and home pages in Internet Explorer are changed to in.webcounter.cc.
- Internet Explorer popup windows displaying in.webcounter.cc are automatically opened.
- On logon, Windows error messages are displayed, stating that "fntldr.exe cannot be found."
When Adware.SearchCounter is executed, it performs the following actions:
- Modifies the following registry keys as shown:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer
"Search"="<WebAddress>"
--------------------------------------------------------------------------------
Note: <WebAddress> is a variable. The adware places the value:
http:/ /%69%6e%2e%77%65%62%63%6f%75%6e%74%65%72%2e%63%63/%2d%2d/?%62%7a%62%6a%72
in the given registry location.
--------------------------------------------------------------------------------
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
"Default_Search"= [WebAddress]
"Search Page"= [WebAddress]
"Start Page"= [WebAddress]
"Use Search Assistant"="yes"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Styles
"User Stylesheet"="%Windir%\hh.htt"
"Use My Stylesheet"= dword:00000001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
"Search Assistant"="<WebAddress>"
"CustomizeSearch"="<WebAddress>"
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer
"ReconfLast"=dword:07D30C01
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer
"Search"="<WebAddress>"
"SearchURL"="<WebAddress>"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main
"Start Page"="<WebAddress>"
"Search Page"="<WebAddress>"
"Default_Search"="<WebAddress>"
"Default_Page"="<WebAddress>"
"Use SearchAssistant"= "yes"
"Search Bar"="<WebAddress>"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Search
"Search Assistant"="<WebAddress>"
"CustomizeSearch"= "<WebAddress>"
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Styles
"User Stylesheet"="%Windir%\Web\tips.ini"
"Use My Stylesheet"= dword:00000001
- Creates two identical files:
%Windir%\Web\tips.ini
%Windir%\hh.htt
These files cause a browser popup window displaying "<WebAddress>" to appear every time an Internet Explorer page contains any of these META tags:
sex
porn
adult
thehun
- Adds this line to the Hosts file:
1089288654 auto.search.msn.com
This causes all the attempts to contact auto.search.msn.com to be redirected to "<WebAddress>"
- Adds the following line to the Win.ini file:
run=fntldr.exe
This is designed to cause the file Fntldr.exe to be run every time you start Windows 95/98/Me. However, during testing by Security Response, the adware did not create or download the Fntldr.exe file. Instead, error dialogs appear after every logon, stating that Fntldr.exe could not be found.
|
Follow the link for further removal instructions @
Hope this helped,
OT
__________________
Slowly but surely getting over the loss of TFP v. 3.0.
Where the hell am I?....
Showering once a month does not make you a better person.
"The ultimate measure of a man is not where he stands in moments of comfort, but where he stands at times of challenge and controversy."
Martin Luther King, Jr.
Last edited by oldtimer; 03-14-2004 at 10:30 AM..
|