Jump to content


Photo

Had a virus message, can't find anything now


  • Please log in to reply
4 replies to this topic

#1 wadahoot

wadahoot

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 25 May 2004 - 01:46 AM

I tried reading the FAQs prior to posting, but the link isn't working. From what I remember when posting before:

Windows XP
IE 6.0.2800
cable modem with AOL 'bring your own'
All Windows updates done
Have run Ad-Aware
Have run SpyBot
Have SpywareBlaster on 'full blast'!
Have Norton Anti-Virus - all updated - ran full scan
Have run TrendMicro's Housecalls

I have 2 issues I could sure use help with!

I was surfing the web and had a pop-up message from Norton saying that it had detected a virus on my computer called VBS.Redlof.A in \Documents and Settings\.....\Column[1].htm (the ... are there because I was not able to expand the window to see what was in between! Arrggghh!)
I ran everything I could think of (see above) and everything was clean. I did a Search for a file called AND containing 'column[1].htm and it cannot find one.
So where the heck did the virus go? Can one get a virus only for the amount of time that we're on that particular webpage?! That's the only (admittedly bizarre!) explaination I can come up with!

Secondly, I have my home page set at Blank, but just lately I have been sent to the MSN homepage! In Ad-Aware I have gotten hits saying 'possible hijacking attempt' which I think this may be.

Could someone please help me work though these 2 problems? I know they aren't major (I've had much worse, and thank you all once again for your time and attention!), but it is frustrating to do all I can, and still hit a brick wall of non-information! Thanks very much!

Take Care,
Anita

#2 wadahoot

wadahoot

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 25 May 2004 - 01:53 AM

Oh, I wanted to add one more question, please.

I do not see on the Hijack This software how to check for updates. I do not see on the webpage how to do it either. If someone will help me and need a Log, I would like to be sure it's the most recent program. How do I do this, please?

Anita

#3 WinHelp2002

WinHelp2002

    Taking back the Internet

  • Global Moderator
  • PipPipPipPipPip
  • 5,365 posts

Posted 25 May 2004 - 04:18 AM

Hi,

a virus on my computer called VBS.Redlof.A in \Documents and Settings\


Try this: "Flush System Restore" (see below)
Basically turn off System Restore and then ...

1) Restart in Safe Mode (see "How To:" below)
2) Enable Hidden Files (see "How To:" below)

Start | Run (type) "%temp%" (no quotes)
Completely delete the entire contents of that "temp" folder.

Restart normally and then ...

Resize your browser cache, then rebuild the cache folders ...
How To: Delete the Internet Explorer Temporary Internet Files
http://www.mvps.org/...02/delcache.htm

Restart and run a full system (AV) scan and reboot, then enable System Restore.

After the above post your log ... here's how:

Download "Hijack This!"
http://www.spywarein.../hijackthis.zip

Create a folder via Windows Explorer for HijackThis, unzip, then move the file (HijackThis.exe) to that folder. This way any backups created are saved in a legit folder.

Double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Click: "Save Log" (generates: "hijackthis.log")

Copy and Paste the entire log into your next post.

Note: do not attempt to "Fix" anything, as we need to see the entire log.
Also if you have any Startup items unchecked in Msconfig, uncheck those items, reboot, then post a fresh log. HijackThis can not "see" disabled items in Startup.

Hint: after posting your log click "Track this topic" at the top of the page, this way you will be notified (email) when a response is made to your post.

In Ad-Aware I have gotten hits saying 'possible hijacking attempt'

About:Blank issue:
http://www.lavahelp....04/05/1801.html

Edited by WinHelp2002, 25 May 2004 - 04:34 AM.

Mike
Former Microsoft MVP Posted Image 1999-2012
"There's no place like 127.0.0.1"
Posted Image
Blocking Malware, Parasites, Hijackers, Trojans, http://www.mvps.org/...p2002/hosts.htm with a HOSTS file

#4 wadahoot

wadahoot

    Member

  • Full Member
  • Pip
  • 28 posts

Posted 25 May 2004 - 12:22 PM

In Ad-Aware I have gotten hits saying 'possible hijacking attempt'

About:Blank issue:
http://www.lavahelp....04/05/1801.html

Hello, Mike, and thanks for your help so far. I will go through all the steps you suggested and appreciate the information. I will post my log afterwards.

I would like to follow up on the About: Blank thing. I understand (I think!) what the LavaSoft page is saying. I think the difference is that I am actually getting MSN.com homepage as my homepage, even though I have it set at Blank. This doesn't happened every time, but probably every two days or so.
Am I missing how unchecking the Ad-Aware will fix this? :unsure:

#5 WinHelp2002

WinHelp2002

    Taking back the Internet

  • Global Moderator
  • PipPipPipPipPip
  • 5,365 posts

Posted 25 May 2004 - 12:48 PM

Hi,

Am I missing how unchecking the Ad-Aware will fix this?

Most likely ... if\when you remove the "about:blank" then IE defaults to MSN because the setting is actually missing. I have mine set to "about:blank" and just ignore the AWW prompt.
Mike
Former Microsoft MVP Posted Image 1999-2012
"There's no place like 127.0.0.1"
Posted Image
Blocking Malware, Parasites, Hijackers, Trojans, http://www.mvps.org/...p2002/hosts.htm with a HOSTS file




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button