IE 6 homepage reset

[Guest]

Hey all,

I recently had a Spyware infection that I've completely removed from my
system, but for some reason, my IE homepage is still resetting.

Spyware files were: Winsrv32.exe which dropped susp.exe and runsrv32 into my
start up menu. Like I said, I was able to successfully remove all the files,
but IE is still resetting my homepage.

Any tips are greatly appreciated.

Thanks

 

[MAP]

Hey all,

I recently had a Spyware infection that I've completely removed from
my system, but for some reason, my IE homepage is still resetting.

Spyware files were: Winsrv32.exe which dropped susp.exe and runsrv32
into my start up menu. Like I said, I was able to successfully
remove all the files, but IE is still resetting my homepage.

Any tips are greatly appreciated.

Thanks

Obviously this is incorrect, How did you "clean" the infection? what tools
did you use if any?

http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLD,GGLD:2006-
01,GGLD:en&q=Winsrv32%2Eexe


http://www.symantec.com/avcenter/venc/data/trojan.aduent.html


http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLD,GGLD:2006-
01,GGLD:en&q=susp%2Eexe

 

[siljaline]

Hey all,

I recently had a Spyware infection that I've completely removed from my
system, but for some reason, my IE homepage is still resetting.

Spyware files were: Winsrv32.exe which dropped susp.exe and runsrv32 into my
start up menu. Like I said, I was able to successfully remove all the files,
but IE is still resetting my homepage.

Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.networktechs.com/forumdisplay.php?f=130)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)
(http://www.malwarebytes.org/forums/index.php?showforum=7)
(http://www.wilderssecurity.com/forumdisplay.php?f=26)
(http://makephpbb.com/phpbb/viewforum.php?f=2)
(http://forums.techguy.org/54-security/)
(http://forums.security-central.us/forumdisplay.php?f=13)
(http://castlecops.com/forum67.html)

Post back the URL where you posted your log, *not* the entire log.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

Reply to group, as return address
is invalid that we may all benefit.