0CAT Hijacker Prevention

[Scott]

This SOB kept installing along with STHome Page and quickmetasearch.com. I
think they're all part of the same thing. So far what I did seems to be
holding. I have ZoneAlarm and Norton AV installed.

1. Add these programs to your Program Control in ZA and block all. You'll
find them in your Temp directory. Don't delete them yet!
0cyp.exe A~NSISu_.exe sthp.exe stl.exe

2. Open Notepad and save blank file as access_now.txt to your Temp dir.
Then rename it to access_now.exe. Then add it to your ZA Program Control
and block the sucker.

3. Next unistall 0CAT Yellow Pages from Add/Remove Programs.

4. Search for STHome Page and STLinks in Program Files and use their
uninstall programs to get rid of them.

5. Finally, open REGEDIT and delete quickmetasearch.com entries in HKLM,
HKCU and HKU. These are all in Software\Microsoft\Internet Explorer\Main
keys.

Keeping my fingers crossed!

 

[Agent_C]

Same problem here, except I just have Norton. Do you have any idea
what the method of infection is?

A_C

 

[Scott]

The only file that Norton kept catching was access_now.exe. ZoneAlarm also
caught it trying to act as a server. Since I created a false clone, my file
size is not correct but I still haven't had any reoccurrence.