Constant "Trusted sites" in status bar

[Guest]

Hi all,
I've just finished cleaning my computer from a virus attack. Someone sat at
my computer a week ago, and I don't know what he's done and what he installed
- but Norton found 79 viruses, which I've finished manually removing now.

However one problem remained still: No matter what site I surf to, the
bottom-right corner of the status bar shows "Trusted sites" rather than
"Internet". Constantly, all sites.

The trusted sites list in my Internet Options is empty, and I have no idea
what's causing this - I'm speculating one of the viruses left something
behind it, even though I deleted the virus' .exe file.

Does anybody know what I can do?

Thanks!

 

[David H. Lipman]

Mere deletion of most infectors is NOT enough. There are helper files, Registry entries and
remnants. That is why you have to follow specific directions from anti virus/spyware
vendors or remeove removal tools. Like the below...

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Dowload the Trend Pattern File by obtaining the ZIP file.
For example; lpt244.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using Trend Sysclean, Stinger and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

You can also try some of the below online scanners.

BitDefender:
http://www.bitdefender.com/scan/license.php

Computer Associates:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

DialogueScience:
http://www.antivir.ru/english/www_av/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

Freedom Online scanner:
http://www.freedom.net/viruscenter/index.html

Kaspersky:
http://www.kaspersky.com/de/scanforvirus

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

RAV
http://www.ravantivirus.com/scan/

Symantec:
http://security.symantec.com/

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com


* * * Please report your results ! * * *

Dave






| Hi all,
| I've just finished cleaning my computer from a virus attack. Someone sat at
| my computer a week ago, and I don't know what he's done and what he installed
| - but Norton found 79 viruses, which I've finished manually removing now.
|
| However one problem remained still: No matter what site I surf to, the
| bottom-right corner of the status bar shows "Trusted sites" rather than
| "Internet". Constantly, all sites.
|
| The trusted sites list in my Internet Options is empty, and I have no idea
| what's causing this - I'm speculating one of the viruses left something
| behind it, even though I deleted the virus' .exe file.
|
| Does anybody know what I can do?
|
| Thanks!

 

[MowGreen [MVP]]

IF, after you've determined that the system is malware free by
following Mr. Lipman's advice, the Trusted Site icon still shows in
the Explorer bar, there is a registry setting that needs to be changed.

Go to Start, Run, type in regedit Click OK.
Navigate to this key -

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InternetSettings\ZoneMap\
ProtocolDefaults\

In the right frame is the Name, http. IF the value is 2 you need to
modify it to 3. Double click http to do so then reboot system.


MowGreen [MVP]
===============
*-343-* FDNY
Never Forgotten
===============

 

[Guest]

Thank you, both.

I tried the registry edit shortly before posting the thread here (I didn't
know where to look for, so I simply searched "trusted" and found the ZoneMap
branch) - it didn't work. As for the cleanup - I indeed ran Adaware and
Norton Antivirus scans prior to the manual removal - I only manually removed
the files that were left after both scans; but thank you for the link to
Sysclean - I ran this scan, but it also didn't find anything new.

I'm not sure what could be causing this, but I'm guessing an on-top windows
install will fix this.

Thanks again!

 

[MowGreen [MVP]]

Was it the AIM "Virus" ?


MowGreen [MVP]
===============
*-343-* FDNY
Never Forgotten
===============