hijacked home page!!!

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi,
An email said I got a postcard then I clicked the link. I saw a plug-in
window openned. Although I imme disconnect and closed my computer, but still
my IE was hijacked!

Every time I open my IE, it goes to a sexy web.

I opened the "Internet Options" under "General", I can see the "Home page"
changed to that sexy site.

I retyped another site or even clicked "use blank", then clicked "Apply" and
clicked "confirm". But after all, nothing change, still that sexy site!

I then used HijeckThis.exe V.1.97.7 scanned, but still no use.

May be HijeckThis can kill some of its link, so even my IE did not open, but
my internet line is on, then it can automatically rework! I can see a
plug-in window open, then after it finished, that sexy site comes up!

Now what can I do to clear it??

Waiting urgently for yr good advice.

Best rgds
Salina
 
Update your virus program and do an immediate scan

Email-Worm.Win32.Zafi.d
http://secunia.com/virus_information/13871/zafi.d/

http://www.news.com.au/common/story_page/0,4057,11696996%5E15306,00.html
Worm arrives as Christmas card
Correspondents in Helsinki
December 15, 2004

INTERNET security experts have warned of a new virulent email worm
particularly successful in infecting computers as it is disguised as a
multilingual electronic Christmas card.

"We think this worm will be big, because of its timing and the fact that it
comes in 15 different European languages," head of anti-virus research at
Finnish firm F-Secure Mikko Hyppoenen said.

The virus, dubbed Zafi.D, is a traditional internet worm infecting computers
by email and distributes itself by using email lists on contaminated
personal computers.

Its Christmas greeting is in the language of the recipient, decided by the
country code at the end of the email address, making it all the more
dangerous, Mr Hyppoenen said.

Zafi.D also opens a back door on infected PCs, making it possible for
outsiders to use them to distribute unsolicited bulk email advertisements,
or spam, and launch malicious attacks to close down websites, he said.
 
Hi,

Thank you very very much for yr imme help.

I update my virus program imme and found 2 files infected! Then deleted
them imme and everything back to normal.

Thanks a lot.

Best rgds
Salina
 
Hi,

After deleted 2 infected files, my IE returned to normal and no more pop up
of that sexy web site.

However, formerly when I clicked to dial up, I can imme hear the connection
sound of my modem until it get connected. But now it is totally silent! I
don't know whether it is connecting or the line is dead.

How can I make it sound again? If the line connected, I go to those webs
with sound, I can still hear music or what ever sound it is. Just the
dialing sound I do not have!

Waiting for yr advice.

Best rgds
Salina
 
Back
Top