hijacked View Source

[Ivo]

Hi,
Using IE6 on WinME, when I click "View Source" (from the contextmenu or
menubar) I no longer get to view the source, but instead a new window is
opened and a casino site loaded therein. According to Norton I am virusfree
and I see nothing suspicious in the registry. Anyone familiar with this? How
can I restore it?
Thanks,
Ivo

 

[Don Varnau]

A casino site in View Source? That's a new one... ;-)

Work through the solutions (CWShredder, Ad-aware, Spybot) at
http://mvps.org/winhelp2002/unwanted.htm Also note the security tips on that
page.

Additional information at:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.htm

Don

 

[Ivo]

A casino site in View Source? That's a new one... ;-)

Work through the solutions (CWShredder, Ad-aware, Spybot) at
http://mvps.org/winhelp2002/unwanted.htm Also note the security tips on that
page.

Additional information at:
The Parasite Fight http://www.aumha.org/a/quickfix.htm
Bugs, Glitches & Stuffups: http://www.mvps.org/inetexplorer/Darnit.htm

Thanks for your suggestions. Doxdesk and Spybot report nothing unusual. I
have however found that 'they' have taken over notepad. In my Windows folder
there are files called "NOTEPAD.EXE" and "notepad.exe.bak". They are both
from the spammers, with their icon. Any click that would cause notepad to
open, now leads me to their site. I suspect all will be well again if I just
remove these files and get a genuine Notepad back. Where can I download
that?
Thanks,
Ivo

 

[Don Varnau]

Thanks for your suggestions. Doxdesk and Spybot report nothing unusual. I
have however found that 'they' have taken over notepad. In my Windows folder
there are files called "NOTEPAD.EXE" and "notepad.exe.bak". They are both
from the spammers, with their icon. Any click that would cause notepad to
open, now leads me to their site. I suspect all will be well again if I just
remove these files and get a genuine Notepad back. Where can I download
that?
Thanks,
Ivo

- - - - -
Run msconfig. On the general tab, click on Extract File. "Restore from" is
C:\WINDOWS\OPTIONS\CABS. "Save file in"... I would save it to TEMP or
another directory, delete the corrupt files, then move notepad.exe to
C:\WINDOWS

Hope this helps,
Don

 

[Ivo]

- - - - -
Run msconfig. On the general tab, click on Extract File. "Restore from" is
C:\WINDOWS\OPTIONS\CABS. "Save file in"... I would save it to TEMP or
another directory, delete the corrupt files, then move notepad.exe to
C:\WINDOWS

Thank you, but which file in C:\WINDOWS\OPTIONS\CABS do I select? None of
the names, like NET3.CAB and WIN_10.CAB, suggest they contain Notepad.
By the way, my Windows Media Player is also corrupt.
Ivo

 

[H Leboeuf]

Check this out this is probably the virus.
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
--

And read this: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051


Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

 

[Ivo]

"Ivo" wrote

Check this out this is probably the virus.
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

Thank you, but I don't use Outlook and noneof the listed files are on my
machine.

And read this: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051

That 's always helpful, but I still don't know how to get Notepad back!
Still stuck in C:\WINDOWS\OPTIONS\CABS...
Thanks
Ivo

 

[H Leboeuf]

If you have Windows 98 just run SFC.EXE and let it extract the notepad.exe
file.

System File Checker explained
....hopefully in layman's terms.
http://users.westelcom.com/rogersr/sfc.htm
--

I changed by Notepad to this a long time ago. Try it.

Notepad+
Roger Meurs' outstanding freeware replacement for the Windows Notepad
program, with many more features -- and without Notepad's limitations!
http://www.mypeecee.org/rogsoft/

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

 

[Robert Aldwinckle]

I still don't know how to get Notepad back!

Try posting about that in a newsgroup which specializes in your OS.

FWIW my understanding is that your sfc command can automatically
show you which .cab file to use. Extract is only needed when you
are doing something non-standard (or when your OS doesn't give you
any alternative.)

Hmm... here's a caveat and some links about the command

<title>KB192832 - System File Checker Tool Extracts Incorrect File Versions</title>

(MSKB Boolean search for
sfc AND kbwin98search
)


Good luck

Robert Aldwinckle

 

[Ivo]

"H Leboeuf" wrote

I had WinZip look through all cabinet files until it found notepad in
WIN_17.CAB.
All if well again now. Thank you all very much.
Ivo