--> Portal Search Menu <-- KIll It!

  • Thread starter Thread starter Sailor Tin Nyanko
  • Start date Start date
S

Sailor Tin Nyanko

Some moron managed to get this on my mom's computer.
Anyone heard of it and know how to get rid of it? Also..
anyong heard of "ray.exe"? Can you E-Mail responces to
(e-mail address removed) as well as post them here?
 
Maybe would help if I describe, lol. It's a search bar..
and some other stuff. I go through and delete stuff
related to it and it reappears (all the junk, in all the
places I deleted from). It appears in every single window
and makes fake pop up that are connected to the window you
are looking at instead of haveing their own minimized bar
at bottom of screen.
 
http://securityresponse.symantec.com/avcenter/venc/data/swporta.trojan.html

This Trojan requires various components in order to work. The components may
have the following file names, depend on the version of the Trojan,
Winn32.exe
Winn32.mcs
SWportal*.exe
SWCaller*.exe
SWportal.js
SWportal1.gif
SWportalero.html
SWportalkop.gif
SWportallink.html

When the Trojan is executed, it does the following,

It changes these values

Start Page
Startpagina

in the registry key

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\

to a HTML page on the local hard drive, for example, C:\<the folder name of
the Trojan program>\Winn32.html

=======
http://www.mvps.org/inetexplorer/Darnit.htm#swportal
 
Back
Top