Find oplysninger om flg. virus:

IKKE link men skriv beskrivelsen her, tak :)

JS.Trojan.Seeker


This script written in JavaScript language quietly changes a browser\'s home page and search page without user confirmation.

The script uses a MS Internet Explorer 5.0 Typelib security vulnerability to create an HTA file in the Windows start-up directory. This file automatically runs upon the next Windows start-up, and the script in it gains control.

The script in the HTA file modifies the system registy keys where the home and search page addresses are specified (before modifying the keys, the script stores their values into BACKUP1.REG and BACKUP2.REG files in the Windows directory). After this, the script deletes the HTA file (and itself).

Taget fra: http://www.symantec.com/avcenter/venc/data/js.seeker.b.html

Technical description:


When executed, this Trojan horse is usually copied to the Windows \\StartUp folder as the file run.hta. This insures that it runs when Windows starts.

It creates and then executes the registry import file C:\\Windows\\Homereg111.reg. When executed, it modifies Internet Explorer settings by making the following changes to the Windows registry:

In the key

HKEY_CURRENT_USER\\Software\\Microsoft\\
Internet Explorer\\Main\\

it modifies the values

Search Bar
Default_Search_URL
Search Page

so that they all point to a Web page that displays links to gambling, adult, and other sites.

In the key

HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\
Internet Explorer\\Search\\

it modifies the value

SearchAssistant

so that it points to the previously mentioned Web page.

The script also creates a \"favorite link\" titled \"Search The Web\" which links to the same Web page.



Removal instructions:


1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan. Be sure that NAV is configured to scan all files.
3. Delete all files that are detected as JS.Seeker.B.
4. The modified Internet Explorer settings can be reconfigured from within Internet Explorer. To reconfigure the home page, click the Tools menu and click Options; to reconfigure search options, click the Search menu and click Customize.

goulduck/kapla0> hvis i kort gider at forklare mig - på dansk - hvad denne virus gør ved min pc, så får i 50 point hver. På forhånd tak :)

Den ændrer din startside og søgeside

øøøhhh.... har haft virussen i en ugen nu, og min startside er stadig eksperten.dk - er det fordi den kun virker på en UK-Windows?

Hvorfor sletter du den ikke bare?

kapla0> den er slettet.
Laver du et svar så du får dine point?

:-)

I får 50 hver - selv om goulduck ikke skrev noget :)

Takker for point. :)

Nej jeg skrev ikke noget - hvorfor skulle jeg begynde at skrive en historie, når det allerede er skrevet?

goulduck> Vær nu bare glad for dine point, ok :)