They're taking my home page!!!

Sangre

OK now everytime i log off(turn off comp-broadband) My homepage turns into a hackers webpage!!
This has happened about 3 times since today so they must have some programme in my computer I d/led is there anyway I can find it or stop them taking my homepage.


BTW sorry if thisn is the wrong forum I wasnt sure!

lynchie

Have you got AV software installed, if so make sure you have the latest updates and run a full scan. It may be a known trojan that your AV software should detect and clean. Also, check what is been loaded at startup on your machine. Check the registry (cant remember the branch, do a google to find the correct branch) and make sure there are no funny named programs loading at startup

Sangre

This adver.setup or something box keeps popping up at startup but I cant fing it to delete it,
BTW whats AV?

STaN

Anti-Virus

run one with all the latest updates!

Also get youself a copy of "Ad-ware 5.83" and run that too

Keeks

This is really more of a security issues than a hosting one.....

Sangre

Ok I ran AVG and a trojan horse was detected, found in 40 files but couldnt remove it from one, WinServices.exe
Should I d/l this file or get an update?
I have WIndows Xp btw
Also this really f0cking annoying window keeps popping saying Ive a virus and I cant get rid of it!

tom-thebox

It sounds like a old worm called W32/Yaha-K adds values to your registry, setting them to run the WinServices.exe file whenever you boot up or log on to the network.

This effected a lot of outlook users a while back. Try and update your anti virus and do another scan.

Full info for this virus can be seen at the link below.

http://www.sophos.com/virusinfo/analyses/w32yahak.html

ecksor

Where is your webpage hosted (i.e, hosting facility, free webspace, in your gaffe?)

Exactly what do you see there instead when you log off?

tom-thebox

I took it his homepage was hosted locally. I noticed this post after I made my post.

http://www.boards.ie/vbulletin/showthread.php?s=&threadid=75420

Sangre

I havent checked the site yet but im so f00ked!

Yeah it is the Yaha-k worm, i restarted my computer and all the icons beside my clock are gone. And no *.exe or shortcut to it on my copmuter works!!!!FS HELP ME!!!
Its says 'xxx' file cant be found I can only open folders, my computer and explorer!

Please tell me what to do, or ask for amy information you need. I cant even run the anti-virus program!!!

ecksor

I only read the first post before replying. I think someone moved it here (keeks probably) and I assumed it was a new thread as a result.

ecksor

Try to salvage any data you need from the machine, then reinstall.

theciscokid

i recommend you go to www.symantec.com

and find a removal tool , they usually have them for high threat viruses in the wild..

symantec's second biggest offcices and manufacturing plants are in blanchardstown, give em a ring if you're really stuck

theciscokid

http://securityresponse.symantec.com/avcenter/venc/data/w32.yaha.k@mm.html

Sangre

Okay....*deep breath*
I checked out the virus site, and got some download and everything seems to be fine, i can run *.exe programmes again. Im still on high alert though, what about the infected Winservices.exe file, can i d/l it.
I got my computer off Time so i dont have any installation cds


Oh and a big thank you to everyone you offered advice Its a big relief knowing I can come here

tom-thebox

No problem at all your invoice will come in the post.

Sangre

Originally posted by tom-thebox
No problem at all your invoice will come in the post.

Theres always a catch

tom-thebox

just kidding

Martyr

If you're on Windows, it could be a VBScript/JScript which runs when you log on and off.
HKEY_USERS\DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
I'm not saying it is that..but it could be a simple matter of deleting any suspicious keys and programs you haven't installed yourself.
But if its an executable, then you may have to reinstall the files that can't be recovered by your AV scanner.