Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help! Www.safetyhomepage.net Help!


  • Please log in to reply
10 replies to this topic

#1 Lexy

Lexy

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 06 September 2006 - 11:15 AM

1. A warning had appeared in a dialogue box of Microsoft Internet Explorer showing warning: w32.myzor.fk@yf is a virus that infects files with .exe extensions. It attempts to steal passwords and private information from the infected computer.

2. My browser was hijacked to " http://www.safetyhomepage.net/ " Then it switches to: http://malwarewipe.com/?rid=246


3. CRITICAL SYSTEM ERROR! also appears in my toolbar as an icon w/ a question mark blinking into a red prohibit sign. A pop up box had occured stating that the third party of this "critical system error" is in the process of stealing all my passwords and email addresses. and if i click the icon on the toolbar it directs me to http://www.virusburst.com/?aff=334 which i believe is a hacker. HOW DO I GET RID OF CRITICAL SYSTEM ERROR?


4. There was about 3 other icons on my desktop which I deleted....one was green, the other was blue, and the last had a yellow triangle with a "!" labeled as Online Tech Support, the other Online Guide, and last was the Error. I deleted that as well because i figured it was a hacker as well.

5. A Warning pops up saying that I had a "Puper Trojan" on my computer.

How would I resolve this issue? How severe is this?

Can you please help? I don't know what to do.....

Edited by Lexy, 06 September 2006 - 11:43 AM.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:20 AM

Posted 06 September 2006 - 11:53 AM

Hello Lexy

We have a self-help section for removing common malware.

Please see the self-help tutorial How to remove VirusBurst.

Start with that and post back if you continue to have problems.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Lexy

Lexy
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 06 September 2006 - 11:59 PM

Ok

I had followed the steps exactly. But for some reason at step 10. I had to stop because I coulnd't find eowygj.dll, duxzj.dll, gtpbx.dll , or xtgwjrm.dll on my computer. How would I go about the few steps? b/c It wouldn't appear on my computer.

I also noticed that virusblast is now out of my toolbar, and safetyhomepage.net is gone. However my homepage keeps going to msn.com and that's not my default page.

#4 Highwolven

Highwolven

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:20 AM

Posted 07 September 2006 - 12:02 AM

Lol...and I'm trying to get mine to go back to msn. Mine is still stuck on the Safetyhomepage.net

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:20 AM

Posted 07 September 2006 - 06:16 AM

Lexy, before you can complete step 10 in the manual method, you are asked to reconfigure windows to show hidden files and folders in step 9. Did you do that? If so and your not finding these files, then you may have another smitfraud variant on your system rather than virusburst. In addition to virusburt you did mention safetyhomepage and malwarewipe. Many of the smitfraud family of infections cause similar critical system error popup alerts. Generally smitRem.exe and the roguescanfix will be able to clean these infections as well.

Is the reason your using the manual removal method because the automatic removal method did not work? If not, then you should be following the instructions for automatic removal.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Lexy

Lexy
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 07 September 2006 - 10:57 PM

I started out following the automatic steps, but then my computer didn't show one of the icons on safe mode that I needed in order to follow further instructions. So I decided to try the manual steps, I had gotten to the manual step no. 9, but then that didn't work out. So I went back to trying to follow the automatic steps but I had to do it w/o the safe mode then it had finally worked.


For the Panda Active Scan log would I need to paste it here or keep it?
I also managed to get a HijackThis log as well.
Should I post the Hijack Log here?

I really appreciate your time and help so far :thumbsup:

P.S.
I don't remember exactly which instructions stated but it said to go to and right click on "My Computer" and go to "Properties", then go to "System Restore", and then it had said check box "Turn off System Restore on all Drives."

Should I leave it the way the instructions told me to? B/c it says if I turn it back
"System Restore can track and reverse harmful changes to your computer."

Edited by Lexy, 07 September 2006 - 11:13 PM.


#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:20 AM

Posted 08 September 2006 - 05:37 AM

Have the popup alerts and browser redirections stopped? Are you having any other problems? If not, then you can turn system restore back on and create a new restore point.

If your still having problems then post your hijackthis log in the HijackThis Logs and Analysis Forum, not here, for assistance by the HJT Team Experts.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. Please include the top portion of the HijackThis log that lists version information. An expert will analyze your log and reply with instructions advising you what to fix.

It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. Please be patient. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have no replies as this makes it easier for them to identify those who have not been helped. If you post another response, a team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

If after 5 days you still have received no response, then post a link to your HJT log here.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 Lexy

Lexy
  • Topic Starter

  • Members
  • 29 posts
  • OFFLINE
  •  
  • Local time:02:20 AM

Posted 08 September 2006 - 12:54 PM

The pop-ups have stopped, and the browser is back to normal. Thanks for helping with that!

As for Roguescanfix, SmitRem, and FixVB would I leave it installed or would I go ahead and uninstall it?

There's a few things i've noticed.....
When I'm using animated avatars that used to work, it isn't working now. Also if i'm on a website that page would stop responding, it'll send an error report stating the page was nonresponsive.
And sometimes a script error would appear asking if I still wanted to run that page.
Can that be fixed?

Now I didn't turn the system restore back to normal nor did I post the hijackthis yet because I noticed those few problems. But after those few problems are resolved then would I turn system restore back on, and then post HJT? Or just go ahead and post the HJT?

Edited by Lexy, 08 September 2006 - 12:56 PM.


#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:20 AM

Posted 08 September 2006 - 01:14 PM

You can delete the tools you used for the fix. Some of these specialized tools get updated by their creators as new malware variants are discovered. If you ever needed them again, then it would be best to just redownload so you have the most current version. Your remaining problems may or may not be malware related or could even be a combination. Hard to say without actually looking at a hijackthis log so go ahead and post it as I previously instructed. Post a note above your log something like "I just removed VirustBurst with the tutorial but still have a few problems. Then explain what the problems are.

You can turn system restore back on so you have a new restore point from where you are now. Better to have it available just in case. After your log is reviewed and everything cleaned, then you can create another new restore point from which to roll back to if necessary.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 Finbarrb

Finbarrb

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:20 AM

Posted 08 September 2006 - 04:58 PM

I have the same or a very similar problem.

1) I have the "blinking icon with the message "your computer is infected with the last version of PSW.x_Vir trojan etc

2) At least that is the latest virus name but in my quartentine i get noticce that it is a Trojan called isamini.exe and it is in a folder called Media-Codec

3) i have done full system scans but no luck and icons keep appearing on my desktop and or menu

Anybodys help would be appreciated - I am not great technically

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:20 AM

Posted 08 September 2006 - 06:19 PM

Hello Finbarrb

See How to remove Media-Codec 4.0 via Add/Remove Programs. Also remove Internet Explorer Security Plugin 2006 and Internet Security add-on if you find them in Add/Remove Programs.

If you think you have VirusBurst, then see the self-help tutorial How to remove VirusBurst.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users