Homepage changing - Virus?

[YoMax]

A friend here at work presented me with this problem he acquired over the weekend. Apparently while browsing he clicked on a link that changed his homepage (he had no specific info; I'm having him write it down and bring it in tomorrow).

The link to that IE homepage is an .exe file, which he says just displays "garbage". He is still able to browse, and to change the homepage back to normal, but after rebooting the problem returns.

Another problem that appeared at the same time is (I think)his file associations have been removed or altered (he is a beginner computer user, so I need to verify that).

Does this have the earmarks of anything in your all's experience? Tomorrow I should have more specific details when he brings more info to work.

 

[iSeriesCodePoet]

Hmm... I know via javascript you can set a page... but I doubt it would automatically change back. I would run a virus scan and see what turns up. Mike Wills
IBM iSeries (AS/400) Programmer

http://www.koldark.net

 

[Grenage]

I had an issue like that once on a PC, it turned out to be a virus called SirCam. The Norton web site has a free download for this virus which will tell you if you have it - and remove it.

http://www.symantec.com

 

[YoMax]

OK, I'm going to have him run NAV tonight and if it finds nothing, then I'll send him to the Norton site for the SirCam check. Thanks, and I'll post our results.

YoMax

 

[confusedlady]

Luckily I haven't had much experience removing/detecting viruses, but aren't there a few that alter the homepage? I do remember one of the things the Lovebug virus did was set your homepage to a particular address everytime it booted. You could change it and think you corrected it, but when you turned on PC and went to net the next day, same homepage...

confusedlady

 

[YoMax]

Ok, my friend wrote down the URL for the offending homepage and brought it to work this morning, and from a quick Google search I determined he has the VBS.ILoveYou.C virus.

Here is the URL:

http://www.skyinet.net/~angelcat/skladjflfdjghk...q4w/WIN-BUGSFIX.exe

I removed the middle portion of random letters. Of course the link doesn't work by now, but that wasn't necessary in his case as the damage was done.

This isn't the nastiest variant of this virus, which hoses most of the files on your hard drive, but will take a bit of work to restore his work files. Thanks to all who responded!

YoMax

 

[Grenage]

Good to hear you got it sorted, just hope it didnt email any important documents out to anyone