Myfamily.com - hijacked network - server 3 pcs

[heavyfreak]

I have a network, that has been hijacked by myfamily.com, not sure how it happened. the company website

http://www.aplusvacationhomes.com

is entered into the browser the address changes to :

http://www.aplusvacationhomes.com/isapi.dll?c=home&htx=loginfrontmember

and it takes you to myfamily.com, same with any page desired. Also, it over-rides yahoos seach.

this happens on the server and 3 pcs, Virus scan's have been run, norton corprate (latest def's) and using bitdefender.com
I've used, cwshredder, hijackthis, spybot1.3.
--nodda

I have search the registry, found nothing, pc, nothing and the web, nothing. This is the first encounter with this type of spyware, any info would be greatfull, only out come i can see now is to restore all the pcs, and server! I DON'T LIKE THIS OUTCOME! PLEASE HELP!

 

[diogenes10]

http://computercops.biz/postlite65605-myfamily.html

Here's one person's solution, maybe it will help you.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[diogenes10]

http://64.233.167.104/search?q=cach..._pages/tasklist_c.htm+symantec+crypserv&hl=en

(all the way to the bottom.)

I'm not sure about that fix above, that file looks like it can be a legitimate file.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[heavyfreak]

For sizzle! thank you, thank you, I'll see what happens

 

[PaulTEG]

I'm not sure about that fix above, that file looks like it can be a legitimate file.

Social Engineering - they'll call the file anything that looks right, or can be explained

Find the directory the file resides in, right click the file, and check the file properties, and it should give the company details, product version etc. if it looks bogus, stop the service, rename the file, and reboot the machine

if it complains, rename it back, you may need emergency boot disks

Standard Disclaimer
If I told you to put your hand in the fire, would you do it?
If the answer is yes, do nothing
If the answer is no, use your own judgement, and bear in mind I take no responsibity in this act (either express or implied)

HTH
--Paul

It's important in life to always strike a happy medium, so if you see someone with a crystal ball, and a smile on their face ... smack the fecker

 

[heavyfreak]

No can do people, this last fix was a failure, I used task manager program, ran on all systems, did not find the crypsrv service, or something like that, nodda, no can do, anyone else out there who has hear something of something, from someone? please help.

 

[jlong515]

I suggest you download and run HiJack This, save the log file without fixing anything, and then post the log file in the Virus/Spyware forum here for an expert to peruse. Someone there should be able to get you fixed up. You may even try searching that forum first for the MyFamily deal and someone may have already posted the fix...

Good Luck,

Jeff

MCSE,CCNA,ASE