pop up starting Internet explorer 6 on w2k pro machine

[mastermagik1]

When opening Internet explorer 6 or any webpage, a pop up appears and mcafee vshield picks it up as trojan vbs/psyme and then allows you delete this. I have run programs like Spybot and Ad-aware but this is still happening. Does anyone know where this link is placed in the registry.

Thanks. Darren

 

[jrbarnett]

Have you run a full virus scan with Mcafee over the system?

John

 

[mastermagik1]

yer, picked nothing up, think it must have added a registry entry somewhere that fires up a link when opening ie, just need to find it though.

 

[jrbarnett]

If it is VBS/Psyme:

http://www.pestpatrol.com/pestinfo/t/trojandownloader_vbs_psyme.asp

But McAfee has had some false names reported as VBS/Psyme:

http://vil.nai.com/vil/content/v_100749.htm

I would check to ensure that your DAT files are up to date and try again.

John

 

[Crazyfitz]

First check your Virus Definition version per

http://vil.nai.com/vil/content/v_100749.htm

Second check your running processes for "1.exe" and end that process if running. delete the following files if they exist.

1.exe
5.htm
5a.htm
error.jsp
gift-with-headers.html
html-404 first copy-cat trojan horse.html

Please, Back up registry first.
Then,search the registry for "1.exe" and delete any keys found containing references to this file.




George
MCSA +Messaging (Win2k) A+, Net +

 

[mastermagik1]

Had a search , but none found, dats are all up to date. I think the pc is clean, but the website it links off to has the virus. When opeing IE the homepage opens "google". then a seperate window opens linking to another website that contains the virus.

 

[Crazyfitz]

try doing a registry search for the site the second window is attempting to open.





George
MCSA +Messaging (Win2k) A+, Net +

 

[mastermagik1]

tried that, but it opens diffent windows. only a couple have that virus.