Posted on 11/27/2003 6:37:51 AM PST by WL-law
This is a Freeper-line call for help. Somehow we have, on our home PC, downloaded a hidden Trojan-horse type application that has:
(a)switched my Internet Explorer homepage (from FR) to a Google-type site called Orbit Explorer, and
(b)brought with it a whole world of pop-up spam (a suspicious amount of such that points me to Microsoft products, BTW).
Part of the deviousness of the Trojan horse is that it self-prevents its own removal. It blocks access to Internet Explorer->Tools->Internet Options, which effectively blocks the end-user from re-setting the homepage back to the original home-page. Instead, a message pops up that says “This operation has been cancelled due to restrictions in effect on this computer…”
I have SpyBot installed on my PC, and when executed it did identify the files in question. However, when I removed the files per SpyBot, then Internet Explorer wouldn’t work at all – all addresses end up in the same failure/error message. Since Spybot has a ‘recovery’ function, I was able to re-load the deleted files and can use the system – but I’m stuck with this bogus homepage, and am fighting off pop-ups at a furious pace as I try to use my system.
BTW, this is a home computer used by all ages -- at this point the spam/pop-up is not pornographic but I have a bad feeling that we’ll soon be afflicted by that as well.
Has anyone out there defeated this problem on their own system?
As I said in my post, the Tools option is BLOCKED by the trojan. See my post. It's infuriating.
WL-law has already said that menu option was blocked.
I'm already using Windows XP -- so be prepared, it's NOT a defense against these things by itself.
Called "Spybot Search & Destroy" it is free, and you can download it here:
http://download.com.com/3000-2144-10194058.html?tag=lst-0-1
It works really well, easy to use and will find/eliminate spybots where the virus scanning warez won't. We use this program, and Norton Systemworks and haven't had any problems, after having many problems before doing this.
Then take a look at post #18.
Well, that was my first thought! (LOL!) But the Orbit Explorer people leave no trail as to who they are or where they are. No surprise there.
Do let us know what you try.
Hijack This is a great free program that has worked for me with this type of program.
Do that and run SpyBot while in safe mode.
If it doesn't work then download and use "hijackthis".
And that's all from me.
This is a patently false statement. They will cite examples of animated cursors and other programs that people download and install (that come bundled with spyware) but I was INFECTED (yes, infected with such a spyware VIRUS) when I typed a "soundalike" webpage name for some site.
Some clymer bought a name that would deciptively look like the site I wanted to visit (a Google search took me to the right page). When I got to the false page I saw what looked like a squater's search engine. I never "approved" the installation of any software.
The company knew that they had installed something you and I did not want because these programs will reassert themselves if they are not entirely removed (hidden files deleted). In your case there were even alterations to your system settings so that you could not easily make the change.
Your computer was hijacked and raped by some scumware company.
Don't try to sue though because the advertising lobbyists long ago got the legislation that they wanted from elected officials.
We know it is malicious software of the same nature as a "virus" but the tech-ignorant legislators believe otherwise. Only now (that it is too late) are any laws being drafted to stem the practice (which will just go offshore and out of "our" reach).
Spybot was effective, but tricky -- removing the viruses tended to make IE inoperable.
What finally worked was a combination of the "System Restore" function of Windows XP, coupled with the immediate use of Spybot.
Specifically, I found a date (about 3 weeks ago) where a system restore to that date brought IE back into function. I immediately ran Spybot (careful to keep the virus files updated)and caught the "Orbit Explorer" virus before it could implant itself into the system files.
System has been stable now for a few days, so I think I'm clean.
Again, thanks to all the responders.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.