Tom's Guide | Tom's Hardware | Tom's Games
![]() |
![]() |
![]() |
As of yesterday, my Verizon DSL interface and Local Area Connection interfaces both indicate that I am properly hooked up to the network, but Internet explorer will not load any web pages. It gives me the indication, "page cannot be displayed."
I think I must have a virus, as IE was working properly yesterday morning.
Also, I notice a weird key ("QueenKarton") in the IE section of the registry. Is this an indicator of a virus?

You have a backdoor trojan:
Backdoor.Berbew.G
Beware of this, the scumbag that dropped it on your harddrive may attempt to access private data on your computer.Read about it here:
http://www.symantec.com/avcenter/venc/data/backdoor.berbew.g.html
Update your AV programs indexes and run an in-depth scan on your harddrive.

Thanks. The only problem is that I'm running AVG anti-virus, and according to their website's virus listings, Berbew is not something they recognize. Any suggestions as to what other resources I could use to get rid of it?
Thanks.

OK, from my research it most likely is a trojan. A variant of the Trojan.Win32.Webber worm that is sent via email, auto executes msits.exe then if it's the right one will change something like this (HKEY_CURRENT_USER\Software\Microsoft\QueenKarton = 0xC) in your system registry. There should be MAIN.CHM running in your task manager go ahead and end it. Now most of the hard evidence for this trojan I got off of a swedish webpage where I could vaguely make out the contents.
jOhn

Read this and follow instructions:
Disabling system restore in Win Xp:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239?Open&src=sec_doc_nam&docid=2001111912274039&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl
Thresher

Phil, the removal instructions are in the website reference I gave you, just dial down.They tell you the signatures to look for and which Register keys to check. Just follow the instructions.

![]() |
![]() |
![]() |

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |