Computing.Net > Forums > Security and Virus > IE Hijack?

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

IE Hijack?

Reply to Message Icon

Name: PhilR
Date: June 28, 2004 at 07:49:35 Pacific
OS: WinXP
CPU/Ram: Dell
Comment:

As of yesterday, my Verizon DSL interface and Local Area Connection interfaces both indicate that I am properly hooked up to the network, but Internet explorer will not load any web pages. It gives me the indication, "page cannot be displayed."

I think I must have a virus, as IE was working properly yesterday morning.

Also, I notice a weird key ("QueenKarton") in the IE section of the registry. Is this an indicator of a virus?



Sponsored Link
Ads by Google

Response Number 1
Name: ranchhand
Date: June 28, 2004 at 12:28:30 Pacific
Reply:

You have a backdoor trojan:
Backdoor.Berbew.G
Beware of this, the scumbag that dropped it on your harddrive may attempt to access private data on your computer.

Read about it here:

http://www.symantec.com/avcenter/venc/data/backdoor.berbew.g.html

Update your AV programs indexes and run an in-depth scan on your harddrive.


0

Response Number 2
Name: PhilR
Date: June 28, 2004 at 13:13:28 Pacific
Reply:

Thanks. The only problem is that I'm running AVG anti-virus, and according to their website's virus listings, Berbew is not something they recognize. Any suggestions as to what other resources I could use to get rid of it?

Thanks.


0

Response Number 3
Name: stillwellvj
Date: June 28, 2004 at 13:37:17 Pacific
Reply:

OK, from my research it most likely is a trojan. A variant of the Trojan.Win32.Webber worm that is sent via email, auto executes msits.exe then if it's the right one will change something like this (HKEY_CURRENT_USER\Software\Microsoft\QueenKarton = 0xC) in your system registry. There should be MAIN.CHM running in your task manager go ahead and end it. Now most of the hard evidence for this trojan I got off of a swedish webpage where I could vaguely make out the contents.

jOhn


0

Response Number 4
Name: Thresher
Date: June 28, 2004 at 20:57:01 Pacific
Reply:

Read this and follow instructions:

Disabling system restore in Win Xp:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239?Open&src=sec_doc_nam&docid=2001111912274039&nsf=tsgeninfo.nsf&view=docid&dtype=&prod=&ver=&osv=&osv_lvl

Thresher


0

Response Number 5
Name: ranchhand
Date: June 29, 2004 at 08:15:19 Pacific
Reply:

Phil, the removal instructions are in the website reference I gave you, just dial down.They tell you the signatures to look for and which Register keys to check. Just follow the instructions.


0

Related Posts

See More



Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: IE Hijack?

IE hijacked www.computing.net/answers/security/ie-hijacked/2252.html

IE HiJacked! www.computing.net/answers/security/ie-hijacked/15504.html

IE hijacked by atrueprotection.com www.computing.net/answers/security/ie-hijacked-by-atrueprotectioncom/20185.html