|
Posted by Thomas Goodson on September 16, 2005, 2:58 pm
If you were Registered and logged in, you could reply and use other advanced thread options
I have a customer's web site that seems to be infected. When the local
internet cache is empty and it is the first time that I hit the site from a
given IP address, I'll get back the normal web page with the following text
added to the top of the message:
<script language=JavaScript src=/oofohmg.js></script>
and internet explorer will seem to be in a loop. In any case, the load of
the page never reaches the point where it displays "done" on the status bar.
If I do a refresh of the site, then it will load correctly and the text
above will not appear in the view source. It has been suggested by the web
host that I have a virus. I have tried this from 5 different computers
running 3 different anti virus program, 1 of which was freshly loaded from
the windows xp sp2 cd. Anyone else encountered this? Any ideas?
** Tom **
|
|
Posted by David H. Lipman on September 16, 2005, 4:14 pm
If you were Registered and logged in, you could reply and use other advanced thread options
| I have a customer's web site that seems to be infected. When the local
| internet cache is empty and it is the first time that I hit the site from a
| given IP address, I'll get back the normal web page with the following text
| added to the top of the message:
|
| <script language=JavaScript src=/oofohmg.js></script>
|
| and internet explorer will seem to be in a loop. In any case, the load of
| the page never reaches the point where it displays "done" on the status bar.
| If I do a refresh of the site, then it will load correctly and the text
| above will not appear in the view source. It has been suggested by the web
| host that I have a virus. I have tried this from 5 different computers
| running 3 different anti virus program, 1 of which was freshly loaded from
| the windows xp sp2 cd. Anyone else encountered this? Any ideas?
| ** Tom **
|
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart
scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE.
It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line
Scanners to
remove viruses, Trojans and various other malware.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file.
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.
* * * Please report back your results * * *
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
|
| Similar Threads | Posted | | Re: Server Infected by virus and unable to clean | May 31, 2007, 2:04 am |
| Help I have been Infected | October 1, 2006, 9:26 pm |
| Server Antivirus software | July 12, 2005, 8:07 pm |
| Win 2K Server anti virus | July 25, 2005, 4:49 pm |
| Couldn't log into Windows Server because of a virus | January 21, 2007, 4:31 am |
| HotPOP.com infected | July 1, 2005, 4:33 pm |
| spyware infected | July 24, 2005, 9:23 pm |
| wininet.dll is infected | October 1, 2005, 12:17 am |
| Can't handle infected PC. Please Help! | April 15, 2006, 6:17 am |
| RE: Can't handle infected PC. Please Help! | April 15, 2006, 1:10 pm |
|
XML site map