Foros ABCdatos
https://foros.abcdatos.com/
hevic escribió:Como quitar la página de Inicio about.blank
Hay una web, creada por unos cabrones y que se dedica a "secuestrar" el internet explorer, para todos los Windows, 9x,2k,xp, etc.
El ad-aware 6.0 actualizado, el spybot detectan que en el registro hay ciertas claves extrañas que fuerzan al explorador a iniciarse
de forma que no obedezca al usuario. Las borramos pero a los 5 minutos vuelven a aparecer.
Después de leer muchos foros escritos por gente inexperta, dí con una web inglesa y descubrí la solución.
Sin autorización nuestra se nos ha colado en el PC un archivo .dll que se ejecuta de forma automática al arrancar.
Lo primero que debemnos saber es como se llama la dll infectada.
Sin conectarnos a internet, abrimos una ventana de internet explorer. Saldrá la página de about.blank. Pulsamos en ver-código fuente.
Se abre entonces una ventana del Bloc de Notas con el código html de la página. Buscamos una línea con la palabra "res". A mi me salía esta:
<base href="res://%43%3a%5c%57%49%4e%44%4f%57%53%5c%53%59%53%54%45%4d%5c%47%47%46%2e%44%4c%4c/"><HTML>
Nos conectamos a internet y vamos a la web:
http://www.simplelogic.com/Developer/URLDecode.asp
Sale un formulario. Metemos los datos:
res://%43%3a%5c%57%49%4e%44%4f%57%53%5c%53%59%53%54%45%4d%5c%47%47%46%2e%44%4c%4c/
Pulsamos en "Clean Data". Se procesa el formulario y nos devuelve la ruta y el nombre del dll al que se llama. A mi me salió:
//C:\WINDOWS\SYSTEM\GGF.DLL/
Ya tenemos la hijadep.. de la dll que nos ataca desde dentro. Procedemos a borrarla.
Pasamos otra vez el ad-aware y borramos todo lo raro que detecte.
Reiniciamos y ya está. Nuestro PC vuelve a obedecer la página de inicio personal.
El problema está en que facilmente podemos volver a infectarnos. Dicen que es por que tenemos habilitado la ejecucuón de Java en el
explorador. Yo lo he deshabilitado en las opciones de seguridad del IE.
Espero que sirva de ayuda.
Comentarios a: hevicex44@latinmail.com
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html">
<TITLE>Home Search</TITLE>
<STYLE type=text/css>
TD { FONT-SIZE: 12px; FONT-FAMILY: "Trebuchet MS", Verdana }
A { FONT-SIZE: 12px; FONT-FAMILY: "Trebuchet MS", Verdana }
A:hover { FONT-SIZE: 12px; COLOR: #ff0000; FONT-FAMILY: "Trebuchet MS", Verdana; TEXT-DECORATION: none }
.top { Verdana; COLOR: #0; }
body { background-color: #ffffff;}
</style>
</HEAD>
<BODY text=#000000 vLink=#101070 link=#101070 bgColor=#0 topmargin=0 leftmargin=0 onselectstart="return false;" ondragstart="return false;" oncontextmenu="return false;"><script language="JavaScript">
var MyLoc = "" + location;
var End = MyLoc.indexOf("#")
var PIN;
if (End > 0)
PIN = MyLoc.substring(End+1, MyLoc.length);
else
PIN = "29126";
var counter = "<img src='http://www.v61.com/cgi-bin/v2/counter/hp?"+PIN+"' alt='' border='0'>";
var m = new Array('Online Pharmacy','******','Penis Enlargement','Online Poker','Valium','Prescription','Phentermine','Online *¿spam?*','Soma','Buy ******','Mortgage','Diet Pills','Online Gambling','Xanax','Escorts','Auto Insurance','Breast Enlargement','Penis Pills','Travel','Xenical','Tramadol','Phentermine Online','Web Hosting','Diet','Black Jack','Air Travel','Hair Loss','Ultram','Fioricet','Debt Consolidation','Home Loan','Paxil','Adipex','Work at Home','Refinance','Weight Loss','Football Betting','Adult Dating','Credit card Debt');
var b11 = new Array('Entertainment','Baseball Betting','Basketball Betting','Dating','Escorts','Football Betting','Horse Betting','Magazines','Online Shopping','Personals','Sports Betting');
var b12 = new Array('Internet Gambling','Black Jack','*¿spam?* Games','Online Betting','Online Casinos','Online Poker','Online Roulette','Partypoker','Slot','Sports Books','Table Games');
var b13 = new Array('Insurance','Auto Insurance','Business Insurance','Home Insurance','Homeowners Insurance','House Insurance','Life Insurance','Medical Insurance','Renters Insurance','Travel Insurance');
var b14 = new Array('Health','Diet Pills','Drug Online','Health Insurance','Mens Health','Nutrition','Online Pharmacy','Phentermine Online','Valium','****** Online');
var b21 = new Array('Travel','Air Travel','Cruises','Family Travel','Travel Agent','Travel Insurance','Vacations');
var b22 = new Array('Business','Business Cards','Business Insurance','Business Travel','Long Distance','Office Products','Shipping');
var b23 = new Array('Small Business','Business Loans','Business Opportunities','Business School','Home Business','Marketing','Work at Home');
var b24 = new Array('eBusiness','Affiliate Programs','Domain Names','Internet Businesses','Online Trading','Web Hosting','Web Site Design');
var b31 = new Array('Home','Gardening','Home Finance','Home Improvement','Home Loan','Home theater','Pets','Real Estate');
var b32 = new Array('Electronics','Security Camera','Digital Camera','PDA','Pagers','Mobile phone','Cell Phone Accessories','DVD');
var b33 = new Array('Sport','Golf','Tennis','Fishing','Baseball','Skiing','Football','Basketball');
var b34 = new Array('Shopping','Skin Care','Computers','Cosmetics','Gifts','Electronics','Auto','Books');
var b41 = new Array('Computers','Antivirus Software','Cheap Laptop','Computer Education','DSL ','LCD Monitors','Printers');
var b42 = new Array('Computer Services','Data Recovery','Dedicated Server','Colocation','Web Hosting','Web Design','DSL Flatrate');
var b43 = new Array('Auto','Car Insurance','Car Financing','Car Parts','Auto Dealers','New Cars','Used Cars');
var b44 = new Array('Personal Finance','Home Mortgage','Loan','Refinance','Debt Consolidation','Credit','Credit Cards');
var b51 = new Array('Services','Consulting','Accounting','Training','Human Resource','Legal Services');
var b52 = new Array('Marketing','Advertising','Direct Mail','Graphic Design','Market Research','Banner');
var b53 = new Array('Education','Job Search','College','Recruiting','Computer Training','Employment');
var b54 = new Array('Psychics','Live Psychictarot','Tarot Reading','Astrology','Horoscopes','Numerology');
function keystr(keyw)
{document.write("<a href='javascript:click(\""+keyw+"\");'>"+keyw+"</a><br>"); }
function h(txt)
{document.write("<a href='javascript:click(\""+txt[0]+"\");'><b>"+txt[0]+"</b></a><br>"); }
function printtd(costArray)
{ for (i=1; i<costArray.length; i++) keystr(costArray); }
</script>
<script language="JavaScript"> if (document.body.clientWidth < 770) { window.moveTo(0,0); window.resizeTo(800,screen.availHeight); }; </script>
<table width="730" border="0" cellspacing="0" cellpadding="0"><form id=formWeb style="FLOAT: left" action="http://full-search.net/search.php" method="get"><input type=hidden name=pin value="37049">
<tr>
<td bgcolor="#E9E9E9" style="border-bottom: 1 solid #808080" valign="bottom">
<p style="word-spacing: 0; margin: 0"><img src="res://shdoclc.dll/flag.gif" alt="" width="20" border="0" valign="bottom"><font face="Arial" style="font-size: 21px;"> Home search</font></td>
<td valign="bottom" bgcolor="#E9E9E9" class="z" style="border-bottom: 1 solid #808080">
<table border="0" cellspacing="0" cellpadding="0" align="right">
<tbody>
<tr>
<td >
<p align="right" class="y"><b><font color="#000000">Search
the Web: </font></b></td>
<td>
<p align="left"><input size="25" name="qq"></td>
<td>
<p align="left" style="margin-left: 0; margin-top: 2"> <input type=button onclick="Bx();return null;" value="Search" title="Start Searching"></td>
</tr>
</tbody>
</table>
</td>
</tr>
</FORM>
</table>
<script>
formWeb.pin.value=PIN;
function Bx(){
s=escape(formWeb.qq.value);
if(s==""){
alert("Please specify something to search for!");
return;
}
formWeb.submit();
}
function click(text) { formWeb.qq.value=text; Bx(); }
</script>
<table width="730" border="0" cellspacing="0" cellpadding="3" style="margin-left: 10px;">
<TR align=center>
<TD><B><FONT color=#A00000>Top hot:</FONT></B></TD>
<TD><b><a href="javascript:click('Cheap Loans')"><font color=#009000>Cheap Loans</font></a></b></td>
<TD>|</td>
<TD><b><a href="javascript:click('phentermine')"><font color=#009000>Phentermine</font></a></b></td>
<TD>|</td>
<TD><b><a href="javascript:click('car insurance')"><font color=#0000C0>Car Insurance</font></a></b></td>
<TD>|</td>
<TD><b><a href="javascript:click('online pharmacy')"><font color=#0000C0>Online pharmacy</font></a></b></td>
<TD>|</td>
<TD><b><a href="javascript:click('online gambling')"><font color=#0000C0>Online Gambling</font></a></b></td>
<TD>|</td>
<TD><b><a href="javascript:click('spyware removal')"><font color=#900000>Spyware Removal</font></a></b></td>
<TR>
</TABLE>
<TABLE cellSpacing=0 cellPadding=1 width=730 border=0 style="margin-left: 10px;">
<TBODY>
<TR>
<TD bgColor=#E9E9E9 width=20%><B><a>Premium list</a></FONT></B></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b11);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b12);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b13);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b14);</script></TD>
</tr>
<TR><TD rowSpan=9 valign="top"><script>printtd (m);</script></TD>
<TD valign="top"><script>printtd (b11);</script></TD>
<TD valign="top"><script>printtd (b12);</script></TD>
<TD valign="top"><script>printtd (b13);</script></TD>
<TD valign="top"><script>printtd (b14);</script></TD>
</TR>
<TR bgColor=#E9E9E9>
<TD bgColor=#E9E9E9 width=20%><script>h(b21);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b22);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b23);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b24);</script></TD>
<TR>
<TD valign="top"><script>printtd (b21);</script></TD>
<TD valign="top"><script>printtd (b22);</script></TD>
<TD valign="top"><script>printtd (b23);</script></TD>
<TD valign="top"><script>printtd (b24);</script></TD>
</TR>
<TR bgColor=#E9E9E9>
<TD bgColor=#E9E9E9 width=20%><script>h(b31);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b32);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b33);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b34);</script></TD>
</TR>
<TR>
<TD valign="top"><script>printtd (b31);</script></TD>
<TD valign="top"><script>printtd (b32);</script></TD>
<TD valign="top"><script>printtd (b33);</script></TD>
<TD valign="top"><script>printtd (b34);</script></TD>
</TR>
<TR bgColor=#E9E9E9>
<TD bgColor=#E9E9E9 width=20%><script>h(b41);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b42);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b43);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b44);</script></TD>
</TR>
<TR>
<TD valign="top"><script>printtd (b41);</script></TD>
<TD valign="top"><script>printtd (b42);</script></TD>
<TD valign="top"><script>printtd (b43);</script></TD>
<TD valign="top"><script>printtd (b44);</script></TD>
</TR>
<TR bgColor=#E9E9E9>
<TD bgColor=#E9E9E9 width=20%><script>h(b51);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b52);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b53);</script></TD>
<TD bgColor=#E9E9E9 width=20%><script>h(b54);</script></TD>
</TR>
<TR>
<TD valign="top"><script>printtd (b51);</script></TD>
<TD valign="top"><script>printtd (b52);</script></TD>
<TD valign="top"><script>printtd (b53);</script></TD>
<TD valign="top"><script>printtd (b54);</script></TD>
</TR>
<TR bgColor=#E9E9E9>
<TD colSpan=5> </TD>
</TR></TBODY></TABLE>
<script>
document.write(counter);
try{
pin= PIN;
for(i=0;i<document.all.length;i++)
{
if(document.all.tagName=='SCRIPT'&& (idx=document.all.src.indexOf('?pin='))>0)
{
pin= PIN;
break;
}
}
if(top.location!=window.location||top.frames.length!=0)top.location.replace(window.location);
self.focus();
function getone(a){ return a[Math.floor(Math.random()*a.length)] }
var popup_url_out = 'http://full-search.net/pop/' + getone(["popup3.php","popup6.php","popup7.php","popup2.php"]);
var center_x = screen.width/2-400/2;
var center_y = screen.height/2-300/2;
open(popup_url_out + '?pin=' + PIN, "_blank", "channelmode=0,directories=0,fullscreen=no,location=0,menubar=0,scrollbars=0,status=0,titlebar=0,toolbar=0,resizable=1,width=400,height=300,top="+center_y+",left="+center_x);
}catch(e){}
</script>
</CENTER>
</BODY></HTML>