Hardware Analysis - Help With C:\WINDOWS\secure.html

Re: Help With C:\WINDOWS\secure.html

greg rigor — 2004-08-12T21:42:24-05:00

SORRY, ONE STEP MORE

If you're using a DSL modem to conect to internet look on My Computer, Windows file and open hosts with notepad. Erase all on this sheet and write "127.0.0.1 LOCALHOST". Save the document and Thats all.

Re: Help With C:\WINDOWS\secure.html

greg rigor — 2004-08-12T21:32:14-05:00

If you have WIN98, WIN98 SE or WIN ME the solution is easy, follow this steps:

Install LAVASOFT ADAWARE AND RUN UPDATE

1- On Start, Settings open Control Pannel
2- Open Add/Remove Programs and look for create Startup Disk
3- Put a floppy and create startup Disk
4- Turn of and turn on with the startup disk on the floppy drive
5- Select minimal startup.(option 4)
6- You have A:\ on the screen, write C: and hit enter
7- You have C:\ on screen, hit CD Windows and hit enter
8- You have now C:\WINDOWS on screen, write ERASE SYSTEM.EXE
9- Turn off your computer and turn on again without the floppy disk
10- Mantain pressed the F8 and select option 3 SAVE MODE
11- When open windows in safe mode enter in My Computer file Windows and delete "secure.html"
12- After that return to Control Pannel and look for Internet Options
13- Change your Home page and delete all cookies, files and history
14- Save the settings and run adaware from lavasoft and delete all.
15- Restart your computer and GOOD LUCK

Re: Help With C:\WINDOWS\secure.html

Maui Stz — 2004-07-28T02:36:23-05:00

Ok Guys

this is some information for those pesky hijackers & spyware of sorts you need to get help from those that are experianced in this particular problem.

Go to this web site http://forums.tomcoyote.org/ & you will find all the help you need.

Re: Help With C:\WINDOWS\secure.html

tgi dkp — 2004-07-27T08:19:58-05:00

because i solved this problem using info from this forum, i am adding this post as a service to others whom are having this problem. i solved the "c:\windows\secure.html" problem using the following tactic.

http://securityresponse.symantec.com/avcenter/venc/data/w32.hl...ot.ao.html

at the website posted above are listed several programs which this particular virus installs to your startup system. i did not find 'reg32' on my system, but i did find 'system.exe'. this file was found in the c:\windows directory. i stopped running it using ctl-alt-del under the processes tab. then i deleted the file with no trouble. upon restart of my computer, i was again able to freely assign the homepage of internet explorer.

DEATH TO THOSE THAT THINK THEY CAN JUST INVADE MY COMPUTER LIKE THIS...DEATH!

tgidkp

Re: Help With C:\WINDOWS\secure.html

Paul Hopley — 2004-07-15T17:05:08-05:00

Please follow all of the instructions above and it shouldnt happenalso check c:\windows\system32 if there is a version of explorer here delete it, you may well find there are two, and they will show up on the hijack this log. To stop the hosts re entering the code you must disablr system restore and follow the rest of the instructions i posted. If you cant do it my email is above so please feel free to use it
Paul

Re: Help With C:\WINDOWS\secure.html

isamu dyson — 2004-07-14T20:43:40-05:00

okay now i tried to edit the host files, but they too keep replacing themselves much like the secure.html file... can someone tell me where i can find the source of this problem?

Re: Help With C:\WINDOWS\secure.html

Paul Hopley — 2004-07-14T18:05:18-05:00

after recieving tons of emails I have decided to post the solution for you here as I cant keep up.
First of all download the following
http://www.shinobiresources.com spybot S&D
http://www.lavasoft.com Ad-aware
http://www.merijn.org hijack this and also cw shredder
make sure you update them too
instructions are for xp modify as neccesary
First things first, you need to disable system restore. To do this you must right click �my computer� and select properties. One of the tabs is system restore, click that and check the box that says turn off system restore, then press �apply� then press �ok�.

Next restart in safe mode and log in as the administrator (if you are the only user just log in as yourself)

Now comes the fun part

Go �start� - �search� � and search for files and folders.

Find : desktop.html

Delete it and all recurrences of it

Now search for hosts

In turn open each one with notepad (ask me if you aren�t sure how) and delete the contents except for 1 line which needs to read

127.0.0.1 localhost

if it isn�t there then write it in yourself and save

now find and see if you can delete the followingdon�t worry if you cant)
c:\windows\system32 rpcss.dll

now empty the recycle bin

run adaware check all entries and delete them

run spybot s&d
clean all entries

go to control panel>internet settings and change the homepage
also in the same place clear all internet history and cookies etc

run cwshredder

reboot in normal mode
run hijack this and fix anything relating to secure.html

re enable system restore

cross your fingers and open internet explorer

Re: Help With C:\WINDOWS\secure.html

isamu dyson — 2004-07-14T11:06:13-05:00

im still having much trouble with this virus/spyware
i followed your directions, but i couldn't find the file "reg32.exe" in the windows folder...
i ran a search for the file but it came up empty...
i also tried using msconfig to shut it down manually from startup but the file didn't exist on the start up list either...
i also tried to just delete the "secure.html" file itself, but it just replaces itself after about a second
i noticed it was continually copying over itself so just replacing it with another file wouldn't help... can someone tell me how to fix this?

Re: Help With C:\WINDOWS\secure.html

Paul Hopley — 2004-07-03T19:11:45-05:00

Ok got the thingnow and now just have to repair the rest of my machine as it got pretty battered whilst I was trying to find the problem. If anyone needs help removing this then just send me an email and I will detail the instructions in simple terms. paul8977@hotmail.com

Re: Help With C:\WINDOWS\secure.html

Paul Hopley — 2004-07-03T08:26:51-05:00

Ok I seem to have gotted rid of th secure html using the instructions two posts up, but it took over my desktop and now my desktop flashes grey and white(it used to show an advert) I cant seem to locate the program doing it please can anyone help?

Re: Help With C:\WINDOWS\secure.html

Paul Hopley — 2004-07-02T19:22:09-05:00

Holly cow, I am so so angry right now. I have a similar problem, even my desktop has been changed I cant change it back, ive deleted files and all kinds of things but im no expert and about ready to give up and cry. Please somebody help me in a language I can understand. I appreciate any help. Many thanks.

Re: Help With C:\WINDOWS\secure.html

Tate Eith — 2004-06-30T15:55:05-05:00

I haven't tried this yet but I feel this is the proper solution...
http://securityresponse.symantec.com/avcenter/venc/data/pf/tro...ecure.html

Re: Help With C:\WINDOWS\secure.html

Ryan Carey — 2004-06-28T20:34:51-05:00

It may be unrelated, but I haven't found reg32 anywhere yet. I do keep finding point32.

Re: Help With C:\WINDOWS\secure.html

Ivo Tzvetkov — 2004-06-28T13:48:20-05:00

I'll show you some tricks about removing the virus tonight ;-)

Re: Help With C:\WINDOWS\secure.html

Shadow_Ops_Airman1 — 2004-06-18T17:21:38-05:00

my brother got attacked by same thing, someone hacked his system and put that crap up along with some trojan horses on his system.