re: odbc.hta
Thursday, March 18, 2004 at 6:53 am
Windows XP Annoyances Discussion Forum
Posted by JEF
(1 messages posted)
One other thing I noted. It appears that the path where these two files reside may
vary in different OS'es. Running McAfee Virus Scan in Win2000 showed that they were
found in C:\WINNT\SYS32 and deleted. Not so. I actually found them lurking in C:\WINNT
[out at the command line, of course]. Also, for some reason, I had to remove the
"read" attribute on the homepage.htm file. Then erase was successful.
On Wednesday, March 17, 2004 at 8:28 am, Jordan Lund wrote:
>I'm seeing the same thing in Windows 98. My solution was to attack it through the
>command line.
>
>C:\windows showed two files that shouldn't be there, odbc.hta (which was running
>on startup) and homepage.htm (the default homepage after odbc.hta runs). I was able
>to edit both with the command line and it looks like they both contain a bunch of
>encrypted Javascript. It also looks like both contain the same code so unless you
>remove both you will continue to be "re-infected."
>
>The erase command didn't work initially because they're flagged as system, hidden
>or read-only.
>
>attrib odbc.hta showed hidden and system so:
>attrib -s -h odbc.hta took care of that allowing erase to work.
>
>attrib homepage.htm showed it was hidden so:
>attrib -h homepage.htm removes the hidden flag.
>
>Just for fun I checked msconfig to see if I could find where odbc.hta was running
>from, no dice. Regedit also ran clean for that string and there wasn't anything
weird
>in the startup folder so I have no idea where that file is running from.
- Written in response to:
- re: odbc.hta (Jordan Lund: Wednesday, March 17, 2004 at 8:28 am)
There are presently no replies to this message.
|
|
All messages in this thread [show all]
 | odbc.hta (Albert: Tue, Mar 2, 2004, 8:26 am) |
 | | | | |  | re: odbc.hta (JEF: Thu, Mar 18, 2004, 6:53 am) |
| |
| |
| |
Return to the Windows XP Discussion Forum
|
|
