Tip: Run a free scan for common Windows errors ad

re: odbc.hta Tuesday, March 2, 2004 at 12:35 pm Posted by jagged ben (3536 messages posted) Have you tried deleting the file yourself? (Duh.) On Tuesday, March 2, 2004 at 8:26 am, Albert wrote: >Whenever my computer boots up, a message from Norton Anti-Virus pops up on the screen. >It reads: "Malicious Script Detected..."Get Special Folder"...Source: C:/WINNT/odbc.hta". >NAV only gives the option to block the script but not delete it, which means that >next time I boot up, that message will be there once again. I've searched all over >the internet for a way to rid myself of this annoyance, but have not found anything >that is appropriate for my situation. > >Any help would be much appreciated. [Reply or follow-up to this message] re: odbc.hta Tuesday, March 2, 2004 at 3:31 pm Posted by neal (137 messages posted) yep, manual deletion is possible thanks to todays computer technology, i do believe its telling u where its at On Tuesday, March 2, 2004 at 8:26 am, Albert wrote: >Whenever my computer boots up, a message from Norton Anti-Virus pops up on the screen. >It reads: "Malicious Script Detected..."Get Special Folder"...Source: C:/WINNT/odbc.hta". >NAV only gives the option to block the script but not delete it, which means that >next time I boot up, that message will be there once again. I've searched all over >the internet for a way to rid myself of this annoyance, but have not found anything >that is appropriate for my situation. > >Any help would be much appreciated. [Reply or follow-up to this message] re: odbc.hta Sunday, March 14, 2004 at 8:40 am Posted by maon segal (1 messages posted) Hi, I'm suffering from same problem. When trying to delete file, was warned that it is a system file and could affect working of pc. Is this so or can I safely delete this file???? Thanks On Tuesday, March 2, 2004 at 3:31 pm, neal wrote: >yep, manual deletion is possible thanks to todays computer technology, i do believe > its telling u where its at > > >On Tuesday, March 2, 2004 at 8:26 am, Albert wrote: >>Whenever my computer boots up, a message from Norton Anti-Virus pops up on the screen. >>It reads: "Malicious Script Detected..."Get Special Folder"...Source: C:/WINNT/odbc.hta". >>NAV only gives the option to block the script but not delete it, which means that >>next time I boot up, that message will be there once again. I've searched all over >>the internet for a way to rid myself of this annoyance, but have not found anything >>that is appropriate for my situation. >> >>Any help would be much appreciated. [Reply or follow-up to this message] re: odbc.hta Tuesday, March 16, 2004 at 5:15 am Posted by jude (1 messages posted) I am also getting this file as part of an "invalid registry key" message. The result is my IE home page is reset to C:\WINDOWS\homepage.htm Deleting the file does not solve the problem. It finds its way onto my system again. Anyone got any ideas? [Reply or follow-up to this message] re: odbc.hta Wednesday, March 17, 2004 at 8:28 am Posted by Jordan Lund (4 messages posted) I'm seeing the same thing in Windows 98. My solution was to attack it through the command line. C:\windows showed two files that shouldn't be there, odbc.hta (which was running on startup) and homepage.htm (the default homepage after odbc.hta runs). I was able to edit both with the command line and it looks like they both contain a bunch of encrypted Javascript. It also looks like both contain the same code so unless you remove both you will continue to be "re-infected." The erase command didn't work initially because they're flagged as system, hidden or read-only. attrib odbc.hta showed hidden and system so: attrib -s -h odbc.hta took care of that allowing erase to work. attrib homepage.htm showed it was hidden so: attrib -h homepage.htm removes the hidden flag. Just for fun I checked msconfig to see if I could find where odbc.hta was running from, no dice. Regedit also ran clean for that string and there wasn't anything weird in the startup folder so I have no idea where that file is running from. [Reply or follow-up to this message] re: odbc.hta Wednesday, March 17, 2004 at 9:22 pm Posted by spm143 (1 messages posted) You rock Jordan! I had the same problem, and your method worked like a charm. I'm glad I got past all that "delete it yourself" riffraff and found a person that actually knew what they were talking about. Thanks! On Wednesday, March 17, 2004 at 8:28 am, Jordan Lund wrote: >I'm seeing the same thing in Windows 98. My solution was to attack it through the >command line. > >C:\windows showed two files that shouldn't be there, odbc.hta (which was running >on startup) and homepage.htm (the default homepage after odbc.hta runs). I was able >to edit both with the command line and it looks like they both contain a bunch of >encrypted Javascript. It also looks like both contain the same code so unless you >remove both you will continue to be "re-infected." > >The erase command didn't work initially because they're flagged as system, hidden >or read-only. > >attrib odbc.hta showed hidden and system so: >attrib -s -h odbc.hta took care of that allowing erase to work. > >attrib homepage.htm showed it was hidden so: >attrib -h homepage.htm removes the hidden flag. > >Just for fun I checked msconfig to see if I could find where odbc.hta was running >from, no dice. Regedit also ran clean for that string and there wasn't anything weird >in the startup folder so I have no idea where that file is running from. [Reply or follow-up to this message] re: odbc.hta Thursday, March 18, 2004 at 6:53 am Posted by JEF (1 messages posted) One other thing I noted. It appears that the path where these two files reside may vary in different OS'es. Running McAfee Virus Scan in Win2000 showed that they were found in C:\WINNT\SYS32 and deleted. Not so. I actually found them lurking in C:\WINNT [out at the command line, of course]. Also, for some reason, I had to remove the "read" attribute on the homepage.htm file. Then erase was successful. On Wednesday, March 17, 2004 at 8:28 am, Jordan Lund wrote: >I'm seeing the same thing in Windows 98. My solution was to attack it through the >command line. > >C:\windows showed two files that shouldn't be there, odbc.hta (which was running >on startup) and homepage.htm (the default homepage after odbc.hta runs). I was able >to edit both with the command line and it looks like they both contain a bunch of >encrypted Javascript. It also looks like both contain the same code so unless you >remove both you will continue to be "re-infected." > >The erase command didn't work initially because they're flagged as system, hidden >or read-only. > >attrib odbc.hta showed hidden and system so: >attrib -s -h odbc.hta took care of that allowing erase to work. > >attrib homepage.htm showed it was hidden so: >attrib -h homepage.htm removes the hidden flag. > >Just for fun I checked msconfig to see if I could find where odbc.hta was running >from, no dice. Regedit also ran clean for that string and there wasn't anything weird >in the startup folder so I have no idea where that file is running from. [Reply or follow-up to this message] re: odbc.hta Sunday, March 21, 2004 at 10:24 pm Posted by Evan (18 messages posted) I have the same problem in Windows XP. I don't know anything about programming though and I don't understand how you said to get rid of them. What does attrib mean? >attrib odbc.hta showed hidden and system so: >attrib -s -h odbc.hta took care of that allowing erase >to work. Also, the program that's running is called odbc.hta but when I looked in the Windows folder, there was a file called ODBC and another called ODBCINST. Both were labeled as "Configuration Settings." Neither had .hta after them. Should I delete these files? My computer tries to log on to the internet every once in a while for no reason so I'm afraid it's some sort of spyware. I ran Adaware and it found a ton of stuff but this is still there. Please help this computer illiterate fix this problem! Thank you, Evan On Wednesday, March 17, 2004 at 8:28 am, Jordan Lund wrote: >I'm seeing the same thing in Windows 98. My solution was to attack it through the >command line. > >C:\windows showed two files that shouldn't be there, odbc.hta (which was running >on startup) and homepage.htm (the default homepage after odbc.hta runs). I was able >to edit both with the command line and it looks like they both contain a bunch of >encrypted Javascript. It also looks like both contain the same code so unless you >remove both you will continue to be "re-infected." > >The erase command didn't work initially because they're flagged as system, hidden >or read-only. > >attrib odbc.hta showed hidden and system so: >attrib -s -h odbc.hta took care of that allowing erase to work. > >attrib homepage.htm showed it was hidden so: >attrib -h homepage.htm removes the hidden flag. > >Just for fun I checked msconfig to see if I could find where odbc.hta was running >from, no dice. Regedit also ran clean for that string and there wasn't anything weird >in the startup folder so I have no idea where that file is running from. [Reply or follow-up to this message] re: odbc.hta Monday, March 22, 2004 at 7:36 am Posted by Jordan Lund (4 messages posted) On Sunday, March 21, 2004 at 10:24 pm, Evan wrote: >I have the same problem in Windows XP. I don't >know anything about programming though >and I don't understand how you said to get rid > of them. What does attrib mean? Boy, you make me feel old! Back in the day before computers had a mouse you had to type everything. This was called "DOS" and the generic name for the interface is a "command line". This still exists in Windows XP (purely, I think, because geeks like me simply can't let go. :^) Attrib is a command you type at the command line. To get there in Windows XP you go from the Start button to all programs to accessories to Command Line. Now the good news: The command line should automatically dump you into the winnt directory which is exactly where you want to be to remove those two files. Use the attrib command as above to remove any hidden or shared or read- only attributes and then use the erase command to delete the files. If for any reason you aren't comfortable doing this you might want to contact a computer users group in your area for assistance. Any good local (i.e. NOT a national chain) computer store should be able to point you in the right direction. >Also, the program that's running is called >odbc.hta but when I looked in the Windows >folder, there was a file called ODBC and another >called ODBCINST. Both were labeled >as "Configuration Settings." Neither had .hta >after them. Should I delete these files? The general ODBC files should be left alone. ODBC stands for "Open Data Base Connectivity" and it's a part of Windows. That's why this particular, I don't know what you want to call it, virus? worm? spyware? whatever is so bad, it's mimicking a legitimate Windows file-name. >My computer tries to log on to the internet >every once in a while for no reason so >I'm afraid it's some sort of spyware. I ran >Adaware and it found a ton of stuff but >this is still there. Please help this computer >illiterate fix this problem! It's most definitely some kind of ad-ware or spyware and running Ad Aware is a very good first step. You might follow up with Spybot Search and Destroy which works well too. But as you noted, neither product picked this one up. That's why I had to figure out a manual removal method. Spybot also has an "Immunize" option to prevent further infections by this kind of software. If you still can't figure out the command line, post a reply to this thread (which notifies me in e-mail) and I'll make a batch file for you to remove the files. [Reply or follow-up to this message] re: odbc.hta Monday, March 22, 2004 at 3:38 pm Posted by berg (1 messages posted) i need some help here...my nortel antivirus tells me ive got a virus named trogan horse. and the object name is: WINNT\odbc.hta. but NAV cant seem to fix/delete the virus. i tried looking for the virus on my comp but i cant seem to find it. what am i doing wrong? im using a win XP OS. i also have another one...my home page on my IE always gets changed to some page i have never even seen before. this occurs every time i reboot the computer. i keep changing the homepage everytime by going through the internet options, but that wierd page keeps coming back. whats that about? how do i eliminate these problems pls [Reply or follow-up to this message] re: odbc.hta Monday, March 22, 2004 at 9:24 pm Posted by Evan (18 messages posted) Thank you for the advice. Actually, I do remember the command prompt. I just never used "attrib." In fact I remembered enough to change the directory to Windows after it dumped me in Documents and Settings for some reason. :) So I was able to delete odbc.hta. I was not able, however, to delete homepage.htm. When I tried using -h homepage.htm, it said Not Resseting System File. When I tried to erase it, it couldn't find it because it was still hidden. In any event, I restarted my computer and odbc.hta did not start as it would have before. Also, when I opened Internet Explorer, my homepage was Google News, which I had reset it as, and not that annoying search engine. But that file is still there and the computer still tried to log on to the internet at startup. When I typed attrib homepage.hta, it listed SHR on the side. The R was the only difference between that and what was listed after odbc.hta. What should I do? By the way, thanks for the help. I would have no idea what to do about this otherwise! :) Evan On Monday, March 22, 2004 at 7:36 am, Jordan Lund wrote: > >On Sunday, March 21, 2004 at 10:24 pm, Evan wrote: >>I have the same problem in Windows XP. I don't >know anything about programming >though >>and I don't understand how you said to get rid >> of them. What does attrib mean? > > Boy, you make me feel old! Back in the day before > computers had a mouse you had to type everything. > This was called "DOS" and the generic name for the > interface is a "command line". This still exists in Windows XP (purely, I >think, because geeks like me > simply can't let go. :^) > > Attrib is a command you type at the command line. To get there in Windows >XP you go from the Start button to all programs to accessories to Command >Line. [Reply or follow-up to this message] re: odbc.hta Tuesday, March 23, 2004 at 8:25 am Posted by Jordan Lund (4 messages posted) If Attrib is showing SHR that means the file is marked as System, Hidden and Read-Only and you have to remove all three to be able to delete the file. attrib -s -h -r homepage.htm should do the trick. The "-" means you're removing the bits. If you ever want to make a file system, hidden or read only you change it to a "+" to add the bit. On Monday, March 22, 2004 at 9:24 pm, Evan wrote: >When I typed attrib homepage.hta, it listed SHR on the side. The R was >the only difference between that and what was listed after odbc.hta. What should >I do? [Reply or follow-up to this message] re: odbc.hta Wednesday, March 24, 2004 at 1:04 am Posted by Evan (18 messages posted) Thanks! That worked perfectly and now both files are gone. Unfortunately, my computer is still trying to log on to the internet every once in a while. There must be something else going on...but at least I solved this annoying problem. Thanks again, Evan On Tuesday, March 23, 2004 at 8:25 am, Jordan Lund wrote: >If Attrib is showing SHR that means the file is marked as System, Hidden and Read-Only >and you have to remove all three to be able to delete the file. > > attrib -s -h -r homepage.htm should do the trick. The "-" means you're removing >the bits. If you ever want to make a file system, hidden or read only you change >it to a "+" to add the bit. > > >On Monday, March 22, 2004 at 9:24 pm, Evan wrote: > > >When I typed attrib homepage.hta, it listed SHR on the side. The R was >>the only difference between that and what was listed after odbc.hta. What should >>I do? [Reply or follow-up to this message] re: odbc.hta Thursday, May 20, 2004 at 2:14 pm Posted by jese llavona (1 messages posted) Im having the same problem with my windows xp. I read your message and tried to fix it, but I couldn't do it. I don't know what the delete command for dos is. And I can't find the files. Can you help me? On Monday, March 22, 2004 at 7:36 am, Jordan Lund wrote: > [Reply or follow-up to this message] re: odbc.hta Saturday, June 26, 2004 at 2:14 pm Posted by Jon (1 messages posted) Hi, I have the same problem with the odbc.hta and can't locate it. I really could use help too. Thanks :) P.S. why the hell do people that are so smart who know how to program such awesome and powerful apps have to be malicious with their talent? On Monday, March 22, 2004 at 7:36 am, Jordan Lund wrote: > [Reply or follow-up to this message] re: odbc.hta Monday, September 20, 2004 at 7:18 am Posted by Jaakko (2 messages posted) About that pesky odbc.hta thing.... I was so excited to find a potential solution (running attrib odbc.hta; attr homepage.htm... deleting those)-- but when I ran those, I got "Extended Error 1,282" as a response. Any idea why? I have Windows 98 OS. I could really use your help... hope you are still out there! Thanks. On Monday, March 22, 2004 at 7:36 am, Jordan Lund wrote: > [Reply or follow-up to this message] re: odbc.hta Monday, September 20, 2004 at 7:41 am Posted by Jordan Lund (4 messages posted) I ran a Google search on that error code and found this: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/system_error_codes__1000-1299_.asp 1282 The system detected an overrun of a stack-based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application. ERROR_STACK_BUFFER_OVERRUN It sounds to me like the odbc.hta might be the least of your problems. Make sure your Windows 98 is up to date and if you're using Internet Explorer 6.0 or any of the Office Packages make sure you have the latest security updates. Checking your anti-virus software and making sure it has the latest virus definitions is a good step too. On Monday, September 20, 2004 at 7:18 am, Jaakko wrote: >About that pesky odbc.hta thing.... > > >I was so excited to find a potential solution (running attrib odbc.hta; attr homepage.htm... >deleting those)-- but when I ran those, I got "Extended Error 1,282" as a response. > Any idea why? I have Windows 98 OS. I could really use your help... hope you are >still out there! > > >Thanks. > > > [Reply or follow-up to this message] re: odbc.hta Sunday, January 16, 2005 at 2:43 pm Posted by Evie (24 messages posted) I'm seeing a similar issue with file by the name of Windows.hta What is that? On Monday, September 20, 2004 at 7:41 am, Jordan Lund wrote: >I ran a Google search on that error code and found this: > > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/system_error_codes__1000-1299_.asp > > 1282 > > The system detected an overrun of a stack-based buffer in this application. This >overrun could potentially allow a malicious user to gain control of this application. > > > ERROR_STACK_BUFFER_OVERRUN > > It sounds to me like the odbc.hta might be the least of your problems. Make sure >your Windows 98 is up to date and if you're using Internet Explorer 6.0 or any of >the Office Packages make sure you have the latest security updates. Checking your >anti-virus software and making sure it has the latest virus definitions is a good >step too. > > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows XP Discussion Forum