Computer hijacked?

On Wed, 05 Nov 2003 19:39:07 GMT, "Heidi" <blackcat2.RemoveThis@zwallet.com>
wrote:

 >Okay here is the deal. I had my computer on but I wasn't
 >here. I got back in here around 1pm
 >
 >My system had been rebooted and the computer said
 >it was a 'serious error'
 >
 >I also noted my homepage was changed which is funny because
 >it was not changed when I left and no one had been touching this computer.
 >
 >Was I hacked and someone changed my homepage etc? If they did
 >they are not too bright because the search engine page that replaced
 >my homepage has an affiliate id.
 >
 >This is creeping me out and I have no idea what is going on.

Ghost in the machine?<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

Heidi wrote:
 > Okay here is the deal. I had my computer on but I wasn't
 > here. I got back in here around 1pm
 >
 > My system had been rebooted and the computer said
 > it was a 'serious error'
 >
 > I also noted my homepage was changed which is funny because
 > it was not changed when I left and no one had been touching this
 > computer.
 >
 > Was I hacked and someone changed my homepage etc? If they did
 > they are not too bright because the search engine page that replaced
 > my homepage has an affiliate id.
 >
 > This is creeping me out and I have no idea what is going on.

MS thingy. <grin>

--
Duende<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

Charging up on a white horse Wipkip said:
: MS thingy. <grin>

Maybe but I could not change the homepage back. I mean I could
but it kept changing back to that stupid search engine page which was
locally stored on my system.

So I found that page in my windows directory and changed the HTML
with that of my normal browser homepage. So now if it changes back to that
page in the windows directory it won't matter.

I still think I was hacked or something and someone put that search engine
page on my computer. Especially as it has an affiliate ID in the search
links on it.

This is going to require more investigation but I download spybot S&D at
Red's
suggestion and use that for now. I am also going to try to determine who is
holding
the account for that affiliate ID with that search engine.

--
Heidi
PaidToReads: http://www.paidtoreads.com/
Recommended Hosting: http://www.page-zone.com/
Put a.w.w. in subject if you email me or it might be trashed
 >> Stay informed about: Computer hijacked? 

"Heidi" <blackcat2.DeleteThis@zwallet.com> wrote in message
news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
 > Okay here is the deal. I had my computer on but I wasn't
 > here. I got back in here around 1pm
 >
 > My system had been rebooted and the computer said
 > it was a 'serious error'
 >
 > I also noted my homepage was changed which is funny because
 > it was not changed when I left and no one had been touching this computer.
 >
 > Was I hacked and someone changed my homepage etc? If they did
 > they are not too bright because the search engine page that replaced
 > my homepage has an affiliate id.
 >
 > This is creeping me out and I have no idea what is going on.

Mine crashed a couple of times lately, same "serious error" thing (Windows
XP).

I thought it might have been a virus (MSblast?) but checked, and was clean.

Has been ok lately.
--
Charles Sweeney
<a style='text-decoration: underline;' href="http://www.CharlesSweeney.com" target="_blank">www.CharlesSweeney.com</a><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

"Heidi" <blackcat2 DeleteThis @zwallet.com> wrote in message
news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
 > Okay here is the deal. I had my computer on but I wasn't
 > here. I got back in here around 1pm
 >
 > My system had been rebooted and the computer said
 > it was a 'serious error'
 >
 > I also noted my homepage was changed which is funny because
 > it was not changed when I left and no one had been touching this computer.
 >
 > Was I hacked and someone changed my homepage etc? If they did
 > they are not too bright because the search engine page that replaced
 > my homepage has an affiliate id.
 >
 > This is creeping me out and I have no idea what is going on.
 >
 > --
 > Heidi
<font color=purple> > PaidToReads: <a style='text-decoration: underline;' href="http://www.paidtoreads.com/</font" target="_blank">http://www.paidtoreads.com/</font</a>>
<font color=purple> > Recommended Hosting: <a style='text-decoration: underline;' href="http://www.page-zone.com/</font" target="_blank">http://www.page-zone.com/</font</a>>
 > Put a.w.w. in subject if you email me or it might be trashed

Download Spybot --
<a style='text-decoration: underline;' href="http://www.safer-networking.org/index.php?lang=en&page=download" target="_blank">http://www.safer-networking.org/index.php?lang=en&page=download</a>
you've got some spyware/ad crap -- spybot will clean it up safely.

Cheers,
Andy<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

Charging up on a white horse Jerry Stuckle said:
: Did you use this userid/password on ANY other site?

What userid and password?

Chances are I didn't as I use a different pass for each site
that is a mix of upper/lowercase letters and numbers plus
some odd characters possibly thrown in.

--
Heidi
PaidToReads: http://www.paidtoreads.com/
Recommended Hosting: http://www.page-zone.com/
Put a.w.w. in subject if you email me or it might be trashed
 >> Stay informed about: Computer hijacked? 

"Heidi" <blackcat2.RemoveThis@zwallet.com> wrote in message
news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
 > Okay here is the deal. I had my computer on but I wasn't
 > here. I got back in here around 1pm
 >
 > My system had been rebooted and the computer said
 > it was a 'serious error'
 >
 > I also noted my homepage was changed which is funny because
 > it was not changed when I left and no one had been touching this computer.
 >
 > Was I hacked and someone changed my homepage etc? If they did
 > they are not too bright because the search engine page that replaced
 > my homepage has an affiliate id.
 >
 > This is creeping me out and I have no idea what is going on.
 >
 > --
 > Heidi
<font color=purple> > PaidToReads: <a style='text-decoration: underline;' href="http://www.paidtoreads.com/</font" target="_blank">http://www.paidtoreads.com/</font</a>>
<font color=purple> > Recommended Hosting: <a style='text-decoration: underline;' href="http://www.page-zone.com/</font" target="_blank">http://www.page-zone.com/</font</a>>
 > Put a.w.w. in subject if you email me or it might be trashed
 >
Many spyware programs won't necessarily show up in a virus checker. Some
replace your home page and search page. Get one of the spyware programs to
check things out. One possible scenario that comes to mind is that someone
used your machine to visit a "bad" web site, downloaded and installed the
program without realizing it.
dp<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

"dp" <noreplyhere RemoveThis @hotmail.com> wrote in message
news:ovgqb.17821$bn4.11389@newssvr33.news.prodigy.com...

 > Many spyware programs won't necessarily show up in a virus checker. Some
 > replace your home page and search page. Get one of the spyware programs to
 > check things out. One possible scenario that comes to mind is that someone
 > used your machine to visit a "bad" web site, downloaded and installed the
 > program without realizing it.

A few theories jumping around now, versus "Windows is shite and crashes a
lot".

I think I know which one I'm going for.
--
Charles Sweeney
<a style='text-decoration: underline;' href="http://www.CharlesSweeney.com" target="_blank">www.CharlesSweeney.com</a><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

"Heidi" <blackcat2.DeleteThis@zwallet.com> wrote in message
news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
 > Okay here is the deal. I had my computer on but I wasn't
 > here. I got back in here around 1pm
 >
 > My system had been rebooted and the computer said
 > it was a 'serious error'
 >
 > I also noted my homepage was changed which is funny because
 > it was not changed when I left and no one had been touching this computer.
 >
 > Was I hacked and someone changed my homepage etc? If they did
 > they are not too bright because the search engine page that replaced
 > my homepage has an affiliate id.
 >
 > This is creeping me out and I have no idea what is going on.
 >
 > --
 > Heidi
<font color=purple> > PaidToReads: <a style='text-decoration: underline;' href="http://www.paidtoreads.com/</font" target="_blank">http://www.paidtoreads.com/</font</a>>
<font color=purple> > Recommended Hosting: <a style='text-decoration: underline;' href="http://www.page-zone.com/</font" target="_blank">http://www.page-zone.com/</font</a>>
 > Put a.w.w. in subject if you email me or it might be trashed
 >
 >

I consider myself pretty computer savvy when it comes to spyware and
viruses. I scan for both regualrly and never download anything I'm not sure
of, but a few weeks ago, a copy of Gator got itself onto my machine just by
visiting a web site or clicking on an ad. Still don't understand the
mechnaics of how it did it, as I noticed nothing happening until the tell
tale signs showed up(hijacked home page, etc.). I would definately run
Spybot or Ad Aware - or both..


Bob<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

"Heidi" <blackcat2 RemoveThis @zwallet.com> wrote in message
news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
 > Okay here is the deal. I had my computer on but I wasn't
 > here. I got back in here around 1pm
 >
 > My system had been rebooted and the computer said
 > it was a 'serious error'
 >
 > I also noted my homepage was changed which is funny because
 > it was not changed when I left and no one had been touching this computer.
 >
 > Was I hacked and someone changed my homepage etc? If they did
 > they are not too bright because the search engine page that replaced
 > my homepage has an affiliate id.
 >
 > This is creeping me out and I have no idea what is going on.

Hmmm...This sounds strangely familiar.....Something has gotten onto my
system and is doing something very similar, yet subtly different.....

On some web pages, every other link gets changed to point to a search page
called ToonComcs or something similar.....All the links in between remain
unchanged, and when I refresh the page, the links all go back to normal
again.....

I've followed the advice on the Symantec homepage to fix it, but nothing
works.....The problem keeps persisting......I think there's something
paticularly nasty out there.....<!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

Yeah I got that too. You only get it when you go to a certain site (won't
mention it here or I'll only get flamed). It doesn't worry me because I just
have to put up with it to get what I want from that site. That's the price
I'm prepared to pay.
No drama really, ........... just use Ad-Aware etc to clean up after you've
been there.
Easiest way to see if it "got" you is to type a non existing domain into
your browser & see where it goes to.
By the way it appears to sit dormant for hours before it installs itself.
Not sure what the trigger is though.
BruceM


"Charles Sweeney" <me.RemoveThis@charlessweeney.com> wrote in message
news:bobskt$1cu8ef$1@ID-162618.news.uni-berlin.de...
 > "Heidi" <blackcat2.RemoveThis@zwallet.com> wrote in message
 > news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
  > > Okay here is the deal. I had my computer on but I wasn't
  > > here. I got back in here around 1pm
  > >
  > > My system had been rebooted and the computer said
  > > it was a 'serious error'
  > >
  > > I also noted my homepage was changed which is funny because
  > > it was not changed when I left and no one had been touching this
computer.
  > >
  > > Was I hacked and someone changed my homepage etc? If they did
  > > they are not too bright because the search engine page that replaced
  > > my homepage has an affiliate id.
  > >
  > > This is creeping me out and I have no idea what is going on.
 >
 > Mine crashed a couple of times lately, same "serious error" thing (Windows
 > XP).
 >
 > I thought it might have been a virus (MSblast?) but checked, and was
clean.
 >
 > Has been ok lately.
 > --
 > Charles Sweeney
<font color=purple> > <a style='text-decoration: underline;' href="http://www.CharlesSweeney.com</font" target="_blank">www.CharlesSweeney.com</font</a>>
 >
 ><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

BruceM wrote:
 > You only get it when you go to a certain site
 > (won't mention it here or I'll only get flamed).

In here? surely not ;o)

 > ...
 > By the way it appears to sit dormant for hours before it installs
 > itself. Not sure what the trigger is though.

reboot perhaps?

--
William Tasso - <a style='text-decoration: underline;' href="http://WilliamTasso.com" target="_blank">http://WilliamTasso.com</a><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked? 

Heidi wrote:
 >
 > Charging up on a white horse Jerry Stuckle said:
 > : Did you use this userid/password on ANY other site?
 >
 > What userid and password?
 >
 > Chances are I didn't as I use a different pass for each site
 > that is a mix of upper/lowercase letters and numbers plus
 > some odd characters possibly thrown in.
 >
 > --
 > Heidi
<font color=purple> > PaidToReads: <a style='text-decoration: underline;' href="http://www.paidtoreads.com/</font" target="_blank">http://www.paidtoreads.com/</font</a>>
<font color=purple> > Recommended Hosting: <a style='text-decoration: underline;' href="http://www.page-zone.com/</font" target="_blank">http://www.page-zone.com/</font</a>>
 > Put a.w.w. in subject if you email me or it might be trashed


Heidi,

Sorry, I should have been more clear. I was referring to an FTP, Telnet
or SSH password - these are the most probable ways someone would get
in. This could include your root (linux) or Administrator (Windoze)
password.

Alternatively, it's possible they got in through a security hole (i.e.
RPC), especially if you're on Windoze. But most hackers aren't
knowledgeable enough to go this far, and the hackers who are
knowledgeable prefer to go after higher profile sites like the FBI .


--

To reply, delete the 'x' from my email
Jerry Stuckle,
JDS Computer Training Corp.
jstucklex DeleteThis @attglobal.net
Member of Independent Computer Consultants Association - <a style='text-decoration: underline;' href="http://www.icca.org" target="_blank">www.icca.org</a><!-- ~MESSAGE_AFTER~ -->
 >> Stay informed about: Computer hijacked?