|
Next: Ping Red
|
| Author |
Message |
External
Since: Apr 29, 2004
Posts: 1010
|
(Msg. 16) Posted: Thu Nov 06, 2003 4:17 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: alt>www>webmaster (more info?)
|
|
|
"Heidi" <blackcat2.RemoveThis@zwallet.com> wrote in message
news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
> Okay here is the deal. I had my computer on but I wasn't
> here. I got back in here around 1pm
>
> My system had been rebooted and the computer said
> it was a 'serious error'
>
> I also noted my homepage was changed which is funny because
> it was not changed when I left and no one had been touching this computer.
>
> Was I hacked and someone changed my homepage etc? If they did
> they are not too bright because the search engine page that replaced
> my homepage has an affiliate id.
>
> This is creeping me out and I have no idea what is going on.
>
Check your registry entries.
Look for ones to do with your browser - good rule of thumb, make a back up
of your registry regularly, that way when something happens it is easy to
restore system to prior defaults.<!-- ~MESSAGE_AFTER~ --> |
|
| Back to top |
|
 | |
External
Since: Sep 25, 2003
Posts: 106
|
(Msg. 17) Posted: Thu Nov 06, 2003 4:50 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Heidi wrote:
> Charging up on a white horse Wipkip said:
> : MS thingy. <grin>
>
> Maybe but I could not change the homepage back. I mean I could
> but it kept changing back to that stupid search engine page which was
> locally stored on my system.
>
> So I found that page in my windows directory and changed the HTML
> with that of my normal browser homepage. So now if it changes back to that
> page in the windows directory it won't matter.
Do you mean orbit explorer or something? I got the same thing recently
and I think it's spyware.<!-- ~MESSAGE_AFTER~ --> |
|
| Back to top |
|
| |
External
Since: Jun 28, 2003
Posts: 585
|
(Msg. 18) Posted: Thu Nov 06, 2003 4:50 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Charging up on a white horse David Venn-Brown said:
: Do you mean orbit explorer or something? I got the same thing recently
: and I think it's spyware.
no I don't think so. It had no name or anything on it. It looked like
a one person job. I saved the html page until I can hopefully squeeze
out of the search engine site whose affiliate ID it was.
--
Heidi
PaidToReads: http://www.paidtoreads.com/
Recommended Hosting: http://www.page-zone.com/
Put a.w.w. in subject if you email me or it might be trashed >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Jun 29, 2003
Posts: 371
|
(Msg. 19) Posted: Thu Nov 06, 2003 7:05 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
"Sam (primetlc® webmaster)" <prime-tee-ell-cee RemoveThis @tiscali.com> wrote in
message news:3faa0c8d$1_1@mk-nntp-2.news.uk.tiscali.com
> "Heidi" <blackcat2 RemoveThis @zwallet.com> wrote in message
> news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
>> Okay here is the deal. I had my computer on but I wasn't
>> here. I got back in here around 1pm
>>
>> My system had been rebooted and the computer said
>> it was a 'serious error'
>>
>> I also noted my homepage was changed which is funny because
>> it was not changed when I left and no one had been touching this
>> computer.
>>
>> Was I hacked and someone changed my homepage etc? If they did
>> they are not too bright because the search engine page that replaced
>> my homepage has an affiliate id.
>>
>> This is creeping me out and I have no idea what is going on.
>
> Hmmm...This sounds strangely familiar.....Something has gotten onto my
> system and is doing something very similar, yet subtly different.....
>
> On some web pages, every other link gets changed to point to a search
> page called ToonComcs or something similar.....All the links in
> between remain unchanged, and when I refresh the page, the links all
> go back to normal again.....
>
> I've followed the advice on the Symantec homepage to fix it, but
> nothing works.....The problem keeps persisting......I think there's
> something paticularly nasty out there.....
As Andy K said:
Download Spybot --
<a style='text-decoration: underline;' href="http://www.safer-networking.org/index.php?lang=en&page=download" target="_blank">http://www.safer-networking.org/index.php?lang=en&page=download</a>
--
Red E. Kilowatt
Advertise your webmaster-related products
and services in news:alt.www.webmaster.ads
Read the FAQs at: <a style='text-decoration: underline;' href="http://aww-faq.org" target="_blank">http://aww-faq.org</a> and <a style='text-decoration: underline;' href="http://awwa.aww-faq.org/" target="_blank">http://awwa.aww-faq.org/</a><!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Nov 05, 2003
Posts: 41
|
(Msg. 20) Posted: Thu Nov 06, 2003 10:38 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
rjdriver wrote:
> "Heidi" <blackcat2.DeleteThis@zwallet.com> wrote in message
> news:vlcqb.11375$Mc.2426@twister.austin.rr.com...
>> Okay here is the deal. I had my computer on but I wasn't
>> here. I got back in here around 1pm
>>
>> My system had been rebooted and the computer said
>> it was a 'serious error'
>>
>> I also noted my homepage was changed which is funny because
>> it was not changed when I left and no one had been touching this
>> computer.
>>
>> Was I hacked and someone changed my homepage etc? If they did
>> they are not too bright because the search engine page that replaced
>> my homepage has an affiliate id.
>>
>> This is creeping me out and I have no idea what is going on.
>>
>> --
>> Heidi
<font color=green> >> PaidToReads: <a style='text-decoration: underline;' href="http://www.paidtoreads.com/</font" target="_blank">http://www.paidtoreads.com/</font</a>>
<font color=green> >> Recommended Hosting: <a style='text-decoration: underline;' href="http://www.page-zone.com/</font" target="_blank">http://www.page-zone.com/</font</a>>
>> Put a.w.w. in subject if you email me or it might be trashed
>>
>>
>
> I consider myself pretty computer savvy when it comes to spyware and
> viruses. I scan for both regualrly and never download anything I'm
> not sure of, but a few weeks ago, a copy of Gator got itself onto my
> machine just by visiting a web site or clicking on an ad. Still
> don't understand the mechnaics of how it did it, as I noticed nothing
> happening until the tell tale signs showed up(hijacked home page,
> etc.). I would definately run Spybot or Ad Aware - or both..
>
The moral of your story, don't click on ads. 
--
Duende<!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Sep 15, 2003
Posts: 119
|
(Msg. 21) Posted: Fri Nov 07, 2003 5:51 am
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Expressing undying admiration for ange, Heidi wrote:
> Okay here is the deal. I had my computer on but I wasn't
> here. I got back in here around 1pm
>
> My system had been rebooted and the computer said
> it was a 'serious error'
>
> I also noted my homepage was changed which is funny because
> it was not changed when I left and no one had been touching this
> computer.
>
> Was I hacked and someone changed my homepage etc? If they did
> they are not too bright because the search engine page that replaced
> my homepage has an affiliate id.
>
> This is creeping me out and I have no idea what is going on.
Do you have a firewall? Can you check the logs to see if there were any
unauthorized entries?
--
~ange
All those who believe in psychokinesis raise my hand.<!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Jun 28, 2003
Posts: 585
|
(Msg. 22) Posted: Fri Nov 07, 2003 6:58 am
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Charging up on a white horse Ange said:
: Do you have a firewall? Can you check the logs to see if there were
: any unauthorized entries?
Yes and no. RR is having some issues and I am getting pinged like crazy
still from RR IPs.
I dont' bother keeping logs anymore until they figure out why it is
happening
and stop it.
PeerGuardian keeps logs though but it would be hard to tell since I don't
know at what time it happened. I wasn't even here.
The best information I have is the referral id in the html code of the
search engine
page that replaced my browser homepage.
--
Heidi
PaidToReads: http://www.paidtoreads.com/
Recommended Hosting: http://www.page-zone.com/
Put a.w.w. in subject if you email me or it might be trashed >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Nov 05, 2003
Posts: 41
|
(Msg. 23) Posted: Fri Nov 07, 2003 7:11 am
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Heidi wrote:
> Charging up on a white horse Ange said:
>> Do you have a firewall? Can you check the logs to see if there were
>> any unauthorized entries?
>
> Yes and no. RR is having some issues and I am getting pinged like
> crazy still from RR IPs.
>
> I dont' bother keeping logs anymore until they figure out why it is
> happening
> and stop it.
>
> PeerGuardian keeps logs though but it would be hard to tell since I
> don't know at what time it happened. I wasn't even here.
>
> The best information I have is the referral id in the html code of the
> search engine
> page that replaced my browser homepage.
Format, reinstall.  )
--
Duende
<a style='text-decoration: underline;' href="http://wipkip.us" target="_blank">http://wipkip.us</a>
<a style='text-decoration: underline;' href="http://wipkip.biz" target="_blank">http://wipkip.biz</a><!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Nov 09, 2003
Posts: 6
|
(Msg. 24) Posted: Sun Nov 09, 2003 5:52 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Hi,
3 things:
1. get and run a good personal firewall
2. download and run spybot
3. download and run spyblaster
2&3 can be found at <a style='text-decoration: underline;' href="http://www.download.com" target="_blank">http://www.download.com</a>
that will clear the problem
James
Heidi wrote:
> Okay here is the deal. I had my computer on but I wasn't
> here. I got back in here around 1pm
>
> My system had been rebooted and the computer said
> it was a 'serious error'
>
> I also noted my homepage was changed which is funny because
> it was not changed when I left and no one had been touching this computer.
>
> Was I hacked and someone changed my homepage etc? If they did
> they are not too bright because the search engine page that replaced
> my homepage has an affiliate id.
>
> This is creeping me out and I have no idea what is going on.
>
> --
> Heidi
<font color=purple> > PaidToReads: <a style='text-decoration: underline;' href="http://www.paidtoreads.com/</font" target="_blank">http://www.paidtoreads.com/</font</a>>
<font color=purple> > Recommended Hosting: <a style='text-decoration: underline;' href="http://www.page-zone.com/</font" target="_blank">http://www.page-zone.com/</font</a>>
> Put a.w.w. in subject if you email me or it might be trashed
>
><!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Jun 28, 2003
Posts: 585
|
(Msg. 25) Posted: Sun Nov 09, 2003 10:27 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
| |
External
Since: Jul 09, 2003
Posts: 527
|
(Msg. 26) Posted: Sun Nov 09, 2003 10:27 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
On Sun, 09 Nov 2003 19:27:24 GMT, "Heidi" <blackcat2.RemoveThis@zwallet.com>
wrote:
>Done that.
>
>: 3. download and run spyblaster
>
>Didnt' do that but I did run Ad-Aware too
I have sometimes found that Spyblaster will find things that Ad-Aware
misses and vice versa. Since they are both free, there's no reason
not to use both.<!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Jun 29, 2003
Posts: 371
|
(Msg. 27) Posted: Sun Nov 09, 2003 10:50 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
"Heidi" <blackcat2.DeleteThis@zwallet.com> wrote in message
news:wywrb.56218$KY1.33196@twister.austin.rr.com
> Charging up on a white horse john smith said:
>
>> Hi,
>> 3 things:
>> 1. get and run a good personal firewall
>
> I have one and I had one at the time this happened too.
>
>> 2. download and run spybot
>
> Done that.
>
>> 3. download and run spyblaster
>
> Didnt' do that but I did run Ad-Aware too
>
<font color=green> >> 2&3 can be found at <a style='text-decoration: underline;' href="http://www.download.com</font" target="_blank">http://www.download.com</font</a>>
>>
>> that will clear the problem
>>
>> James
A friend of mine had a trojan on his XP system that reset his home page and
would randomly open windows with ads in them. We tried everything to get rid
of it and nothing worked. He finally had to do a clean install.
He is rather fond of porn sites and I kinda doubt he's learned his lesson
yet.
--
Red E. Kilowatt
Advertise your webmaster-related products
and services in news:alt.www.webmaster.ads
Read the FAQs at: <a style='text-decoration: underline;' href="http://aww-faq.org" target="_blank">http://aww-faq.org</a> and <a style='text-decoration: underline;' href="http://awwa.aww-faq.org/" target="_blank">http://awwa.aww-faq.org/</a><!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Sep 19, 2003
Posts: 3499
|
(Msg. 28) Posted: Sun Nov 09, 2003 10:57 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Red E. Kilowatt wrote:
> ...
> We tried
> everything to get rid of it and nothing worked. He finally had to do
> a clean install.
>
> He is rather fond of porn sites and I kinda doubt he's learned his
> lesson yet.
/whisper: javascript
Turn off javescript and if it happens again: wrap his computer neatly in a
box and tell him he can have it back when he's not too dumb to own one or
when he grows up; whichever is sooner.
--
William Tasso - <a style='text-decoration: underline;' href="http://WilliamTasso.com" target="_blank">http://WilliamTasso.com</a><!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Jun 29, 2003
Posts: 371
|
(Msg. 29) Posted: Sun Nov 09, 2003 11:08 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
"William Tasso" <SpamBlocked RemoveThis @tbdata.com> wrote in message
news:bom63s$1eq6cv$1@ID-139074.news.uni-berlin.de
> Red E. Kilowatt wrote:
>> ...
>> We tried
>> everything to get rid of it and nothing worked. He finally had to do
>> a clean install.
>>
>> He is rather fond of porn sites and I kinda doubt he's learned his
>> lesson yet.
>
> /whisper: javascript
>
> Turn off javescript and if it happens again: wrap his computer neatly
> in a box and tell him he can have it back when he's not too dumb to
> own one or when he grows up; whichever is sooner.
Rumor has it that you can buy all the porn you want on tape and DVD these
days, so there is no excuse for being so stupid.
Forgot to mention one of the really odd things. We saw a couple of programs
(forgot the names now) in add/remove programs, so we removed them. After a
reboot, they would reinstall themselves. I checked the "Run" "RunOnce"
registry keys and couldn't find anything that would do that.
--
Red E. Kilowatt
Advertise your webmaster-related products
and services in news:alt.www.webmaster.ads
Read the FAQs at: <a style='text-decoration: underline;' href="http://aww-faq.org" target="_blank">http://aww-faq.org</a> and <a style='text-decoration: underline;' href="http://awwa.aww-faq.org/" target="_blank">http://awwa.aww-faq.org/</a><!-- ~MESSAGE_AFTER~ --> >> Stay informed about: Computer hijacked? |
|
| Back to top |
|
| |
External
Since: Jun 28, 2003
Posts: 585
|
(Msg. 30) Posted: Sun Nov 09, 2003 11:59 pm
Post subject: Re: Computer hijacked? [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
| |
FAQ
Profile
Private Messages
Log in
