A word about spyware, hijacks, trojans, worms & dialers

bongo3 · 2004-04-18, 10:31 PM

Hi there,

i spent the last hour to remove a fuckin dialer.
Normally hijackthis, cws, ad aware and pestpatrol
get rid of that stuff.
Anyone having problems removing that stuff?

i put together some free software links and some hints
to remove unwanted software such as
spyware, worms, trojans, dialers & hijacks
you are redirected to other websites?

http://www.tgpbb.com/aboutspyware/index.html

the tools are free and there is no affiliate link
bye
Bongo

SirMoby · 2004-04-19, 10:02 AM

That's a nice list Bongo. I hope people use it

MrMaryLou · 2004-04-19, 10:08 AM

Man this one has been driving me nuts mk:@MSITStore:C:\WINDOWS\start.chm::/spad.html been every where can be removed but it keeps coming back ? Changes your home page setting have done it all updates hijack this takes it out but cant seen the block it from coming back any ideas ?

Surfn · 2004-04-19, 10:13 AM

Quote:

Originally posted by MrMaryLou
Man this one has been driving me nuts mk:@MSITStore:C:\WINDOWS\start.chm::/spad.html been every where can be removed but it keeps coming back ? Changes your home page setting have done it all updates hijack this takes it out but cant seen the block it from coming back any ideas ?

If it's on an XP box restore it to a date prior to the start of the infection.

MrMaryLou · 2004-04-19, 10:21 AM

Did that too but it keeps coming back I am sure its something thats embeded in galleries that I am reviewing

Surfn · 2004-04-19, 10:30 AM

Did you search for it in regedit?

MrMaryLou · 2004-04-19, 10:32 AM

Yep removed it many times just keeps getting reset

RawAlex · 2004-04-19, 12:08 PM

MML: There are using an EXE file attached to the startup or other routine to reinstall it. Some of them actually replace the exe file of your internet explorer so that when you open a browser, they get reinstalled. Check each of your commonly used icons.

Also, in the registry, check your RunOnce and Startup sections to see what is being run at startup.

Finally, you can boot your system with verification, and check each item as it is loaded from the registry... you might be able to spot it there.

Alex

MeatPounder · 2004-04-19, 12:08 PM

Quote:

Originally posted by MrMaryLou
Man this one has been driving me nuts mk:@MSITStore:C:\WINDOWS\start.chm::/spad.html been every where can be removed but it keeps coming back ? Changes your home page setting have done it all updates hijack this takes it out but cant seen the block it from coming back any ideas ?

I love my lil scottish terrier

http://winpatrol.com/
the free version alerts you whenever any browser hijacker tries to add a toolbar or home page redirect and asks if you want to allow it...and stops their nasty deeds when you refuse.
It also alerts you to any new software installed

T Pat · 2004-04-19, 12:13 PM

Good Job Bongo
I picked this piece of scumwhere up
http://nkvd.us/ which redirected to http://searchpage.cc/
The uninstall didn’t work, yesterday they added instructions that told which file in the registry to delete.
Here’s the last sentence in the uninstall directions:
“Enjoy with your clear PC.. and stop looking for free porn - try to buy membership on a good paysite”

To The Owner Of nkvd.us My name id Pat Bray I live on Dock 8, Driscolls Wharf, San Diego and I want a piece of your ass!!!

I add a thumbnail linking to a gallery of a new girl to my paysite once a week, last week when I went to add the update half the images were stripped when I uploaded the file, Yesterday all the images were being stripped, I would view a saved copy, all the thumbnails would be there then when I would upload the file they would be fucking gone.
<A href="http://www.tiajuanawhores.com/members/norma/index.htm">
<IMG height=100 src="images/norma.jpg" width=76 border=0></A>

<A href="http://www.tiajuanawhores.com/members/norma/index.htm">
<IMG height=100 src=" " width=76 border=0></A>

Instead of spending a nice relaxing day with my wife, I spent the whole day removing scumware and trying to get my thumbnails back up.
I think I have everything fixed on my computer now except view source I can view the source of a saved web page but can’t view the source on the internet any ideas?

grzepa · 2004-04-19, 01:19 PM

Thanks for the link

Im still fucked up by some shit turning my IE start page into some "warning" crap saying i need to use one of the anty-spyware proggies they offer... now when I type anything in address bar I have to close to pop-ups (that arent blocked by my google toolbar) before i can see the URL i typed... whats even worse is that these 2 pop-ups often contain CP...

DavidM · 2004-04-19, 04:49 PM

Good Information. You have it included there but a lot of people just put it off... So, again: It is very important to install the critical security updates if you are using microsoft windows. Many of these things use these vulnerabilities in order to take root. Also by the time the patch is available, the problem is probably already being exploited. So waste no time.

Also, do not forget about Zones in Internet Explorer and your settings. If you have it configured to allow scripting without at least a prompt, perhaps you may wish to reconsider. If the prompts annoy you, you can always add your routine trusted sites to your "Trusted Zone" where you can set it up without prompts.

And bear in mind: Each layer of security you add further protects you, but no one program or setting (etc) will protect you from everything. Good security will come from everything being in place and working together. Fail to protect yourself in one area and the other precautions you take will likely mean nothiing in the end.

urb · 2004-04-20, 04:40 AM

I think it's a lot safer to surf "unknown" sites with a non Microsoft browser....

http://www.mozilla.org/

I only use IE to read page rank and to test sites I'm working on.

plateman · 2004-04-20, 05:12 AM

yea just spent the last 2 fucken hours getting rid of nkvd.us tryed everything till i started windows in safe mode and re ran cw shredder. spy bot, adware and everything looks good thank goodness

what a cock

Fonz · 2004-04-20, 07:19 AM

this C:\searchpage.html thing got on one of the machines I use yesterday and can't seem to get rid of it

Tried CWShredder and HiJackThis but no succes so far

T Pat · 2004-04-20, 10:35 AM

Me Too Fonz
I ended up useing system restore to a previouse date
Now my emails aren't getting through to outlook

Cleo · 2004-04-20, 10:49 AM

Quote:

Originally posted by urb
I think it's a lot safer to surf "unknown" sites with a non Microsoft browser....

http://www.mozilla.org/

I only use IE to read page rank and to test sites I'm working on.

Or for truly carefree computer use a non Microcrap OS.

MrMaryLou · 2004-04-20, 10:52 AM

Man this all sucks so much spent allot of the day yesterday trying to find what the home page changer is attached too but still no MS is even baffeled on this one

priest · 2004-04-20, 11:06 AM

MML, have you tried Bazooka?

Since I downloaded it, I've never had problems removing all this crap. It's free and scans your machine for 2 seconds. Then it lets you know how to manually remove the shit.

Here is the URL, give it a try man.

http://www.kephyr.com/spywarescanner/

plateman · 2004-04-20, 12:36 PM

man am i happy i got my stuff fixed was up till 6 in the morning trying to get rid of the shit and from doing searches on nkvd.us some people cant get rid of the shit

ended up turning off system restore starting in safe mode and ran everthing that was sugguested to kill that fucker

TijuanaPat i am with you, if i ever find that motherfucker i will kick his teeth down his to throat

T Pat · 2004-04-20, 01:48 PM

I have spent the last three days trying to straighten out my system I think I got it all fixed now

been up since 3:30 screwing with outlook and going back and forth with Cyberwurx support, they finale found out why I wasn't getting emails:

There was a small scrambled message in there. It of course was for Viagra. I
deleted it and that unstopped it.

Stomach has been in knots for three days and I haven't gotten anything constructive done. I hope it's over

urb · 2004-04-20, 01:57 PM

If you are using Outlook or Outlook Distress... you may want to go to Tools>Options>Read and then check the box that says "Read all messages in plain text".

Minimise the entry points.

T Pat · 2004-04-20, 03:42 PM

Ok Urb it's done thanx for the advice

Cleo · 2004-04-21, 09:04 AM

Interesting article about spyware
http://www.zdnet.com.au/news/securit...9145385,00.htm

urb · 2004-04-21, 09:27 AM

This is one big can of worms because the authorities and anti-virus companies are soon gonna go crazy with anti-cookie, anti-banner anti-htaccess and anti-console.

With no banners we'll be using text links which won't be tracked to our sponsors because the cookie will be blocked.

Norton Internet Security already has issues with .htaccess anti-hotlink protected images... so maybe the answer to this is to cover every domain with anti-hotlink .htaccess, so the surfers cannot see the pics without lowering their privacy settings.

2004-04-18, 10:31 PM	#1
bongo3 Internet! Is that thing still around? Join Date: Mar 2004 Posts: 9	A word about spyware, hijacks, trojans, worms & dialers Hi there, i spent the last hour to remove a fuckin dialer. Normally hijackthis, cws, ad aware and pestpatrol get rid of that stuff. Anyone having problems removing that stuff? i put together some free software links and some hints to remove unwanted software such as spyware, worms, trojans, dialers & hijacks you are redirected to other websites? http://www.tgpbb.com/aboutspyware/index.html the tools are free and there is no affiliate link bye Bongo __________________ TRADE TRAFFIC SUBMIT YOUR GALLERIES

2004-04-19, 10:08 AM	#3
MrMaryLou i fucking told i type to fucking fast wtf Join Date: Mar 2003 Location: New York Posts: 11,247	Man this one has been driving me nuts mk:@MSITStore:C:\WINDOWS\start.chm::/spad.html been every where can be removed but it keeps coming back ? Changes your home page setting have done it all updates hijack this takes it out but cant seen the block it from coming back any ideas ? __________________ <a href="http://www.greenguysboard.com/onthebench/">Join Me For On The Bench </a>

2004-04-19, 10:21 AM	#5
MrMaryLou i fucking told i type to fucking fast wtf Join Date: Mar 2003 Location: New York Posts: 11,247	Did that too but it keeps coming back I am sure its something thats embeded in galleries that I am reviewing __________________ <a href="http://www.greenguysboard.com/onthebench/">Join Me For On The Bench </a>

2004-04-19, 10:32 AM	#7
MrMaryLou i fucking told i type to fucking fast wtf Join Date: Mar 2003 Location: New York Posts: 11,247	Yep removed it many times just keeps getting reset __________________ <a href="http://www.greenguysboard.com/onthebench/">Join Me For On The Bench </a>

2004-04-19, 12:13 PM	#10
T Pat You can now put whatever you want in this space :) Join Date: Aug 2003 Location: Paridise Posts: 3,244	Good Job Bongo I picked this piece of scumwhere up http://nkvd.us/ which redirected to http://searchpage.cc/ The uninstall didn’t work, yesterday they added instructions that told which file in the registry to delete. Here’s the last sentence in the uninstall directions: “Enjoy with your clear PC.. and stop looking for free porn - try to buy membership on a good paysite” To The Owner Of nkvd.us My name id Pat Bray I live on Dock 8, Driscolls Wharf, San Diego and I want a piece of your ass!!! I add a thumbnail linking to a gallery of a new girl to my paysite once a week, last week when I went to add the update half the images were stripped when I uploaded the file, Yesterday all the images were being stripped, I would view a saved copy, all the thumbnails would be there then when I would upload the file they would be fucking gone. <A href="http://www.tiajuanawhores.com/members/norma/index.htm"> <IMG height=100 src="images/norma.jpg" width=76 border=0></A> <A href="http://www.tiajuanawhores.com/members/norma/index.htm"> <IMG height=100 src=" " width=76 border=0></A> Instead of spending a nice relaxing day with my wife, I spent the whole day removing scumware and trying to get my thumbnails back up. I think I have everything fixed on my computer now except view source I can view the source of a saved web page but can’t view the source on the internet any ideas? __________________ How To Keep An Asshole In Suspense I'll Tell You Later

2004-04-19, 10:02 AM	#2
SirMoby Jim? I heard he's a dirty pornographer. Join Date: Aug 2003 Location: Washington, DC Posts: 2,706	That's a nice list Bongo. I hope people use it

2004-04-19, 10:30 AM	#6
Surfn If you don’t take a chance the Angels won’t dance Join Date: Aug 2003 Location: Earth on occasion Posts: 8,812	Did you search for it in regedit?

2004-04-19, 12:08 PM	#8
RawAlex Took the hint. Join Date: Mar 2003 Posts: 5,597	MML: There are using an EXE file attached to the startup or other routine to reinstall it. Some of them actually replace the exe file of your internet explorer so that when you open a browser, they get reinstalled. Check each of your commonly used icons. Also, in the registry, check your RunOnce and Startup sections to see what is being run at startup. Finally, you can boot your system with verification, and check each item as it is loaded from the registry... you might be able to spot it there. Alex

2004-04-19, 01:19 PM	#11
grzepa You can now put whatever you want in this space :) Join Date: Nov 2003 Posts: 980	Thanks for the link Im still fucked up by some shit turning my IE start page into some "warning" crap saying i need to use one of the anty-spyware proggies they offer... now when I type anything in address bar I have to close to pop-ups (that arent blocked by my google toolbar) before i can see the URL i typed... whats even worse is that these 2 pop-ups often contain CP... __________________ RATIOS SUCK ? - TRY REALITYCASH !

2004-04-19, 04:49 PM	#12
DavidM If something goes wrong at the plant, blame the guy who can't speak English Join Date: Oct 2003 Location: Florida Posts: 38	Good Information. You have it included there but a lot of people just put it off... So, again: It is very important to install the critical security updates if you are using microsoft windows. Many of these things use these vulnerabilities in order to take root. Also by the time the patch is available, the problem is probably already being exploited. So waste no time. Also, do not forget about Zones in Internet Explorer and your settings. If you have it configured to allow scripting without at least a prompt, perhaps you may wish to reconsider. If the prompts annoy you, you can always add your routine trusted sites to your "Trusted Zone" where you can set it up without prompts. And bear in mind: Each layer of security you add further protects you, but no one program or setting (etc) will protect you from everything. Good security will come from everything being in place and working together. Fail to protect yourself in one area and the other precautions you take will likely mean nothiing in the end.

2004-04-20, 04:40 AM	#13
urb All the way from Room 101 Join Date: Aug 2003 Posts: 3,557	I think it's a lot safer to surf "unknown" sites with a non Microsoft browser.... http://www.mozilla.org/ I only use IE to read page rank and to test sites I'm working on. __________________

2004-04-20, 05:12 AM	#14
plateman What can I do - I was born this way LOL Join Date: Oct 2003 Location: ohio Posts: 3,086	yea just spent the last 2 fucken hours getting rid of nkvd.us tryed everything till i started windows in safe mode and re ran cw shredder. spy bot, adware and everything looks good thank goodness what a cock __________________ Submit to: Porn O Plenty XXX Links Reality Here Last edited by plateman; 2004-04-20 at 05:34 AM..

2004-04-20, 07:19 AM	#15
Fonz Former pr0n slinger. Join Date: Aug 2003 Location: Antwerp, Belgium Posts: 7,929	this C:\searchpage.html thing got on one of the machines I use yesterday and can't seem to get rid of it Tried CWShredder and HiJackThis but no succes so far __________________ See how I abuse little trees on my Shumi no Bonsai Blog

2004-04-20, 10:35 AM	#16
T Pat You can now put whatever you want in this space :) Join Date: Aug 2003 Location: Paridise Posts: 3,244	Me Too Fonz I ended up useing system restore to a previouse date Now my emails aren't getting through to outlook __________________ How To Keep An Asshole In Suspense I'll Tell You Later

2004-04-20, 10:52 AM	#18
MrMaryLou i fucking told i type to fucking fast wtf Join Date: Mar 2003 Location: New York Posts: 11,247	Man this all sucks so much spent allot of the day yesterday trying to find what the home page changer is attached too but still no MS is even baffeled on this one __________________ <a href="http://www.greenguysboard.com/onthebench/">Join Me For On The Bench </a>

2004-04-20, 11:06 AM	#19
priest If something goes wrong at the plant, blame the guy who can't speak English Join Date: Aug 2003 Posts: 37	my 2 cents MML, have you tried Bazooka? Since I downloaded it, I've never had problems removing all this crap. It's free and scans your machine for 2 seconds. Then it lets you know how to manually remove the shit. Here is the URL, give it a try man. http://www.kephyr.com/spywarescanner/

2004-04-20, 12:36 PM	#20
plateman What can I do - I was born this way LOL Join Date: Oct 2003 Location: ohio Posts: 3,086	man am i happy i got my stuff fixed was up till 6 in the morning trying to get rid of the shit and from doing searches on nkvd.us some people cant get rid of the shit ended up turning off system restore starting in safe mode and ran everthing that was sugguested to kill that fucker TijuanaPat i am with you, if i ever find that motherfucker i will kick his teeth down his to throat __________________ Submit to: Porn O Plenty XXX Links Reality Here Last edited by plateman; 2004-04-20 at 12:38 PM..

2004-04-20, 01:48 PM	#21
T Pat You can now put whatever you want in this space :) Join Date: Aug 2003 Location: Paridise Posts: 3,244	I have spent the last three days trying to straighten out my system I think I got it all fixed now been up since 3:30 screwing with outlook and going back and forth with Cyberwurx support, they finale found out why I wasn't getting emails: There was a small scrambled message in there. It of course was for Viagra. I deleted it and that unstopped it. Stomach has been in knots for three days and I haven't gotten anything constructive done. I hope it's over __________________ How To Keep An Asshole In Suspense I'll Tell You Later

2004-04-20, 01:57 PM	#22
urb All the way from Room 101 Join Date: Aug 2003 Posts: 3,557	If you are using Outlook or Outlook Distress... you may want to go to Tools>Options>Read and then check the box that says "Read all messages in plain text". Minimise the entry points. __________________

2004-04-20, 03:42 PM	#23
T Pat You can now put whatever you want in this space :) Join Date: Aug 2003 Location: Paridise Posts: 3,244	Ok Urb it's done thanx for the advice __________________ How To Keep An Asshole In Suspense I'll Tell You Later

2004-04-21, 09:04 AM	#24
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	Interesting article about spyware http://www.zdnet.com.au/news/securit...9145385,00.htm __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2004-04-21, 09:27 AM	#25
urb All the way from Room 101 Join Date: Aug 2003 Posts: 3,557	This is one big can of worms because the authorities and anti-virus companies are soon gonna go crazy with anti-cookie, anti-banner anti-htaccess and anti-console. With no banners we'll be using text links which won't be tracked to our sponsors because the cookie will be blocked. Norton Internet Security already has issues with .htaccess anti-hotlink protected images... so maybe the answer to this is to cover every domain with anti-hotlink .htaccess, so the surfers cannot see the pics without lowering their privacy settings. __________________