Saturday, July 10, 2004
Gone and Already Forgotten
This blog is out of service for an indefinite period of time.
I might start posting again at some point in the future.
I might not.
I might start posting again at some point in the future.
I might not.
Saturday, July 03, 2004
AdWare
Well I don't really know the details of how it happened but adware was surreptitiously installed on one of my desktops, (I have several computers, but 3 that are currently set up and running, a Linux box, a Windows box and a Dell laptop). Of course it was the Windows box that got it.
This happened to me once before on my laptop about 8 months ago. It took me two days to get the fucking thing off my computer. That one was WINSHOW. It's a nasty little fucker. All the standard AdWare, SpyWare and virus removal devices didn't get it off. Every time I removed it, it magically would reappear when I rebooted the machine. I installed a port monitor and checked what was making external calls during start up and found a program that had been installed that made a remote call to redownload WINSHOW at start up. I deleted that program, deleted all the WINSHOW files and cleaned up my registry and that took care of it.
What was a really annoying was that all removal procedures recommened by companies like McAfee and Symantic didn't fix the problem. I even went to the trouble of contacting Symantic and providing them with updated information on WINSHOW and the details of how I removed it from my computer. They ignored me.
This time I had some fucking thing that changed my home page to "about:blank" which displayed some search engine bullshit and a pop-up window that informed me that I have spy-ware on my computer and offered a link for a removal device.
Changing my home page back to what I usually use wouldn't work. Everytime I closed all browser windows and opened a new one sure enough my home page was set back "about:blank" with the same crap.
So I searched the internet looking for answers. And I found some. I downloaded several adware, spyware and virus removal applications, including Norton, CWShredder, Ad-Aware, HiJackThis and Stringer.
I ran them and removed all kinds of shit, (about 20 files and registry entries) off my machine.
When I went to bed last night everything looked good.
But sure enough this morning the shit was back.
This time I ran all the removal/scan programs several times.
I rebooted into Recovery Mode and found some hidden dlls in system32 directory.
I deleted those fuckers.
But nothing would get rid of it.
So finally I searched on everything associated with "about:blank" in my registry and deleted all entries that came up. Then I ran Ad-Aware, HiJackThis, CWShredder and Norton again.
Now it looks like the bullshit is gone, or if not gone disabled.
I viewed the source of the unwanted homepage and saved it.
The target url of the search was http://oz.msie.tv -- DO NOT GO TO THIS WEBSITE!
So I looked the fuckers up and here's what I got.
msie.tv
Registrant:
Lie Domak (liedomak@yahoo.de)
Post Box 2321
Beirut, NONE 5098
LB
+1 8004347824
Domain Name: msie.tv
Administrative, Technical, Billing Contact:
Lie Domak (liedomak@yahoo.de)
Post Box 2321
Beirut, NONE 5098
LB
+1 8004347824
Record created on Feb 5 2004.
Record expires on Feb 5 2006.
Domain servers:
ns2.msie.cc
ns3.msie.cc
Now how do I get these fuckers back?
Suggestions welcomed.
This happened to me once before on my laptop about 8 months ago. It took me two days to get the fucking thing off my computer. That one was WINSHOW. It's a nasty little fucker. All the standard AdWare, SpyWare and virus removal devices didn't get it off. Every time I removed it, it magically would reappear when I rebooted the machine. I installed a port monitor and checked what was making external calls during start up and found a program that had been installed that made a remote call to redownload WINSHOW at start up. I deleted that program, deleted all the WINSHOW files and cleaned up my registry and that took care of it.
What was a really annoying was that all removal procedures recommened by companies like McAfee and Symantic didn't fix the problem. I even went to the trouble of contacting Symantic and providing them with updated information on WINSHOW and the details of how I removed it from my computer. They ignored me.
This time I had some fucking thing that changed my home page to "about:blank" which displayed some search engine bullshit and a pop-up window that informed me that I have spy-ware on my computer and offered a link for a removal device.
Changing my home page back to what I usually use wouldn't work. Everytime I closed all browser windows and opened a new one sure enough my home page was set back "about:blank" with the same crap.
So I searched the internet looking for answers. And I found some. I downloaded several adware, spyware and virus removal applications, including Norton, CWShredder, Ad-Aware, HiJackThis and Stringer.
I ran them and removed all kinds of shit, (about 20 files and registry entries) off my machine.
When I went to bed last night everything looked good.
But sure enough this morning the shit was back.
This time I ran all the removal/scan programs several times.
I rebooted into Recovery Mode and found some hidden dlls in system32 directory.
I deleted those fuckers.
But nothing would get rid of it.
So finally I searched on everything associated with "about:blank" in my registry and deleted all entries that came up. Then I ran Ad-Aware, HiJackThis, CWShredder and Norton again.
Now it looks like the bullshit is gone, or if not gone disabled.
I viewed the source of the unwanted homepage and saved it.
The target url of the search was http://oz.msie.tv -- DO NOT GO TO THIS WEBSITE!
So I looked the fuckers up and here's what I got.
msie.tv
Registrant:
Lie Domak (liedomak@yahoo.de)
Post Box 2321
Beirut, NONE 5098
LB
+1 8004347824
Domain Name: msie.tv
Administrative, Technical, Billing Contact:
Lie Domak (liedomak@yahoo.de)
Post Box 2321
Beirut, NONE 5098
LB
+1 8004347824
Record created on Feb 5 2004.
Record expires on Feb 5 2006.
Domain servers:
ns2.msie.cc
ns3.msie.cc
Now how do I get these fuckers back?
Suggestions welcomed.
