Hi guys I’ve wasted half my day, trying to sort my computer out. And was wondering if any here have run into episodes of some porn site stuff, which has, loaded into my computer changing my default browser to
Revolution.da.ru. several times in the last couple of weeks. Today, it really knocked me out of commission.

All day I had “google” (my default browser) and several web sites unavailable. I could load Outlaw, and another site I have to do business on. But could not load ‘google’ AVS or HTF. . I thought I had two separate issues going on. That issue of google and the web sites not available stumped SWB when I spent over an hour ½ on the phone with Southwestern Bell DSL tech support today, they never could diagnose why Googol would not load, and we hung up without resolution. Late this afternoon I got it all back when cleaning the ‘porn’ cookies and files out again. So I’m assuming that probably my browser/web site ‘PAGE NOT AVAILABLE” glitch all day is connected to the porn trash taking over my computer.
My problem is I think the ‘porn’ takeover is leaving a kernel of something somewhere I cannot trace and keeps reloading and I can’t figure out what sets it off cueing it to reload. (I have never had to ‘pay’ to get my computer worked on in all these years although I am basically computer illiterate. I just somehow muck around until I get everything running again, without knowing what I have done to ‘fix’ it. This one is stumping me and getting worse. Anyone run into this one? When it takes over, It changes the entire favorites list to all porn sites. Loads about 3 desktop icons for Porn site. Changes default browser to the Revolution address. And now evidently somehow locks me out of Google and many web sites.

This particular virus? Spam? Whatever seems to be slowly gaining a wider foothold in my system. Anyone out there dealt with this particular set of circumstances and can direct me to the ‘root’ cookies, files etc to weed out?

PS. What’s a cabinet file? I have 2 loaded checking new files for todays date, I am itching to delete since I think they might be connected to the porn takeover, but I cannot verify what they are and am concerned (I have done it in the past)…I’ll crash the whole system if I delete these.

Any computer gurus had this ‘problem’.

Thanks!

Solution: Buy a Macintosh

SLL,

You are running an antivirus program, right? Have you made sure that it's updated?

Cabinet files are a type of archive (like a .ZIP or .RAR file) that's particular to Microsoft. If you look on your OS install CD, you'll see that most of the directories are .CAB files. You say that you have two with todays date? What are their names?

As for the cookies, if you're running IE and unless you've customized your set up, they are usually in a directory called

"C:\Documents and Settings\{user name}\Cookies"

You can delete all of them if you wish, but you'll loose most any auto-logon's and passwords and stuff like that that you may have set up for web sites that you regularly visit. The only down side to this is that you'll have to manually key in your ID & password the next time you visit a site that you had previously saved. Annoying, but far from being the end of the world.

Another thing you might want to try, go to http://www.lavasoftusa.com/ and download, install and run Ad-Aware. It'll ferret out any spyware applications or applets that have been installed (usually without your knowledge) on your system and give you the chance to remove them.

Good luck!

------------------
pat----

email: pat@sklenar.info ---===--- home page: Grumpy's Lair

Hey -

At last one I can really help with! I'm a professional software engineer working in anti-virus and security technology for a while now, so while my info isn't definitive, it's at least well informed.

Try these places to scan for viruses:

http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://housecall.antivirus.com/housecall/start_corp.asp

both of these are kept current with up to the minute updates of the signature files - I like the Panda one, I think it's a bit more complete but the Trend one is a bit faster. Both are excellent scanners and both have good AV researchers.

If you are infected there are several current viruses out there that disable installed AV software, so once you get out of date and are infected with one of these guys updating at that point won't typically restore your AV to running condition.

Generally one of the above will detect and may be able to clean but if not the best bet is to carefully copy data and reinstall the OS. Once that is done install an up to date AV and then scan each backed up file before restoring it.

What is the URL you're being directed to? Add spaces or something to keep someone from accidentally linking to it....

Dear, dear Lena,

Porn cookies? I never would have imagined that you would frequent such sites. Do you earn or spend $4.98/minute? My favorite porn cookie is XXXchocolate chip with the milk of bovine kindness.

If you don't already, I would install a software firewall.

ZoneAlarm standard version is free at:

http://download.com.com/3000-2092-10039884.html?part=zonealarm&subj=dlpage&tag=button

Look at www.zonelabs.com

for info about other versions of zone alarm that have some more features but cost money.


Unlike other software firewalls, zone alarm block files that are on your computer from sending out info onto the web from your computer. You can allow specific programs to send info. Zone alarm prompts you to allow/disallow. It's a good program and it's free.

And don't go to those naughty sites. If you do, there will be NO MORE spankings for you, you little vixen!!!

Paul

He’s running tubes AND a Mac, now I’m really going to be sick.

Pat, yes but (blush) my auto update has expired. Thanks for the explaination on cabinet files. These two are:
Rb003 c:\\windows\sys.. 1,774kb 1-22-03
Rb002 same 1,775kb 1-21-03

Turns out they are not todays date. Yet this latest eposide with a larger ‘takeover’ each incident has gone on 3 times in the last few days. When I cleaned out a couple of days ago ….thought I had got it all,,,,obvously NOT.

I’ll check the cookie directory location out to see if anything can 'hide'? I clean out temp internet files and cookies constantly from the internet options box -(just live with retyping my passwords)…with DSL and heavy surfing it gets too full and clogs even with a fairly low harddrive allocation set, I find things get less glitchy if I clean these regulary and I usually do.
I think I’ve heard of Ad aware…I may have even seen them mentioned in the past when I was ridding my computer of things like Gator…right now I know I’m ‘infected’ with the company who loves to make money off my surf habits ‘webhancer’ but won’t try to rid myself of this one till I am ready to upgrade my harddrive. (when I researched removal, - many have had to re-load their OS trying to clean that one). Thanks for the reminder of some spots to look for help. I can’t tell you how tired I am of (today) loosing half my brouse capiblity, and naked women popping up all over the place…..(its never men ….what a sexist porn site ).

It even took over my 'start' button the other day, when I went to reboot because I couldn't get into the internet to shut it off. My computer is set to boot without the internet loading which is a good way to live during this. When I clicked 'start' ...well...lets just say that the shutdown/reboot box is NOT what was popping up...had to pull the plug.
Thanks again (I’ll need the luck) I never know what I’m going to (destroy) when I have to start muddling through these issues. So If I disapear for days in the next weeks…(or at any time…) you can pretty much assume I knocked myself right out of my computer and it takes me days to sort myself out when I do. The husbands no help, - he will upgrade hardware and has rebuilt our computer many times but has no patience level for software conflicts. The only thing he’ll ever do is get my mouse back for me. His version of a fix is wipe it all and reload, some of our programs have so many ‘patches’ and downloaded upgrades, - to wipe the system isn’t as palatable a method any more.


Edit: Must have been same time typing as two of you!. Arent we all up late!. Yes I have two young guys in the house (and their friends) who love my DSL. YOU THINK!!!...I"LL KILL THEM.

actually the first occurance any one had was me...I had just cleaned all the spam off my free hotmail address (there's always alot of trash when I open that one)..I alway DELETE without opening...and did that as usual...but the second I backed out of Hotmail and into the broswer it hit me (the first time) So maybe it was me (blushes).


[This message has been edited by Smart Little Lena (edited January 23, 2003).]

The rb003.cab,rb002.cab files are backup files of your registry. They should be there and have a fairly recent date. There is a virus out there that messes with home pages like you describe. You might check in your registry for the contents of HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

You should be able to see your current home page. If you don't then you've got a problem. This virus lives in standard html files (asp,htm) to prevent code like this from executing in the future (big help now I know ) Microsoft has a patch for this. Info here: http://support.microsoft.com/default.aspx?scid=KB;en-us;q275609

More info on a similar virus can be found here: http://vil.mcafee.com/dispVirus.asp?virus_k=99066

I think a good Anti Virus software should find and clean, but some verbage about Windows ME users worth reading if it applies to you.

Hope that helps.

ps. if you need help seeing getting into your registry just let me know - and (nag nag nag) while using Windows always stay current with MS updates.


[This message has been edited by TurnerF (edited January 23, 2003).]

It's not a bad idea if a truly malicious virus has in fact infested your system. If you're looking for an excuse to upgrade the HD this could be it - just put in the new drive, install your OS (I'd recommend an NT based one, certainly if you're doing real work on it), install AV protection, install your personal productivity software, get a NAT (LinkSys and many other sell really inexpensive ones) and put between you and the DSL box, then insert the old drive into the system as a second drive. With you booting from a clean and AV protected system partition it should be safe to access/scan etc. any data you need.

The 9x family (95/98/Me) of 'operating systems' - using the term quite loosely - is pretty easy to compromise, certainly if left exposed to the internet while opened for any sort of resource sharing. The NT based family (NT/2K/XP) has an actual security model that at least gives developers the tools to try and restrict unauthorized access.

In any case I'd prefer a real NAT/firewall over a personal firewall software as a first line of defense. I use both, but that's probably overkill.

EDIT - A firewall won't save you from the sort of attack where you are inadvertently pulling the infected file into your system, like accidentally clicking a link to an infected web page. This is where the OS patches (first line of defense) and good, up to date (this is critical) AV software helps as your last line of defense.

[This message has been edited by charlie (edited January 23, 2003).]

Here is a safe way to see if your AV is working:

http://www.eicar.org/anti_virus_test_file.htm

Most major AV vendors will trigger on this file as a test sample. It is not dangerous.

Thanks everyone!. So far I have not messed with anything and will pursue all the helpful links (prob this weekend) to try dig out the kernel or protect from future attacks. (I don’t’ think I dug it out yet just think I beat it back into the woodwork again) Today (crosses fingers) have not had an incident, and am scared to rock the boat till I get some more work out. Besides, - I can get sidetracked and spend hours cleaning up other things in the system when I start this path of mucking in the computer.
Turner I can't remember how to get into my registry know I've been in it in the past.
Need to dig out all the old manuals and brush up.

We paid top dollar for a larger hard drive last year and W2000, (I am running W98) but ran into some conflicts with losing the DSL line until SW Bell mailed an upgrade disc for the modem. When we loaded 2000. And I lost my laser printer (an older HP) without upgrade patches. We backed out of upgrading the system till we gathered all the resources and never went back to it. With this going (porn party on my ISP), ...its time to force ourselves in the next few months its past due for a housecleaning on my box.

But you know the drill.... Life is so hectic...and if it "ain’t' broke don't try to fix it" mentality sneaks into our daily routine. What Time I have I want to muck with AV not computers!

I think I had almost the same problem a couple of years ago and if I am remembering correctly it was not a virus at all. I got rid of it by. Going to:
Start
Then Run. Type in MSCONFIG then enter
and then found the little program under the STARTUP tab. But it may have been under one of the other tabs.
All I did was de-select it and that was all it took.
I picked up the "unwanted program," at a website while looking for "keygenerating"
cracks.
It may not be anything like your problem, but it couldn't hurt to look and see.
Good luck,
Richard

I had one like that as well - not a virus, but a real PITA, got it from some popup infested site on one of those free server places.

Good luck.

BTW - I would recommend against a Win2K upgrade from 9x, it seldom goes smoothly. I'd just archive everything (or get a new drive) and install 2K or XP pro from scratch. Both are quite smooth.

“BTW - I would recommend against a Win2K upgrade from 9x, it seldom goes smoothly. I'd just archive everything (or get a new drive) and install 2K or XP pro from scratch. Both are quite smooth.”

Yes I had heard that and we purchased the full bore Win2K and a new drive but when we loaded since we lost the printer and the DSL we did not have our resources gathered up for the changeover, - backed out and returned everything to 98 and the old drive…and then never got around to it again, - when the disc for DSL was finally received. Since that time too, my mother (who is more computer literate than I in some areas) has complained that she’s had more trouble with 2K than she ever did with 98 at home and work and recommended I stick to 98 if its working or I might regret.

I was scared and decided against XP since we “used to” yank parts and upgrade hardware very often, and we understood for self builders you have the “limited count’ on these and then have to get codes for authorization to reload the OS or upgrade parts past the few allowed…. I decided not to support that kind of (microsoft stranglehold) mentality.

I have never bought a fully loaded system from a retailer since we started with a 286, (?) years ago which was given to us second hand. It just evolved over the years until no original part was left on it including the case and power supply (gutted, - many times over) into what I have sitting here now.

I really do appreciate all the help and the second this hits me again (on the weekend) or takes me out complete, I have printed all the links (although they won’t function if I crash…so I guess I REALLY need to do this soon). Right now the thing is just hiding from me!.

Thanks again everyone!

I agree with Soundhound's assesment of the situation.

------------------
Matthew J. Hill
matt@idsi.net

Gaaak. Nooooo.

Don't buy electronics from a fruit company.

Nobody writes viruses for Macintoshes - there just aren't enough of them to make it worthwhile for the geeks, in their ego driven quest for world dominance. When a Macintosh encounters a virus written for PC's, it can't run it, thus no problem.

Actually not strictly true. As with Linux and other less popular OSs, there are viruses out there and there are also AV packages available, but just like anything else in software, the biggest 'market' gets targeted first so to speak. It's not, as some Mac users claim, that the Mac OS is any more secure. It's just as you said - popularity.

You are right, of course - The Mac OS is not immune from invasion. It would just have to be a relative 'loser' of a hacker that would bother with an OS that doesn't have even 5% of the market. Now, if a hacker wanted to paralyze Hollywood, which uses Macs almost elclusively in editing and post production, then a Mac specific virus would do the trick!

Lena, I agree that a "clean install" of a new version of an OS is much less likely to have problems than an "upgrade" install.

When I did the upgrade install from Win 98se to Win2000, things went fine. No problems showed up.

When I did the upgrade last year (2002) from Win2000 to WinXP, I had no problems with the install, but my office 2000 no longer worked. Later when I installed Roxio ezCD creator, I had problems with that as well. I worked with Microsoft support to try and fix the office 2000 problems. They sent me a utility that is suppose to clean up things in preparation for installing things. It didn't help. I tried: uninstall office 2000, re-install WinXP (upgrade route) and then re-install office2000 did not work.

I then wiped out the partition (C) that the WinXP was installed on and did a clean install of WinXP. I then had to re-install all my applications but beings I install applications on hard drive partition E, the data files were still there.

I decided to give up on Roxio ezCD creator (I have v5 and patches for WinXP) and now used Ahead's Nero burning Rom and Plextor's Plextools with no problems.

I do think that having the operating system on one partion, a fixed size swap file on another and applications and related files on yet other partition(s) is a good route to follow. If something hoses the operating system, a clean install can be done which leaves the contents of the other partions alone. Then, reinstalling the applications to their (prior) locations will afford minimum disruption.

I also use a router that has some firewall protection in addition to my software firewall. In the case of computer security, wearing both a belt and suspenders is warranted.

Lena, you may want to set up computer accounts for those who may be temped to go to those naughty sites. Do not give these new accounts administrator privilidges. It will help some.

Paul

I'd agree w/ Paul on this one - most issues in the upgrade process are not actually with the OS - Microsoft can catch those in QA. It's the things the OS group doesn't test or fix, like broken applications (even some MS apps) that are the real pain at times.

Microsoft has QA?

------------------
Matthew J. Hill
matt@idsi.net

matt,

yes, they do. the problem is the customers.

for example, some of you may have heard on the news about the SQL.Slammer work that's circulating the the 'net since last firday. It searches for 'vulnerable' MS SQL Server installations to take over and use to spread itself. I've been quite this past weekend because I've spent the past 72+ hours making sur emy company's computers are not susceptable to this. Luckily our network folks kept this worm from getting into our network. As for our database boxes, I've been responsible for roughly 100 SQL Servers for the past several years ... they were 100% protected against this. However, this situation has finally gotten me the assistance I needed to scan all of our complete networks and I now know that we have around 560+ boxes.

ugh. life sucks. MS released a fix for this hole last summer. I had it on all my boxes. the remaining 460+ ... let's just say that I'm very, very tired right now and do *not* like many customers.

However, thanks to our network folks and the DBAs who've worked with me, we've not had a single occurance of this damnable worm in-house. {sigh}

pat----

One often neglected factor is simply that software development is hard to scale. What works for a small company or project starts to fall apart rapidly as the company or project grows. When this is extrapolated to something the size of Microsoft it's a small wonder anything works. In reality they do an admirable job considering the scale they work at.

As a previous post pointed out, a lot of the problem is that they are the biggest target, not really that they're that bad. Almost all software has flaws.

SLL...SH is write again. wish i'd gone mac. the g-4 is so coool. also, it's probably to late for this, but just in case. if when you were opening explorer or whatever..did the thing automatically go to that site? you can click on 'tools' (explorer) and go to internet options..click that and you can set whatever site you want the thing to go to first. i will soon be having your problems when i retire next week. gotta give up me toshiba...and then they take me off the turner site. it's run by an ex-cia guy who really knows his stuff...the firewalls are so massive that i can't do a lotta things i want to...but we are virus protected pretty well...occasionally one gets thru...usually someone who downloaded something at home and brings it to work and goes on line thru the turner system. i gotta find a new computer and a new provider next week. several told me 'juno' is good...it's small right now and really cheap..was gonna use earthlink like me daughters but i like the 9.95 price of juno. i just need a way to get into the pipe,anyway...how's the old man?

------------------
t higg

I swapped to Mandrake Linux and what a nice OS...much better than Windows

Finally found where it was embedded, and what set it off to load every so often. It was hiding under "search" right next to 'favorties' on the explorer tool bar.

If you let the mouse get loose on a quick click and brushed the search tab while clicking in a hurry, - it activated it to load. Not sure how I did but I cleaned it out of that area. FINALLY No reload since. YEA~

I'd have to second the linux approach. I've run linux/unix for years now with 0 compromises. My web server has stood faithfully thru the countless number of viruses that ms servers have fallen to. I also REALLY like the price of linux. I just laugh when I see ms users paying to get infected.
One caveat, I do run a firewall as the first line of defense. BUT, I don't worry about opening a mail message or having my web server go zany because of weird http requests. Linux mail readers just don't fall prey to the freshman virus attack and well, what more can I say but Apache!

One thing I have noticed with Linux is, surfing the web is alot faster, web pages download faster, its like being on a high speed T1 line...and for people still wanting to run MS Office on Linux there is this:

http://www.codeweavers.com/about/press_releases/?id=20030422

[This message has been edited by HI-FI (edited April 29, 2003).]

Linux is great - one my best friends has patches in the next release - but if you're going to do business right now there is still no substitute for Windows, at least in software development for profit.

Linux may eventually be a contender on the desktop - it certainly is already on the server, but someone like IBM needs to put Apple out of their misery and port the Aqua GUI and shell to Linux. Once Linux has as good or better (and standardized) shell it will have a chance on the desktop.

It shouldn't be tough, the Mac already gave up on having it's own kernel and is running on *nix.

If your OS is limiting your web surfing speed you're either on something a lot faster than T1 (which isn't very fast BTW) or you're running a 60Mhz Pentium. Typical LAN connections (about 60x faster than T1) can't even saturate a reasonable CPU anymore. I like Linux, but lets' be real here.....

I have Linux and Windows NT on a dual boot system with a DSL connection and the Linux is faster....

Browsing speed has less to do with the OS than the browser... IE does a lot of work with it's rendering engine... if you're on Linux you're probably using Gaelon or Konquerer or something else that's much more efficient...

For a even comparison you could use Opera on both platforms... and unless your network config is really screwed up in windows they should perform the same

Not quite true. The TCP stack (the thing that actually connects you to the internet) is much cleaner under *nix. Microsoft has come some distance, but the *nix implementations are simply better. There are also multi-tasking reasons why the *nix version of the browser will perform better than the windows equivalent. That said, I agree that opera for example is going to blow the drawers off IE or netscape on either platform. The main reason you'd want to move off IE/windows is virus protection, plain and simple. Microsoft until recently just didn't care about security. Their implementations show it (The way the read mail is an example of how not to be secure.)

Ok guys I have clocked the download & upload speed on both Windows NT 4.0 (fresh install no bugs) and Mandrake Linux by using this web site:

http://bandwidthplace.com/speedtest/

and the Linux is faster by about 200KBs

I did this test several times

Note that this forum is being hosted on FreeBSD Unix/Apache, not winders. Go Outlaw. Yet another great example of Outlaw cost savings!

I don't even know where to start on this.

• Fresh install != no bugs
• Several times on two platforms isn't more than a weak indicator. Simple configuration changes can account for much more than that, as can the client implementation. This is not really an OS test.
• Most folks have a connection < 1 mbps, which isn't going to peg any reasonable machine. Even T1 is only 1.5 mbps. If you want to test throughput do it on a LAN, preferably something like 1 gbps copper.

Certainly Linux has advantages, and the new release (coming soon to a ftp site near you!) will erode several places where Windows has clear advantages over Linux in the realm of socket connection processing, but this sort of thing is way more interesting to the folks who are doing web servers and such. Client side stuff is going to be more about 'perception of speed', not reality.

And Windows presently allows more efficient processing of some sorts for network connections. This is being fixed in the next release of Linux, and the patch is available, but not everything in Linux-land is roses.



All operating systems and most applications contain bugs and vulnerabilities. Linux has two huge advantages:

• An army of developers who are willing to issue fixes quickly, and
• A smaller user base, which makes Linux a less interesting target for virus writers.

No magic there. I do AV and security software development BTW.

EDIT: Fixed a bug.

[This message has been edited by charlie (edited May 06, 2003).]