Warning !!!!!

K

Kirrie2001

Guest
I found this on the Langalist today. Hope it is of some use.


SPYWARE WARNING - Level: HIGH RISK!
Last night, I got a phonecall from a friend that wanted me to have a look at his PC. Thinking it was going to be an easy job, was an understatement! Internet Explorer would run but not access websites at all. I spent a total of 4hrs trying to get it up and running and failed!
It seems there is a new serious spyware component that can download itself and install, without your knowledge. The last advertising company that I can remember using this technique was RealNames, last year - no longer in operation. Now, there is one originating from the link below.
w.w.w.i.g.n.k.e.y.w.o.r.d.s..c.o.m <<<------ DO NOT CLICK ON THIS ADDRESS!!!!! (I have disabled this link for security reasons!!) - Currently, there is no known cure for this parasite. Ad-aware, Pest Patrol or any other spyware checker will not alert you or disable it. If you can 'BLOCK' this domain, then do so NOW! The uninstaller this company has on their website does not remove the spyware, browser functionality is still affected after using their removal tool.
The parasite will add 3 files to your system, and enter Registry entries. The main culprits come in the form of bho.dll and winstart.exe. The winstart.exe will execute upon restarting under msconfig. Deleting these files, does not get rid of this problem. Even un-installing your browser and re-installing will not cure this infection.
Many reports worldwide, concerning this spyware are growing. Some people have even gone to reformatting their systems. Their have been reports that it affects the search page of Internet Explorer and MSN Messenger.
Some ways of prevention are:
Do not trust a 'Certificate from IGN' as trusted - should you ever receive a dialogue of this description.
Be very careful of ActiveX Control downloads.
Do not click Yes to any popups asking for permission to download.
Make sure your Security settings are set to at least Medium or Higher.
Remember this is not a virus, so your Antivirus program will not detect it, nor will it show as an attack on a firewall program - this parasite comes directly through your browser, and render it useless!
L8rs...
H
P.S. - It looks like I will need to reformat my friends drive!

Link edited, we don't want someone elses computer getting messed up - Jewelzz
 
One of the more important reasons to install windows updates is to avoid things like that, there is a web page that is running a script that formats a visitors computer unless he has the security updates of SP1 .

But what else can you expect from an OS built around a web browser.
 
Re warning

The way I see it SP1 is not up against this parasite (& others to come). Putting this domain name on Block seems a good idea to me, but it would help to know where I can find the option to do so, haven't done it before.
 
Tools, Internet Options, Privacy, under Web Site click Edit, type in site you want to block, and click block.
 
i wounder if the education networks ahve this blocked because if they dont it could cause them real probems
 
how do u know if its on your comp already? how can u find out?
 
Jeez, I think I'll add that site to my HOSTS file. Anybody need help doing that, e-mail me.

vivid
 
re warning

Boy_alien asked How Do You Know It's Already There.
Kirrie suggests you'll find it in your Registry. But I'm not sure Registry will feature it under the domain (that dares not speak its name...) and if you have many entrees in your Reg it may be difficult to trace...? Anyway, Boy_alien, won't you notice by simply seeing your pc going bonkers?
 
Just another way to block the website

Just another way to block that website,
Whenever you type a domain in, ex www.hotmail.com, it first checks your host file if it is anything "special", and if it is not than it will contine as normal. But if it does find it than it will redirect to where ever the hosts file says (this is a very good way to block ads) So you can make ads or this website just get a error file by;

1. open run, type this in;
notepad c:\windows\system32\drivers\etc\hosts
hit enter
2. You might have a short or long file, in either case just make sure you have this at the very top (if not, copy paste)

# localhost: Needs to stay like this to work
127.0.0.1 localhost

3. than go to the last line on this file and type;
127.0.0.1[space][the website you want to block]

ex. 127.0.0.1 ad.adsmart.com
this will block out ad.adsmart.com
(if it is a www site type www.website.com)

This makes the computer look on your own computer for the page, and it will come back in error.

Enjoy!

lieb39
 
there is nothing in that site I removed all the dots and then clicked, the page is white.:cool:
 
Originally posted by Octopus
there is nothing in that site I removed all the dots and then clicked, the page is white.:cool:

You sure it hasn't caused an adverse effect to your desktop background? hehe :eek:
 
Thanks !

Thanks People, you have indirectly helped me over a small problem ... some time ago I ran an Ad killer, and have been looking to remove it ever since ! Well, it turns out that it had Filled my HOSTS file with redirects to 127.0.0.1 for just about EVERY Ad server, making my HOST file huge !! It did work though, but got annoying seeing all those page not found errors, and it did slow down surfing due to the HOSTS file size I suppose. :cool:
 
ahhhhh!

ahhh i had this parasite and i got rid of it using spy bot. at least i think it did!
 

Members online

No members online now.

Latest profile posts

Also Hi EP and people. I found this place again while looking through a oooollllllldddd backup. I have filled over 10TB and was looking at my collection of antiques. Any bids on the 500Mhz Win 95 fix?
Any of the SP crew still out there?
Xie wrote on Electronic Punk's profile.
Impressed you have kept this alive this long EP! So many sites have come and gone. :(

Just did some crude math and I apparently joined almost 18yrs ago, how is that possible???
hello peeps... is been some time since i last came here.
Electronic Punk wrote on Sazar's profile.
Rest in peace my friend, been trying to find you and finally did in the worst way imaginable.

Forum statistics

Threads
62,015
Messages
673,494
Members
5,621
Latest member
naeemsafi
Back