Security

Ask something
Discussion Locked

Help needed, ASAP

0 helpful
13 replies

by voldar

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi there,

If it were some time ago, I would have asked for help in the Q&A section, but now, I am really having problems with some networks - of course, a spyware "attack". I tried anything, starting with Ad-Aware, and finishing with SpyBot, but it is not getting me to a concludent answer.
So, here it is my problem. If I logon into a domain/local (with any type of user accounts), each time, a web page splashes on my desktop, saying http://rev0lt.net/index.html, web page wich is empty, of course.
I used Ad-Aware, as local administrator, it finds some spyware programs, and deletes them all. I restart the computer, the web page splash into "my face" again! If I disable the NIC, and use the anti-spyware programs, everything is okay, even after I reboot, I have no more the web page splashing on my desktop. As soon as I enable the NIC, here it comes again :(.
I scanned the server, every computer, one by one, but it seams that is not getting me in a place to solve the problem. Ouch, I forgot to say, my users use roaming profiles, and I suspect that whatever I have in my network is profile resident. But although I scanned the server too, I had no results.
If anyone had this problem, with the web page getting to the http://rev0lt.net/index.html, I would be very gratefull to give some directions.

Thank you in advance!

VLAD

13 replies

by zlitocook

With your network. Are you using a firewall or antivirus software/hardware? You should find out what port/ports that is using. You should be blocking all ports except what is needed. We block all ports except two and only open ports when needed, like for a net meeting ect. Get a company to come in and help you scan, clean up and help you with security. It sounds like you have a registry problem and maby a bot problem. Have you tried packet filtering to see how much leaves your network? You may be a spam bot and not know it. A good IDS/IPS softeware/ hardware can help. Good luck.

by voldar

I already did that, but it uses a Microsoft DCOM exploit, that goes with 445 port .. and for now .. I can't find anything to stop it, not even on the Microsoft page.

by astronusa

Since you seem very knowledgable.. If I was in your shoes my next step after adaware and spybot.. Is to use a slightly more dangerous program called hijackthis http://tomcoyote.org/hjt/#Top.... I say dangerous in that. In the wrong hands it can really screw some things up. I am not a pro but this program has helped me fix several hijack type problems.

by voldar

I finally managed to solve the problem, using not only Ad-Aware and Spybot, but also XP SP2, which I deployed on all the networks, after several tests, of course!. And finally, the things are going to be safe now ;).
This firewall is great in XP2, as long as you learn how to deal with it. Here are some links that explains how to use it in a prof. manor :D.

http://www.microsoft.com/downloads/details.aspx?FamilyID=4454e0e1-61fa-447a-bdcd-499f73a637d1&DisplayLang=en

http://www.microsoft.com/technet/community/columns/cableguy/cg0204.mspx

Good day all, and again, thanks for your help!!

by wordworker

Here's what worked for me. I just got broadband installed, clicked on a bad link and POW! My IE6 got hijacked. I could change the home page but it would change back. I could go to one site safely, but the next move spawned popups and search site crap. Was able to get to mozilla and download firefox, then went to lavasoft and got the free, personal version of ad-aware. Ran it once, it found X bad objects and deleted or quarantined them. Launched IE, still bad. Ran ad-aware again, rebooted, ran it again, rebooted, and finally after the fourth deep scan, IE6 was back like it had been freshly installed. But it took getting to zero bad objects/files found two or three times in a row with reboots in between before it was completely gone.

by voldar

was intended to be here .. but by mystake I linked it to a wrong place. I make my mea culpa, and again, THANK YOU!

by cmoore

I notice that no one has mentioned it's a resource-hog. I just got a new computer, fast processor, lots of ram (but still on dial-up). Other programs work well but when I'm online, I'm now about 10% of the speed of my old box. Sometimes I can't even get to websites or download email.

Using Netscape, expect to swith to Firefox, don't want IE because of its holes, don't want to get XP SP2 because of problems I've heard about it. If that's the case, is Ad-Aware still the way to go?

Thanks.
Cat

by tlewicke

I had the same problem and did a Google search. I found this with some suggestions www.dslreports.com/forum/remark,11412856~mode=flat
I haven't tried his suggestions yet, but I will as soon as I get off the inet.
The rev0lt reportedly puts the following files in %systemroot%\system32 in machines with Window 2000 or XP, sys32.exe, bling.exe and index.exe. If SP4 is not installed there may also be a hidden file called msnmgr5.exe. Microsoft has patches, KB828035,KB828741, KB828749 and KB835732.

I hope this works,

Tom

by vikasarora

I face the same problem with rev0lt.net site and another site gen0cide.com...

tried all tricks with NAV but hopeless...Have been trying to delete index.exe etc from registry and hard disk but somehow everything seems to come back on next reboot...

has anyone else faced the same problem with gen0cide and rev0lt ??

Any advise and help ?

by empolgadao

Hi there,

I'm from Brazil. I've faced that boring problem of having rev0lt.net splashing into my face everytime I boot my PC. It drives me crazy.
Please, anybody, help me.

Thanks.

This discussion is closed to new replies.