Community archive

Ask something
Discussion Locked

help punish this site

0 helpful
17 replies

by tiza

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

i don't know if this qualifies as a discussion, but what i know is that i need help desparately.
You may guess from the topic that i am very angry and i'm. somebody is causing me problems and if i knew them, i would kick their A** real bad. thing is, my IE Browser has been hijacked by this cheap stinker using IP:http://81.211.105.9. everytime i start explorer & i'm a heavy internet user, this site comes up first with the extension: index.php?v=3, with the result that i ma directed to these search engines: allsearch.ws and wetsearch.ws.
this is very annoying. i have tried all i could to remove the crap but i can't find where its hiding, and its the second time. first time i had to re-inst wins so as to get rid of it & now like crap its back. ofcourse, apart from sharing with me your experiences, i would like to know if the're laws against this, and how can i make the a****** responsible pay for this bull***t, anyway would suit me fine.
please assist.

17 replies

by maxwell edison

A risk of using the Internet is that you allow your computer to be connect to another's computer. What that other computer does, or the people controlling it, is a risk you assume by connecting in the first place. Porn sites are notorious for such practices.

The best thing you can do is to protect yourself. Im most cases, a simple firewall will prevent such activity.

Put a hardware firewall, in the form of an inexpensive router, between your computer and the Internet. In addition, use a firewall software, such as ZoneAlarm. You could get such a router for $50 - $100, and ZoneAlarm costs only around $40. It's an investment well worth making.

by maxwell edison

When it comes to routers, not all routers have built-in firewall capabilities. So make sure you get one that does.

by tiza

thanks max,hope u don't mind. i am as of now connected to the Int, through a LAN, and the gateway server has all the neccessary security the guys can afford. i don't want to put a firewall on mine as this might reduce speed, thats according to me. so no chance to kick these guys' ***. anyway, how do i get rid of the nuisance then

by joseph moore

A new tool (well, new for me!) that I found is called HijackThis, and it is GREAT for diagnosing this. This tool is the best thing I have seen for analyzing IE and Netscape, listing all of the plugins and browser modifications that spyware and trojans do.
Get HijackThis here:
http://mjc1.com/mirror/hjt/

It is really detailed, and easy to use. Just download it, run it, and click the Scan button.
It will lists all of the components that could be taken over by spyware. To remove something, just click the checkbox associated with it, and click the Fix button.
That is it! Easy! I've used this at work on a couple machines that had problems, and it works like a champ!

Another useful link is to a tutorial on HijackThis:
http://tinyurl.com/ufi8

That page will help you with identifying what HijackThis is reporting.

And don't forget spyware scan and remove tools like Ad-aware.

by joseph moore

Ah, something else interesting on the IP you posted. Now, I agree with Maxwell that helping you attack this site is WRONG and not something to do. But, I also agree with Oldefar that a little knowledge about the site is in order. Now, the web server HTTP headers you get from the web site (things your browser does not show you, but it received first before the HTML comes across) appear as follows:

HTTP/1.1 302 Found
Date: Sat, 10 Jan 2004 22:11:22 GMT
Server: Apache/1.3.28 (Unix) PHP/4.3.3
X-Powered-By: PHP/4.3.3
Location: http://cool-search.ws/
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html

What is important here is the Location tag, pointing to CoolSearch. They are evil, from what I have read on the spyware boards! With the CoolSearch spyware on your machine, you need to do something special to remove it, above and beyone Ad-aware and HijackThis. Those tools alone cannot remove the CoolSearch spyware; apparently, it is the worst one out there, writing itself all over the REgistry.
But luckily, the guy who wrote HijackThis ALSO has an anti CoolSearch tool called CWShredder.
So, go to his home page:
http://www.spywareinfo.com/~merijn/
and click the Download link.
Then scroll down to the CWShredder section, and click the documentation link. That will tell you about just what is going on with CoolSearch, along with a link to get his removal tool.

Good luck!

by oldefar

The address belongs within the range of -

person: Prasolov S A
address: ICS TM
address: 70 Bolshoy pr. V.O.
address: 199002 St.-Petersburg
address: Russia
phone: +7 812 3291492
fax-no: +7 812 3222242
e-mail: dnsmaster@ilca.ru
nic-hdl: PSA13-RIPE
notify: dnsmaster@ilca.ru
mnt-by: SOVINTEL-MNT
changed: marty@sovintel.ru 20031203
source: RIPE

You could try complaining to them.

You can find this info beginning at http://www.whois.net

by maxwell edison

A firewall, such as Zonealarm, on your computer wouldn't affect the speed of anything.

Try a free demo (expires in 30 days)

http://www.tucows.com/preview/195418.html

Read all about it:

http://www.zonelabs.com/store/content/home.jsp

REMOVE SPACES from the pasted URLs.

By the way, Norton has one as well for about the same price.

No, there's nothing you can do to them to "get even". Besides, when a person wastes his time on "get-even-with-him-ism", he wastes the time that could otherwise be productive. There's nothing positive about revenge.

by joseph moore

Maxwell:
Just looking at the HTML source, I see what is going on.
On your "firewall and speed" post, after you have the link to HOME.JSP for ZA, the < BR > (extra spaces included so it shows up when I post this just in case!!!) tag is used to start the next line. Apparently, the carriage returns we use in these TR text boxes are translated into the Break HTML command; the < P > paragraph tags are not used.
So, when your post was converted into HTML, what it did was it added an extra space in the Break tag, so instead of being < BR > (again, with no spaces), it was converted into < B R > !!!
And, the < B > tag is Bold.
So, what is happening is that extra space Break tag is being interpreted by our browsers as a Bold tag. That is why the text is bold.
I've had this happen to some of my post also. Exactly why the Break tags are occasionally getting a Space between the B and R is something I can't even guess at.
But, at least know I know Why the bold, just not the Why of the Why!

by oz_media

At one point, I thought the new board was HMTL based, COOL, colors and italis for emphasis instead of SCREAMING all the time.(I think this adds to discussion problems as people don't know if you are yelling or simply stressing an word)

I buggered with some code on a test thread and no go. :-(

(Let me stop and say that I am not considering myself an html 'expert' but I do understand HTML and all the other various web scripts as I do build, maintain and position quite a few sites.)

I think it is in thier server side scripting where it BOLDS certain type. It is probably just not parsing forms properly sometimes.

Did you add the
your self or was that added by TR?

OM

by maxwell edison

I know some HTML as well, but I'm no expert either. I did not add the
. That was somehow added in the cut/paste process.

I'll usually, as I did in this case, write my message in the reply window provided, cut the text out of it, paste it into another program to run a spell-check, cut from there, and paste back into the reply window. (I use either Word or Outlook Express for the spell check. In this case, Outlook Express)

So the
was magically added, with or without the space, by the TR process.

(P.S. No cut and paste spell check was done with this message.)

by oz_media

This is a very common hijack, it is installed due to you level of security in your IE securilty settings. Raising them will only disable your ability to view many sites, unfortunately the hijack isn't breaking laws if it in in compliance with your security settings. If it CHANGED you settings in order to install itself, that would be unlawful aand you'd have grounds for complaint to authorities.

There are many ways to block this stuff, registry entries and startup files will simply reinstall and acticate the 'jack as soo as you reboot.

There is some software, 'ie-spyad' that adjusts your security certificates to block these known hijack websites and AdAware will probably help remove all thejunk and malware and ad cookies that get installed as you surf.

LINKS:

IE-SPY AD http://tinyurl.com/zoh7

AdAware http://www.lavasoft.nu

This protection and then regular cleaning with AdAware (I run it several time a day), will help prevent further hijacking and advertisements.

by oz_media

It's not your mistake Max,it is obviously the way the server side scripts are parsing or compliling the reply.

The only scripted format I see that could cause such an error, obviously without viewing scipts, is that it is Title text formatting. Thus the page break after the carriage retun. They are using CSS scripting so it is hard to determine the fault, but knowing your attention to detail quite well, I can with out any doubt whatsoever, this is NOT your error. You probably knew that but figured you point out the flaw anyway, so I'm not helping at all, bye Max.

OM

by oz_media

I've used CW Shredder before (it works well) but also have a friend who has written a very similar script and it is just part of the IE-Spy Ad process. From what I understand, and this could be wrong, CW Shredder is just part of the IE-Spy Ad script.

How does CW Shredder perform a deifferent task ?

I am not trying to start a rant here, I am honestly asking out of interest in your opinion.

OM

by fluxit

Have checked to see if some program is running on start? There could numerous places that this is located depending on your version of windows.

You may be faced with an IRC channel being opened and someone accessing your machine if such a program is installed on start. There are a variety of ways to deliver them to your machine from the internet.

The whois on the ip pulled up a melbourneit.com and a check on this found. However, they may only be brokering domain names. Email them with your complaint.

Domain Name.......... melbourneit.com
Creation Date........ 1999-04-05
Registration Date.... 2000-05-23
Expiry Date.......... 2013-04-05
Organisation Name.... Melbourne IT Ltd
Organisation Address. Level 2, 120 King Street
Organisation Address.
Organisation Address. Melbourne
Organisation Address. 3000
Organisation Address. Vic
Organisation Address. AUSTRALIA

Admin Name........... Account Manager
Admin Address........ Level 2, 120 King Street
Admin Address........
Admin Address........ Melbourne
Admin Address........ 3000
Admin Address........ Vic
Admin Address........ AUSTRALIA
Admin Email.......... cdm@melbourneit.com
Admin Phone.......... +61.386242465
Admin Fax............

Tech Name............ Account Manager
Tech Address......... Level 2, 120 King Street
Tech Address.........
Tech Address......... Melbourne
Tech Address......... 3000
Tech Address......... Vic
Tech Address......... AUSTRALIA
Tech Email........... cdm@melbourneit.com
Tech Phone........... +61.386242465
Tech Fax.............
Name Server.......... ns1.MelbourneIT.com.au
Name Server.......... ns2.MelbourneIT.com.au
Name Server.......... ns4.MelbourneIT.com.au

by mrafrohead

http://www.merijn.org/downloads.html

There's a program called CWShredder. Run that, then when you're finished download Spybot and run that on your computer.

The reason that this is happening, is becauase this is software that someone at your site installed on your computer to make it do this. If you are at a business, I'd tell them to stop or they're fired. If they're putting this on their machine, imagine what else is there, and I'm sure you don't want your data going to other peoples servers legally do you?

As to are there laws regarding this. Depending on your state their may be. But the problem is that almost all of this software is installed on your computer because you allowed it to install. Make sure the EULA's to anything you run is read thoroughly. That is where you will see that extra "stuff" is being installed on your box.

Good luck.

mrafrohead

by tiza

Thanks all for the help. CW Shredder seems like worked for now. i tried hijack this but only helped in telling me where the culprits were hiding but could not get rid of them. CW Shredder on the other hand removed these links from their hidings completely. i am monitoring my system to see for how long its gonna work and if CW itself is not a carrier of anything. in the meantime i will follow the worthy advise and install a firewall.
thanks all and may 2004 and beyond be your best years.

This discussion is closed to new replies.