Re-appearing links

Discussion in 'Computer Security' started by Soet, Nov 23, 2003.

  1. Soet

    Soet Guest

    Hi all,

    I've got a heavy (security) problem on my WinXP machine and hope
    to get information here about where to start looking for solutions.

    I found several links/shortcuts to a specific porn site in my start menu,
    my favorites list, and also on my desktop although I neither placed them
    there nor did I ever visit this site. I keep on deleting all of the links
    but
    after a random time span they keep appearing again. Needless to say
    that this is absolutely annoying and more importantly very frightening.

    I scanned my whole computer with the norton anti-virus scanner and
    up-to-date virus definition files but couldn't find anything. I also checked
    all processes in the task manager and all automatically started tasks and
    services with msconfig but couldn't find anything suspicious.

    Does anybody have an idea if this is some hidden process messing with
    my system or possibly an attack from the internet (have DSL).

    Any advice is appreciated
    Suat
    Soet, Nov 23, 2003
    #1
    1. Advertising

  2. Soet

    dkg_ctc Guest

    "Soet" <> wrote in news:bpp91p$rcg$:

    > Hi all,
    >
    > I've got a heavy (security) problem on my WinXP machine and hope
    > to get information here about where to start looking for
    > solutions.
    >
    > I found several links/shortcuts to a specific porn site in my
    > start menu, my favorites list, and also on my desktop although I
    > neither placed them there nor did I ever visit this site. I keep
    > on deleting all of the links but
    > after a random time span they keep appearing again. Needless to
    > say that this is absolutely annoying and more importantly very
    > frightening.
    >
    > I scanned my whole computer with the norton anti-virus scanner and
    > up-to-date virus definition files but couldn't find anything. I
    > also checked all processes in the task manager and all
    > automatically started tasks and services with msconfig but
    > couldn't find anything suspicious.
    >
    > Does anybody have an idea if this is some hidden process messing
    > with my system


    Most likely.

    > or possibly an attack from the internet (have DSL).


    Probably not.

    Download something like Spybot Search & Destroy or AdAware, update the
    definitions for both, and scan for spyware. From there, you can avoid
    re-infection by using a browser other than Internet Explorer, or if
    you insist on using IE, then staying up-to-date on patches and
    browsing with ActiveX off are highly recommended. Then, if you run
    into a site which you consider trustworthy and which requires ActiveX,
    you can add it to IE's trusted zone.
    dkg_ctc, Nov 23, 2003
    #2
    1. Advertising

  3. Soet Spilled my beer when they jumped on the table and proclaimed in
    <bpp91p$rcg$>:

    > Hi all,
    >
    > I've got a heavy (security) problem on my WinXP machine and hope
    > to get information here about where to start looking for solutions.
    >
    > I found several links/shortcuts to a specific porn site in my start
    > menu, my favorites list, and also on my desktop although I neither
    > placed them there nor did I ever visit this site. I keep on deleting
    > all of the links but
    > after a random time span they keep appearing again. Needless to say
    > that this is absolutely annoying and more importantly very
    > frightening.
    >
    > I scanned my whole computer with the norton anti-virus scanner and
    > up-to-date virus definition files but couldn't find anything. I also
    > checked all processes in the task manager and all automatically
    > started tasks and services with msconfig but couldn't find anything
    > suspicious.
    >
    > Does anybody have an idea if this is some hidden process messing
    > with my system or possibly an attack from the internet (have DSL).


    In addition to DKG's advice, I would also scan the computer from an
    online site such as trend micro's site/etc... (www.antivirus.com for
    instance). One of last summer's viruses works similarly to this.

    NOI
    Thund3rstruck, Nov 23, 2003
    #3
  4. Soet

    Fowl Guest

    On Sun, 23 Nov 2003 04:24:42 +0100, "Soet" <> wrote:

    >Hi all,
    >
    >I've got a heavy (security) problem on my WinXP machine and hope
    >to get information here about where to start looking for solutions.
    >
    >I found several links/shortcuts to a specific porn site in my start menu,
    >my favorites list, and also on my desktop although I neither placed them
    >there nor did I ever visit this site. I keep on deleting all of the links
    >but
    >after a random time span they keep appearing again. Needless to say
    >that this is absolutely annoying and more importantly very frightening.
    >
    >I scanned my whole computer with the norton anti-virus scanner and
    >up-to-date virus definition files but couldn't find anything. I also checked
    >all processes in the task manager and all automatically started tasks and
    >services with msconfig but couldn't find anything suspicious.
    >
    >Does anybody have an idea if this is some hidden process messing with
    >my system or possibly an attack from the internet (have DSL).
    >
    >Any advice is appreciated
    >Suat
    >


    Use www.pestscan.com

    Online pestscanner. from pestpatrol

    To Reply: madballs64 (at) gmx (dot) net
    Fowl, Nov 23, 2003
    #4
  5. Soet

    Mimic Guest

    "Soet" <> wrote in message news:bpp91p$rcg$...
    > Hi all,
    >
    > I've got a heavy (security) problem on my WinXP machine and hope
    > to get information here about where to start looking for solutions.
    >
    > I found several links/shortcuts to a specific porn site in my start menu,
    > my favorites list, and also on my desktop although I neither placed them
    > there nor did I ever visit this site. I keep on deleting all of the links
    > but
    > after a random time span they keep appearing again. Needless to say
    > that this is absolutely annoying and more importantly very frightening.
    >
    > I scanned my whole computer with the norton anti-virus scanner and
    > up-to-date virus definition files but couldn't find anything. I also

    checked
    > all processes in the task manager and all automatically started tasks and
    > services with msconfig but couldn't find anything suspicious.
    >
    > Does anybody have an idea if this is some hidden process messing with
    > my system or possibly an attack from the internet (have DSL).
    >
    > Any advice is appreciated
    > Suat
    >
    >


    Sounds like youve been going to gn0rty sites and got fooled by the "you have
    to click yes to proceed" button.
    Dont be ashamed, most people look at porn

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 23, 2003
    #5
  6. Soet

    Mimic Guest

    "Fowl" <> wrote in message
    news:...
    > On Sun, 23 Nov 2003 04:24:42 +0100, "Soet" <> wrote:
    >
    > >Hi all,
    > >
    > >I've got a heavy (security) problem on my WinXP machine and hope
    > >to get information here about where to start looking for solutions.
    > >
    > >I found several links/shortcuts to a specific porn site in my start

    menu,
    > >my favorites list, and also on my desktop although I neither placed them
    > >there nor did I ever visit this site. I keep on deleting all of the links
    > >but
    > >after a random time span they keep appearing again. Needless to say
    > >that this is absolutely annoying and more importantly very frightening.
    > >
    > >I scanned my whole computer with the norton anti-virus scanner and
    > >up-to-date virus definition files but couldn't find anything. I also

    checked
    > >all processes in the task manager and all automatically started tasks and
    > >services with msconfig but couldn't find anything suspicious.
    > >
    > >Does anybody have an idea if this is some hidden process messing with
    > >my system or possibly an attack from the internet (have DSL).
    > >
    > >Any advice is appreciated
    > >Suat
    > >

    >
    > Use www.pestscan.com
    >
    > Online pestscanner. from pestpatrol
    >
    > To Reply: madballs64 (at) gmx (dot) net


    pestpatrol, its a joke, they list underground txt (and GUI) magazines as
    "pests" and have removal sequences for them.

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 23, 2003
    #6
  7. Soet

    Soet Guest

    Hi Mimic,

    I am not ashamed of admitting that I visit sites with adult content.
    I live in Germany and we are pretty open to such things.

    However, I can assure you that I never visited that particular site
    and I never admitted anything to be executed on my PC that came
    from a webpage, since I am aware of the risks.

    Yet, the advices of the other guys didn't help. This stupid links
    keep re-appearing. Neither NAV, nor AdAware or Spybot
    cleaned the problem. Maybe they are not aware of this particular
    bug.

    I have no chance to track down the root of this annoying problem.
    I will most likely end up re-installing the system to get rid of it.

    Regards

    "Mimic" <> schrieb im Newsbeitrag
    news:...
    > "Soet" <> wrote in message

    news:bpp91p$rcg$...
    > > Hi all,
    > >
    > > I've got a heavy (security) problem on my WinXP machine and hope
    > > to get information here about where to start looking for solutions.
    > >
    > > I found several links/shortcuts to a specific porn site in my start

    menu,
    > > my favorites list, and also on my desktop although I neither placed them
    > > there nor did I ever visit this site. I keep on deleting all of the

    links
    > > but
    > > after a random time span they keep appearing again. Needless to say
    > > that this is absolutely annoying and more importantly very frightening.
    > >
    > > I scanned my whole computer with the norton anti-virus scanner and
    > > up-to-date virus definition files but couldn't find anything. I also

    > checked
    > > all processes in the task manager and all automatically started tasks

    and
    > > services with msconfig but couldn't find anything suspicious.
    > >
    > > Does anybody have an idea if this is some hidden process messing with
    > > my system or possibly an attack from the internet (have DSL).
    > >
    > > Any advice is appreciated
    > > Suat
    > >
    > >

    >
    > Sounds like youve been going to gn0rty sites and got fooled by the "you

    have
    > to click yes to proceed" button.
    > Dont be ashamed, most people look at porn
    >
    > --
    > Mimic
    >
    > "Without Knowledge you have fear, With fear you create your own

    nightmares."
    > "There are 10 types of people in this world. Those that understand Binary,
    > and those that dont."
    > "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    > when you do, it blows away your whole leg"
    >
    >
    >
    Soet, Nov 24, 2003
    #7
  8. Soet

    Soet Guest

    The problem still remains. Links appear in my favorites folder, on my
    desktop, and in my start menu and files are placed on my main drive,
    even if I am not online.

    I already had AdAware and Norton Anti-Virus installed with the
    latest definition-files before I wrote my first posting. Now I have
    also installed Spybot S&D. Here is what I already did.

    - Checked system with NAV, AdAware and Spybot
    - Installed latest IE patch and set security to "high"
    - Activated WinXP firewall
    - Checked for suspicious processes and services with taskmgr and msconfig

    Maybe neither AdAware nor Spybot know this particular spyprg.
    I fear that I will have to re-install the whole system or to burn down
    the PC :).

    "dkg_ctc" <> schrieb im Newsbeitrag
    news:Xns943BE10F6B501dkgctc@130.133.1.4...
    > "Soet" <> wrote in news:bpp91p$rcg$:
    >
    > > Hi all,
    > >
    > > I've got a heavy (security) problem on my WinXP machine and hope
    > > to get information here about where to start looking for
    > > solutions.
    > >
    > > I found several links/shortcuts to a specific porn site in my
    > > start menu, my favorites list, and also on my desktop although I
    > > neither placed them there nor did I ever visit this site. I keep
    > > on deleting all of the links but
    > > after a random time span they keep appearing again. Needless to
    > > say that this is absolutely annoying and more importantly very
    > > frightening.
    > >
    > > I scanned my whole computer with the norton anti-virus scanner and
    > > up-to-date virus definition files but couldn't find anything. I
    > > also checked all processes in the task manager and all
    > > automatically started tasks and services with msconfig but
    > > couldn't find anything suspicious.
    > >
    > > Does anybody have an idea if this is some hidden process messing
    > > with my system

    >
    > Most likely.
    >
    > > or possibly an attack from the internet (have DSL).

    >
    > Probably not.
    >
    > Download something like Spybot Search & Destroy or AdAware, update the
    > definitions for both, and scan for spyware. From there, you can avoid
    > re-infection by using a browser other than Internet Explorer, or if
    > you insist on using IE, then staying up-to-date on patches and
    > browsing with ActiveX off are highly recommended. Then, if you run
    > into a site which you consider trustworthy and which requires ActiveX,
    > you can add it to IE's trusted zone.
    Soet, Nov 24, 2003
    #8
  9. Soet Spilled my beer when they jumped on the table and proclaimed in
    <bprkiv$muu$>:

    > Hi Mimic,
    >
    > I am not ashamed of admitting that I visit sites with adult content.
    > I live in Germany and we are pretty open to such things.
    >
    > However, I can assure you that I never visited that particular site
    > and I never admitted anything to be executed on my PC that came
    > from a webpage, since I am aware of the risks.
    >
    > Yet, the advices of the other guys didn't help. This stupid links
    > keep re-appearing. Neither NAV, nor AdAware or Spybot
    > cleaned the problem. Maybe they are not aware of this particular
    > bug.
    >
    > I have no chance to track down the root of this annoying problem.
    > I will most likely end up re-installing the system to get rid of it.


    If it's the virus I am thinking of, (Lovesan?) it would have
    disabled NAV, Macafee, etc. Try an online scanner, such as Trend
    Micro,(www.antivirus.com) Symantec's site, (www.symantec.com) etc,
    just to make 100% sure.

    NOI
    Thund3rstruck, Nov 24, 2003
    #9
  10. Soet

    Mimic Guest

    "Thund3rstruck" <> wrote in message
    news:3fc18542$0$22738$...
    > Soet Spilled my beer when they jumped on the table and proclaimed in
    > <bprkiv$muu$>:
    >
    > > Hi Mimic,
    > >
    > > I am not ashamed of admitting that I visit sites with adult content.
    > > I live in Germany and we are pretty open to such things.
    > >
    > > However, I can assure you that I never visited that particular site
    > > and I never admitted anything to be executed on my PC that came
    > > from a webpage, since I am aware of the risks.
    > >
    > > Yet, the advices of the other guys didn't help. This stupid links
    > > keep re-appearing. Neither NAV, nor AdAware or Spybot
    > > cleaned the problem. Maybe they are not aware of this particular
    > > bug.
    > >
    > > I have no chance to track down the root of this annoying problem.
    > > I will most likely end up re-installing the system to get rid of it.

    >
    > If it's the virus I am thinking of, (Lovesan?) it would have
    > disabled NAV, Macafee, etc. Try an online scanner, such as Trend
    > Micro,(www.antivirus.com) Symantec's site, (www.symantec.com) etc,
    > just to make 100% sure.
    >
    > NOI


    It wont be lovesan (aka the Blaster worm)

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 25, 2003
    #10
  11. Soet

    Mimic Guest

    "Soet" <> wrote in message news:bprkiv$muu$...
    > Hi Mimic,
    >
    > I am not ashamed of admitting that I visit sites with adult content.
    > I live in Germany and we are pretty open to such things.
    >
    > However, I can assure you that I never visited that particular site
    > and I never admitted anything to be executed on my PC that came
    > from a webpage, since I am aware of the risks.
    >
    > Yet, the advices of the other guys didn't help. This stupid links
    > keep re-appearing. Neither NAV, nor AdAware or Spybot
    > cleaned the problem. Maybe they are not aware of this particular
    > bug.
    >
    > I have no chance to track down the root of this annoying problem.
    > I will most likely end up re-installing the system to get rid of it.
    >
    > Regards
    >
    > "Mimic" <> schrieb im Newsbeitrag
    > news:...
    > > "Soet" <> wrote in message

    > news:bpp91p$rcg$...
    > > > Hi all,
    > > >
    > > > I've got a heavy (security) problem on my WinXP machine and hope
    > > > to get information here about where to start looking for solutions.
    > > >
    > > > I found several links/shortcuts to a specific porn site in my start

    > menu,
    > > > my favorites list, and also on my desktop although I neither placed

    them
    > > > there nor did I ever visit this site. I keep on deleting all of the

    > links
    > > > but
    > > > after a random time span they keep appearing again. Needless to say
    > > > that this is absolutely annoying and more importantly very

    frightening.
    > > >
    > > > I scanned my whole computer with the norton anti-virus scanner and
    > > > up-to-date virus definition files but couldn't find anything. I also

    > > checked
    > > > all processes in the task manager and all automatically started tasks

    > and
    > > > services with msconfig but couldn't find anything suspicious.
    > > >
    > > > Does anybody have an idea if this is some hidden process messing with
    > > > my system or possibly an attack from the internet (have DSL).
    > > >
    > > > Any advice is appreciated
    > > > Suat
    > > >
    > > >

    > >
    > > Sounds like youve been going to gn0rty sites and got fooled by the "you

    > have
    > > to click yes to proceed" button.
    > > Dont be ashamed, most people look at porn
    > >
    > > --
    > > Mimic
    > >
    > > "Without Knowledge you have fear, With fear you create your own

    > nightmares."
    > > "There are 10 types of people in this world. Those that understand

    Binary,
    > > and those that dont."
    > > "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    > > when you do, it blows away your whole leg"
    > >
    > >
    > >

    >
    >


    Glad to hear it.
    It doesnt matter if you havent visited that particular site, when you get
    into http porn its just an industry of popups and leads, someone could have
    just had a popup that linked the OK or No button to accept the download.
    If i were you, id prolly go into the registry and have a root around :D

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 25, 2003
    #11
  12. Mimic Spilled my beer when they jumped on the table and proclaimed in
    <>:
    > It wont be lovesan (aka the Blaster worm)


    Thinking about it, you are correct. However, being the
    obsessive-compulsive type I am, I just had to find out what it was.
    <G>

    After obsessing for over an hour, I found the record in an obscure
    location on the server at work...

    js.fortnite

    How the hell, I got Love-anything out of that, I will never know...

    Here's a link to the description if anyone is interested...

    http://www3.ca.com/virusinfo/virus.aspx?ID=11890

    NOI
    Thund3rstruck, Nov 25, 2003
    #12
  13. Soet

    Mimic Guest

    "Thund3rstruck" <> wrote in message
    news:3fc2c087$0$30684$...
    > Mimic Spilled my beer when they jumped on the table and proclaimed in
    > <>:
    > > It wont be lovesan (aka the Blaster worm)

    >
    > Thinking about it, you are correct. However, being the
    > obsessive-compulsive type I am, I just had to find out what it was.
    > <G>
    >
    > After obsessing for over an hour, I found the record in an obscure
    > location on the server at work...
    >
    > js.fortnite
    >
    > How the hell, I got Love-anything out of that, I will never know...
    >
    > Here's a link to the description if anyone is interested...
    >
    > http://www3.ca.com/virusinfo/virus.aspx?ID=11890
    >
    > NOI


    Yeah i know what you mean, sex pron and love really dont go together ;D

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 25, 2003
    #13
  14. Soet

    Soet Guest

    Well, after searching some more in the internet I finally found some
    information
    on the Symantec (Norton Anti-Virus) webpages that exactly described my
    problem.
    According to that it was a virus called "dialer.heysan", that doesn't create
    registry
    entries but rather places some malicious files on you harddrive.
    http://securityresponse.symantec.com/avcenter/venc/data/dialer.heysan.html

    The weird thing is that despite of having that virus also in the virus
    definition list
    my Norton Anti-Virus scanner didn't find it even by performing a deep scan
    on
    all files on my harddrive.

    However, by manually searching for the files that are described in the given
    webpage
    I was successful. The problem source was a file called "mile.scr". This
    created the
    links, shortcuts, and files and placed these in different locations. Since
    the extension
    ".scr" stands for "Windows Screensaver" I assume that this file was
    activated by
    the screensaver mechanism of Windows. But I am not sure about that.

    Anyway, deleting this one particular file solved all my problems.

    Thanks to all for the valuable information that finally helped me to narrow
    down my
    search for a solution.

    Cheers


    "Mimic" <> schrieb im Newsbeitrag
    news:...
    > "Thund3rstruck" <> wrote in message
    > news:3fc2c087$0$30684$...
    > > Mimic Spilled my beer when they jumped on the table and proclaimed in
    > > <>:
    > > > It wont be lovesan (aka the Blaster worm)

    > >
    > > Thinking about it, you are correct. However, being the
    > > obsessive-compulsive type I am, I just had to find out what it was.
    > > <G>
    > >
    > > After obsessing for over an hour, I found the record in an obscure
    > > location on the server at work...
    > >
    > > js.fortnite
    > >
    > > How the hell, I got Love-anything out of that, I will never know...
    > >
    > > Here's a link to the description if anyone is interested...
    > >
    > > http://www3.ca.com/virusinfo/virus.aspx?ID=11890
    > >
    > > NOI

    >
    > Yeah i know what you mean, sex pron and love really dont go together ;D
    >
    > --
    > Mimic
    >
    > "Without Knowledge you have fear, With fear you create your own

    nightmares."
    > "There are 10 types of people in this world. Those that understand Binary,
    > and those that dont."
    > "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    > when you do, it blows away your whole leg"
    >
    >
    >
    Soet, Nov 26, 2003
    #14
  15. Soet Spilled my beer when they jumped on the table and proclaimed in
    <bq0sju$8c8$>:

    > Well, after searching some more in the internet I finally found some
    > information
    > on the Symantec (Norton Anti-Virus) webpages that exactly described
    > my problem.
    > According to that it was a virus called "dialer.heysan", that
    > doesn't create registry
    > entries but rather places some malicious files on you harddrive.
    >

    http://securityresponse.symantec.com/avcenter/venc/data/dialer.heysan.html
    >
    > The weird thing is that despite of having that virus also in the
    > virus definition list
    > my Norton Anti-Virus scanner didn't find it even by performing a
    > deep scan on
    > all files on my harddrive.
    >
    > However, by manually searching for the files that are described in
    > the given webpage
    > I was successful. The problem source was a file called "mile.scr".
    > This created the
    > links, shortcuts, and files and placed these in different locations.
    > Since the extension
    > ".scr" stands for "Windows Screensaver" I assume that this file was
    > activated by
    > the screensaver mechanism of Windows. But I am not sure about that.
    >
    > Anyway, deleting this one particular file solved all my problems.
    >
    > Thanks to all for the valuable information that finally helped me to
    > narrow down my
    > search for a solution.


    I'm glad you got it solved. Yes, the .scr files are activated
    (basically) by the screensaver section of windows... <G>

    NOI
    Thund3rstruck, Nov 26, 2003
    #15
  16. Soet

    Mimic Guest

    "Soet" <> wrote in message news:bq0sju$8c8$...
    > Well, after searching some more in the internet I finally found some
    > information
    > on the Symantec (Norton Anti-Virus) webpages that exactly described my
    > problem.
    > According to that it was a virus called "dialer.heysan", that doesn't

    create
    > registry
    > entries but rather places some malicious files on you harddrive.
    > http://securityresponse.symantec.com/avcenter/venc/data/dialer.heysan.html
    >
    > The weird thing is that despite of having that virus also in the virus
    > definition list
    > my Norton Anti-Virus scanner didn't find it even by performing a deep scan
    > on
    > all files on my harddrive.
    >
    > However, by manually searching for the files that are described in the

    given
    > webpage
    > I was successful. The problem source was a file called "mile.scr". This
    > created the
    > links, shortcuts, and files and placed these in different locations. Since
    > the extension
    > ".scr" stands for "Windows Screensaver" I assume that this file was
    > activated by
    > the screensaver mechanism of Windows. But I am not sure about that.
    >
    > Anyway, deleting this one particular file solved all my problems.
    >
    > Thanks to all for the valuable information that finally helped me to

    narrow
    > down my
    > search for a solution.
    >
    > Cheers
    >


    >


    Isnt .scr for script ?

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 26, 2003
    #16
  17. Soet

    Per Pedersen Guest

    "Mimic" <> skrev i en meddelelse news:48OdnRTMwqifl1iiRVn-
    > >

    >
    > Isnt .scr for script ?
    >
    > --
    > Mimic
    >
    > "Without Knowledge you have fear, With fear you create your own

    nightmares."
    > "There are 10 types of people in this world. Those that understand Binary,
    > and those that dont."
    > "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    > when you do, it blows away your whole leg"


    Hi Mimic

    The ".SCR" extension is for Screensaver executeable files, scripts is
    usually ".CMD", in Windows NT/2000/XP, but can also be ".BAT", ".VBS",
    ".VBE", ".JS", ".VSH", and ".WSF".

    Just try to execute any ".SCR" file in thhe C:\Windows\System32\ directory,
    they are actually executeable files, just ligew ".EXE", you can even copy
    and rename them to ".EXE" and run them as a proggy if you like.

    Regards

    Per Pedersen
    Per Pedersen, Nov 26, 2003
    #17
  18. Soet

    infosafety Guest

    This could be a firewall or spyware problem. If you don't have a firewall
    installed, you can get a free version of ZoneAlarm for noncommercial use.
    You also need anti-spyware software. Spybot Search & Destroy is good free
    software. Pestpatrol has a decent
    free online scanner at http://pestscan.com/Scan.asp

    I hope this helps.

    Regards,
    Craig
    http://info-safety.com


    "Soet" <> wrote in message news:bpp91p$rcg$...
    > Hi all,
    >
    > I've got a heavy (security) problem on my WinXP machine and hope
    > to get information here about where to start looking for solutions.
    >
    > I found several links/shortcuts to a specific porn site in my start menu,
    > my favorites list, and also on my desktop although I neither placed them
    > there nor did I ever visit this site. I keep on deleting all of the links
    > but
    > after a random time span they keep appearing again. Needless to say
    > that this is absolutely annoying and more importantly very frightening.
    >
    > I scanned my whole computer with the norton anti-virus scanner and
    > up-to-date virus definition files but couldn't find anything. I also

    checked
    > all processes in the task manager and all automatically started tasks and
    > services with msconfig but couldn't find anything suspicious.
    >
    > Does anybody have an idea if this is some hidden process messing with
    > my system or possibly an attack from the internet (have DSL).
    >
    > Any advice is appreciated
    > Suat
    >
    >
    infosafety, Nov 27, 2003
    #18
  19. Soet

    Dave Korn Guest

    "Per Pedersen" <> wrote in message
    news:3fc513cb$0$25816$...
    >
    > "Mimic" <> skrev i en meddelelse news:48OdnRTMwqifl1iiRVn-
    > > >

    > >
    > > Isnt .scr for script ?
    > >
    > > --
    > > Mimic
    > >
    > > "Without Knowledge you have fear, With fear you create your own

    > nightmares."
    > > "There are 10 types of people in this world. Those that understand

    Binary,
    > > and those that dont."
    > > "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    > > when you do, it blows away your whole leg"

    >
    > Hi Mimic
    >
    > The ".SCR" extension is for Screensaver executeable files, scripts is
    > usually ".CMD", in Windows NT/2000/XP, but can also be ".BAT", ".VBS",
    > ".VBE", ".JS", ".VSH", and ".WSF".
    >
    > Just try to execute any ".SCR" file in thhe C:\Windows\System32\

    directory,
    > they are actually executeable files, just ligew ".EXE", you can even copy
    > and rename them to ".EXE" and run them as a proggy if you like.
    >
    > Regards
    >
    > Per Pedersen
    >
    >


    And the great thing about them is that logon.scr often gets automatically
    executed by the system account...

    This led to much merriment under NT4; however the ACLs on it are properly
    configured these days.


    DaveK
    --
    moderator of
    alt.talk.rec.soc.biz.news.comp.humanities.meow.misc.moderated.meow
    Burn your ID card! http://www.optional-identity.org.uk/
    Help support the campaign, copy this into your .sig!
    Proud Member of the Exclusive "I have been plonked by Davee because he
    thinks I'm interesting" List Member #<insert number here>
    Master of Many Meowing Minions
    Holder of the exhalted PF Chang's Crab Wonton Award for kook spankage above
    and beyond the call of hilarity.
    PGP Key-ID: 0x0FB504D1 Fingerprint 04B7 2E8C 0245 680E 6484 C441 CEC7 D2BD
    Dave Korn, Nov 27, 2003
    #19
  20. Soet

    Mimic Guest

    "Per Pedersen" <> wrote in message
    news:3fc513cb$0$25816$...
    >
    > "Mimic" <> skrev i en meddelelse news:48OdnRTMwqifl1iiRVn-
    > > >

    > >
    > > Isnt .scr for script ?
    > >
    > > --
    > > Mimic
    > >
    > > "Without Knowledge you have fear, With fear you create your own

    > nightmares."
    > > "There are 10 types of people in this world. Those that understand

    Binary,
    > > and those that dont."
    > > "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    > > when you do, it blows away your whole leg"

    >
    > Hi Mimic
    >
    > The ".SCR" extension is for Screensaver executeable files, scripts is
    > usually ".CMD", in Windows NT/2000/XP, but can also be ".BAT", ".VBS",
    > ".VBE", ".JS", ".VSH", and ".WSF".
    >
    > Just try to execute any ".SCR" file in thhe C:\Windows\System32\

    directory,
    > they are actually executeable files, just ligew ".EXE", you can even copy
    > and rename them to ".EXE" and run them as a proggy if you like.
    >
    > Regards
    >
    > Per Pedersen
    >
    >


    fair enough.

    --
    Mimic

    "Without Knowledge you have fear, With fear you create your own nightmares."
    "There are 10 types of people in this world. Those that understand Binary,
    and those that dont."
    "C makes it easy to shoot yourself in the foot. C++ makes it harder, but
    when you do, it blows away your whole leg"
    Mimic, Nov 28, 2003
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?TGFuZU5lbQ==?=

    Wireless network not appearing in "My Network Places"

    =?Utf-8?B?TGFuZU5lbQ==?=, Dec 16, 2004, in forum: Wireless Networking
    Replies:
    4
    Views:
    7,429
  2. =?Utf-8?B?RW5mb1BhdWw=?=

    Site Links and Physical WAN Links

    =?Utf-8?B?RW5mb1BhdWw=?=, Mar 20, 2005, in forum: MCSE
    Replies:
    2
    Views:
    1,064
    =?Utf-8?B?RW5mb1BhdWw=?=
    Mar 22, 2005
  3. Thaqalain
    Replies:
    7
    Views:
    5,338
    Thaqalain
    Sep 30, 2005
  4. why?
    Replies:
    7
    Views:
    727
  5. Puma
    Replies:
    10
    Views:
    1,166
Loading...

Share This Page