Re: Off Topic: PC being attacked by various unknowns

[Dixiana <dixiana@xxxxxxxxxxxxxxxxxx>]

You have a Trojan in your system. Pop over to symantec.com and run their free security scan. It's very good at telling you what you have and how to get rid of it. Warning -- the scan is ActiveX-control based and can take some time.

Dave McCombs

Steven Fox wrote:

John,

I'm no expert, but someone else's idea of a worm/virus (maybe undetected by
current software) attacking your system could probably be the culprit.
Barring any other cure, I would indeed reformat and reinstall (while of
course backing up critical data before reformatting your hd).

Steve


----- Original Message ----- 
From: "John W Rosa" <JohnRosa@xxxxxxxxxxxxxx>
To: "AMC List" <mail@xxxxxxxxxxxx>
Sent: Wednesday, September 14, 2005 6:37 AM
Subject: Off Topic: PC being attacked by various unknowns


  

Sorry for the OT, but I know some of you folks are FAR
more in the know about computer threats/security and
adware/virus issues. PLEASE respond directly to my Email
address so everyone else doesn't have to read every
response.

I was out searching for some downloadable software to
'rip' audio from concert DVDs to MP3 files. I found only
one that seemed to be mentioned everywhere called DVD
Audio Ripper (as obvious a title if there ever was one),
and downloaded and installed it. It did all I wanted so
I revisited the site to 'buy' the unlock code. The site
wasn't responding and in my impatience, and at the urging
of my neighbor's kid, I went searching for the 'crack'...
and apparently fell into one.

I landed on a 'site' that instantly caused multiple browser
windows to open and I couldn't shut them off as fast as
they opened. I bailed off the site and killed everything,
logged off, rebooted and then tried to go online again.
That's when the first obvious sign that 'something malicious
this way came'. My network connection window opened (yes,
still on dial-up) and showed a gibberish phone number in
place of the usual one. I checked and found my user name
also altered. I presumed the password was also different.
Apparently, the attempt was made to have me dialup some
foreign number and login to their server so they could
access my system directly. I changed all the info back and
logged on just fine. I found out later when I logged off
again, the altered numbers automatically reinserted
themselves. Now I'm having to fix it every time I wish to
log on.

The second issue, probably related, is that once I log on and
open IE's browser, a second window opens automatically. I
Haven't let it fully load to display what it plans to, but
I suspect it's been linked to open with IE and is the 'program'
that is resetting my connection to the malicious phone number
and login info...but that's a guess.

Other issues that have also arisen include insanely slow CD
burning (Nero) and an occasional 5 to 10 minute startup time
for MS Outlook. Just walk away...it'll finish loading eventually.

Throughout all this, I have a very-current McAfee Firewall and
Virus package, plus I'm running AdAware Plus daily. AdAware
found A pile of critical items the first time it ran, but the cleanup
did not affect the issues I've detailed above. McAfee has found
nothing.

Soooo.....anybody got a good idea what went wrong (other than my
thought processes)? Solutions (other than format and reinstall...
grr!)? All ideas appreciated.

BTW- I did finally get back to the software site, paid and got my
code. Lesson learned (again).

John
johnrosa@xxxxxxxxxxxxxx