ZeusCali
2004-05-28, 10:53 AM
so ya my computer has been acting weird lately. Slows down alot, porn pops up even if i am not browsing a web page, my start page changes without me telling it too every time i start up.
So today i started up and got this as the home page:
htp://default-homepage-network.com/newspynotice.html (http://default-homepage-network.com/newspynotice.html)
do not click /\ but that is the link displayed
IMPORTANT SECURITY NOTICE!
Is your computer (http://go-advertising.com/?go=computer) suffering from any of the following symptoms:
1. Has your browser's START PAGE changed?
or 2. Are you seeing a recent increase in annoying POP UPS?
or 3. Have PORN ads appeared in your browser or email?
or 4. Has your computer (http://go-advertising.com/?go=computer) been acting wierd lately?
or 5. Is your Internet slower or even crashing?
or 6. Do you think your computer (http://0-2u.com/?go=computer) may have a virus?
or 7. Have new programs or toolbars been added without your permission?
If your computer (http://get-faster.com/?go=computer) is experiencing any of these symptoms...
It is almost certain that "spyware (http://go-all.com/?go=spyware)" has taken over your computer (http://get-certified.net/?go=computer),
and the problems will only get worse quickly. Plus your sensitive
information like credit cards (http://go-acct.com/?go=credit+cards) and all of your passwords can be
retrieved by criminals all around the world. This is a very scary
problem that needs immediate attention! You NEED to get this fixed now!
Click on THIS LINK TO DOWNLOAD THE #1 BEST SPYWARE ELIMINATION SOFTWARE (http://www.spydeleter.com/spydeleter.php?KBID=1004)
and your computer (http://get-certified.net/?go=computer) will be back to normal and secure again in just a
few minutes.
/\ that is what the homepage displayed it also downloads something faster then i can see
So looks like whoever made this virus is trying to make some money of it's hits. Any one have a free spy ware program ? because i do not want to supprot this asshat.
Sorry if this is 0fn or if you don't care about me at all anymore.
edit-
also files start up with my computer that seems to be part of the virus or in the least i didn't authorize to startup:
wyzh.exe,syswast.exe,unstall.exe(all 3 made on the same date and time wednesday 5/5/2004 10:39pm)
actulice.exe made wednesday 5/12/2004 11:45am
jushed32.exe made thursday 4/29/04 7:56pm(seems to be a clone of the normal thing but it just watches a port all the time)
Wast.exe made 5/26/04
and a annoying replaced exe of wmplayer(windows media player) it made the virus rename the original to wmplayer.exe1 and take over it's location. made
oh and along with the homepage it pops up
C:\Documents and Settings\zach\Local Settings\Temporary Internet Files\Content.IE5\IL27CD6J\htm[1].htm
and opens mshta.exe trying to acess the internet. my program to control the internet acess says it's destination is IP: 127.0.0.1:Port 1410 and Port 1415
and also says wmplayer.exe is trying to access the internet but has been changed since the last time it ran, it is trying to get to IP: 216.127.33.119:HTTP
then also FTP.EXE (ftp://ftp.exe/) is trying to get to IP 205.236.189.54:FTP
Sorry if this belongs in tech forum but i thought this had nothing to do with planetside and you guys would get a laugh out of the obviousness of the hacker making the virus hack the homepage with his own site for spyware removal
So today i started up and got this as the home page:
htp://default-homepage-network.com/newspynotice.html (http://default-homepage-network.com/newspynotice.html)
do not click /\ but that is the link displayed
IMPORTANT SECURITY NOTICE!
Is your computer (http://go-advertising.com/?go=computer) suffering from any of the following symptoms:
1. Has your browser's START PAGE changed?
or 2. Are you seeing a recent increase in annoying POP UPS?
or 3. Have PORN ads appeared in your browser or email?
or 4. Has your computer (http://go-advertising.com/?go=computer) been acting wierd lately?
or 5. Is your Internet slower or even crashing?
or 6. Do you think your computer (http://0-2u.com/?go=computer) may have a virus?
or 7. Have new programs or toolbars been added without your permission?
If your computer (http://get-faster.com/?go=computer) is experiencing any of these symptoms...
It is almost certain that "spyware (http://go-all.com/?go=spyware)" has taken over your computer (http://get-certified.net/?go=computer),
and the problems will only get worse quickly. Plus your sensitive
information like credit cards (http://go-acct.com/?go=credit+cards) and all of your passwords can be
retrieved by criminals all around the world. This is a very scary
problem that needs immediate attention! You NEED to get this fixed now!
Click on THIS LINK TO DOWNLOAD THE #1 BEST SPYWARE ELIMINATION SOFTWARE (http://www.spydeleter.com/spydeleter.php?KBID=1004)
and your computer (http://get-certified.net/?go=computer) will be back to normal and secure again in just a
few minutes.
/\ that is what the homepage displayed it also downloads something faster then i can see
So looks like whoever made this virus is trying to make some money of it's hits. Any one have a free spy ware program ? because i do not want to supprot this asshat.
Sorry if this is 0fn or if you don't care about me at all anymore.
edit-
also files start up with my computer that seems to be part of the virus or in the least i didn't authorize to startup:
wyzh.exe,syswast.exe,unstall.exe(all 3 made on the same date and time wednesday 5/5/2004 10:39pm)
actulice.exe made wednesday 5/12/2004 11:45am
jushed32.exe made thursday 4/29/04 7:56pm(seems to be a clone of the normal thing but it just watches a port all the time)
Wast.exe made 5/26/04
and a annoying replaced exe of wmplayer(windows media player) it made the virus rename the original to wmplayer.exe1 and take over it's location. made
oh and along with the homepage it pops up
C:\Documents and Settings\zach\Local Settings\Temporary Internet Files\Content.IE5\IL27CD6J\htm[1].htm
and opens mshta.exe trying to acess the internet. my program to control the internet acess says it's destination is IP: 127.0.0.1:Port 1410 and Port 1415
and also says wmplayer.exe is trying to access the internet but has been changed since the last time it ran, it is trying to get to IP: 216.127.33.119:HTTP
then also FTP.EXE (ftp://ftp.exe/) is trying to get to IP 205.236.189.54:FTP
Sorry if this belongs in tech forum but i thought this had nothing to do with planetside and you guys would get a laugh out of the obviousness of the hacker making the virus hack the homepage with his own site for spyware removal