OT - Web browsing issue

[Eric Cope]

I thought it was malware also, but now its doing it to my work PC and
Firefox. I think my Wordpress installation has been compromised. Dang!

On Mon, Aug 10, 2009 at 9:10 AM, JD Austin <jd at twingeckos.com> wrote:

>
>    - Look for 'browser helpers' and dns settings changed.
>    - They can do it two ways - by changing the dns server or by adding to
>    c:\windows\system32\drivers\etc\hosts
>    - Look for a 'search assistant' installed in control panel ->
>    add/remove programs
>    The most common one I see now days is mywebsearch that has a browser
>    plugin, email plugin, and application installed
>
>
> On Mon, Aug 10, 2009 at 8:54 AM, Eric Cope <eric.cope at gmail.com> wrote:
>
>> she's pissy over using firefox, the world will implode if I switch it to
>> Linux...
>>
>> Firefox and Noscript have stopped it...
>> malwarebytes doesn't find anything.
>> spybot is running right now.
>> DNS records look ok (but I am far from an expert).
>> Any other ideas? My wife told me her mom us suffering the same thing. Any
>> ideas to scan my website?
>>
>> Thanks,
>> Eric
>>
>>
>> On Sun, Aug 9, 2009 at 10:03 PM, Michael Butash <michael at butash.net>wrote:
>>
>>> Haha, do like I did, force my wife to eat linux for her main
>>> workstation.  Past a few weeks of trepidation and being pissy, she's now
>>> quite thankful.
>>>
>>> Rehab for windoze users, it's for their own good to perform
>>> intervention.  :)
>>>
>>> -mb
>>>
>>>
>>> On Sun, 2009-08-09 at 17:18 -0700, Bob Elzer wrote:
>>> > Might have to do an upgrade to wife 1.2 :-)
>>> >
>>> >
>>> >
>>> >         ______________________________________________________________
>>> >         From: plug-discuss-bounces at lists.plug.phoenix.az.us
>>> >         [mailto:plug-discuss-bounces at lists.plug.phoenix.az.us] On
>>> >         Behalf Of Eric Cope
>>> >         Sent: Sunday, August 09, 2009 4:15 PM
>>> >         To: michael at butash.net; Main PLUG discussion list
>>> >         Subject: Re: OT - Web browsing issue
>>> >
>>> >
>>> >
>>> >         I recently wiped it due to a similar issue. But my wife visits
>>> >         the same sites...
>>> >
>>> >         On Sun, Aug 9, 2009 at 3:57 PM, Michael Butash
>>> >         <michael at butash.net> wrote:
>>> >                 How often do you actually ask windows-only people for
>>> >                 anything helpful
>>> >                 even for windoze?  :)
>>> >
>>> >                 Sounds like something is manipulating your outbound
>>> >                 traffic, try
>>> >                 malwarebytes, or a format.  I don't trust any windoze
>>> >                 install once it's
>>> >                 been compromised, and only slightly more even fully
>>> >                 patched.  I had a
>>> >                 friends new windoze install get owned in less than day
>>> >                 of them ignoring
>>> >                 my warning of using firefox w/noscript, and got the
>>> >                 same kind of
>>> >                 behavior hijacking url's like that.  Even when cleaned
>>> >                 with
>>> >                 malwarebytes, something still persisted that it
>>> >                 couldn't find, so they
>>> >                 just wiped it again.  Hopefully it wasn't one of those
>>> >                 mbr-resident
>>> >                 stealth ones thanks to sony...
>>> >
>>> >                 -mb
>>> >
>>> >
>>> >                 >
>>> >                 > why are we asking windows questions on Linux list?
>>> >                 >
>>> >                 > Craig
>>> >                 >
>>> >                 >
>>> >
>>> >
>>> >
>>> >                 ---------------------------------------------------
>>> >                 PLUG-discuss mailing list -
>>> >                 PLUG-discuss at lists.plug.phoenix.az.us
>>> >                 To subscribe, unsubscribe, or to change your mail
>>> >                 settings:
>>> >
>>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>> >
>>> >
>>> >
>>> >
>>> >         --
>>> >         Eric Cope
>>> >         http://cope-et-al.com
>>> > ---------------------------------------------------
>>> > PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>>> > To subscribe, unsubscribe, or to change your mail settings:
>>> > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>>
>>> ---------------------------------------------------
>>> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>>> To subscribe, unsubscribe, or to change your mail settings:
>>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>>
>>
>>
>>
>> --
>> Eric Cope
>> http://cope-et-al.com
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>
>
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>



-- 
Eric Cope
http://cope-et-al.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20090810/513a7031/attachment.htm