sept 27th was deal with trojan spyware hijacker day

Article View: chi.internet

Article #601

#601

From: Matt Ferrari
Date: Fri, 30 Sep 2011 18:25

27 lines
2624 bytes

ok which one of yooze guys hacked me?

A week ago i started finding my computer idle with the adminstrator sign in 
screen displayed when i returned the next day.

 I guess what was happening is someone was accessing my computer
remotely. It was more disturbing when it started happening while i was 
actually AT the computer. I would see a warning screen that 34kere93joeblow 
administrator is trying to connect to my computer and that agreeing to it 
would sign me out.
Well if i made no choice it signed me out anyway. If i said no it would go 
away for a while then come back.

So  what the FSDFL@#R$ S?! had enough of that crap. went to my computer 
right clicked properties then the remote tab
and clicked off allow remote connections. Then i decided to check my startup 
programs. There i found 2 malicious programs running.
I decided to uncheck 19 startups and keep 12 yes i had a lot.
http://www.ferrari-dvd.com/imagesNEWS-G/startupsSETTINGS.jpg

uh? i guess i can get rid of umax vista access too i havent had a umax 
scanner in a long time. :O

Installed the program combofix and ran it it removed the bs.

what the fork is up with people screwing computer users over like this?
I'm just a guy surfing the net doing research, and this happens? sheesh!

Technical Details

Message-ID: <j651ih$114$1@dont-email.me>

Path:

arc1-ca.pugleaf.net!lh7ni8466pbb.0!nntp.google.com!news1.google.com!volia.net!news2.volia.net!feed-A.news.volia.net!newsfeed.utanet.at!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Thread: 10d5fa,a90a628857f3b390,start
X-Google-NewGroupId: yes
X-Google-Attributes: gid837b0c45a0,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Received: by 10.68.8.229 with SMTP id u5mr47192628pba.0.1317407122630;
        Fri, 30 Sep 2011 11:25:22 -0700 (PDT)
MIME-Version: 1.0
Path: arc1-ca.pugleaf.net!lh7ni8466pbb.0!nntp.google.com!news1.google.com!volia.net!news2.volia.net!feed-A.news.volia.net!newsfeed.utanet.at!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!.POSTED!not-for-mail
From: "Matt Ferrari" <invalid@noSpamORharvest.com>
Newsgroups: chi.internet
Subject: sept 27th was deal with trojan spyware hijacker day
Date: Fri, 30 Sep 2011 13:25:17 -0500
Organization: A noiseless patient Spider
Lines: 29
Message-ID: <j651ih$114$1@dont-email.me>
Injection-Date: Fri, 30 Sep 2011 18:25:21 +0000 (UTC)
Injection-Info: mx04.eternal-september.org; posting-host="uhgHkDY8bJ/xlrEH3dyEnQ";
 logging-data="1060"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18LAt8/lWj5jHZGYI1ARr2mP/kyDuOzdxg="
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6109
X-RFC2646: Format=Flowed; Original
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:RdGonHkKIsMCrr01kVSsADz49io=
X-Priority: 3
X-MSMail-Priority: Normal