Slinging.org Forum - Re: Winfixer Spyware on Slinging.org

Matthias

Past Moderator

Offline

Posts: 1418
Gatineau/Ottawa QC, Canada
Gender: male

Re: Winfixer Spyware on Slinging.org
Sep 23^rd, 2005 at 5:46pm

Ouch...

The good news, FunSlinger, is that Winfixer is a client side problem, ie: Slinging.org is clean. Bad news is that it looks like a right pita.

There are a handful of manual removal techniques posted online (not sure what variant you've got) and a couple of "automatic" cleaning tools. I'm normally healthily dubious of the auto-clean progs, particularily ones that are design to remove malware that is already trying to sale anti-malware ( Angry

) product. The manual steps are typically long and involved.

A quiet plug for running alternative browsers - since I switched from IE to Opera, I have had exactly 0 problems of this nature. Firefox is another good option.

Matthias

Back to top

IP Logged

Matthias

Past Moderator

Offline

Posts: 1418
Gatineau/Ottawa QC, Canada
Gender: male

Re: Winfixer Spyware on Slinging.org
Reply #1 - Sep 23^rd, 2005 at 9:05pm

I'm as positive as is possible that slinging.org is clean. I regularily access this site though 4 different browsers on 6 machines. You are also the only person who has reported being affected.

Lots of browser hijacks target sites that are "stored" somewhere in your system. The obvious trigger at slinging.org could be the password cookie, if not the url or files from your history/bookmarks/cache. I'm sure you've tried attacking this one already, but wiping the cookies/cache and trying to reload the site might be useful in pinning down the behaviour (but not fixing it, alas).

I spent a bit of time cruising for info on winfixer - can you post any additional info? The variant it sounds like is attacking you doesn't match the common profile posted. If you've had the problem for acouple of months, it should be relatively simple to crack once it is fully identified. It's the "first-day" infections that always have me worried; you know if you can't find any google references that you are in trouble....

Matthias

Back to top

IP Logged

Willeke Interfector Viris Spurii Past Moderator Offline Give me some string and I know what to do. Posts: 2072 Netherlands Gender:	Re: Winfixer Spyware on Slinging.org Reply #2 - Sep 24^th, 2005 at 2:54am While I am not having the problem with slinging.org, I have it with one other site where I am always bombarded with adds. So I look forward to see the results of this discussion. Willeke
Back to top	"Never underestimate what a simple person can do with clever tools, nor what a clever person can do with simple tools." - Ian Fieggen - Writer of A booklet on lanyards, PM for info - Member IGKT, Netherlands Bad spellers of the world: untie! IP Logged

Douglas_The_Black Interfector Viris Spurii Offline Hakkaa päälle! Posts: 3491 Salineville Ohio Gender:	Re: Winfixer Spyware on Slinging.org Reply #3 - Sep 24^th, 2005 at 8:00am i had this same problem untill i got firefox.
Back to top	i live in a maze of typo's&&&& popularity is for dolls a hero cannot be popular-Ralph Waldo Emerson&&&&DTB-master of the corny vest, and crappy carpet! IP Logged

Gun Interfector Viris Spurii Past Moderator Offline Slinging Viking Posts: 1089 The Ozarks of Ark & Mo Gender:	Re: Winfixer Spyware on Slinging.org Reply #4 - Sep 24^th, 2005 at 9:34am Funslinger just get both yahoos and msn spam spyware software for free from the internet. Between both I NEVER get any popups or spyware. You still will need to run scans from time to time on your computer but they both seam to work great to me.
Back to top	"A Knifeless man is a lifeless man" Old Nordic Proverb IP Logged

Mike_R Funditor Offline Posts: 617	Re: Winfixer Spyware on Slinging.org Reply #5 - Sep 24^th, 2005 at 7:48pm I'm not sure what the hell is going on, but when I logged on today, I saw this post and got winfixered at the same time. I've never come across this winfixer crap before. I have no clue what this means but maybe someone can make sense of it.
Back to top	IP Logged

Matthias

Past Moderator

Offline

Posts: 1418
Gatineau/Ottawa QC, Canada
Gender: male

Re: Winfixer Spyware on Slinging.org
Reply #6 - Sep 24^th, 2005 at 8:42pm

Well that is a kick in the teeth. Could you describe when/how/what exactly pops up? I'm still hoping this is coincidental - haven't seen any posts on YaBB vulerability or such... (yet Sad

) As far as I can tell, you pretty much need to click in a popup to activate this thing - maybe somewhere linked in a recent post is the initial source.

Any news on your situation FunSlinger?

Matthias

Back to top

IP Logged

Castle7 Senior Member Offline I'm on fire today!! Posts: 453 GR, Michigan Gender:	Re: Winfixer Spyware on Slinging.org Reply #7 - Sep 25^th, 2005 at 11:47am I use both a Firefox and IE and have no problems here with slinging.org. Good idea to delete your cookies.
Back to top	If I build it, they will run.&&-Mikeel&&&& IP Logged

Matthias Past Moderator Offline Posts: 1418 Gatineau/Ottawa QC, Canada Gender:	Re: Winfixer Spyware on Slinging.org Reply #8 - Sep 28^th, 2005 at 12:48pm Unpleasant... FunSlinger could post or maybe email me a screencap of the popup? Matthias
Back to top	IP Logged

Naiyor

Descens

Offline

My sling-a-ling, My sling-a-ling,
I want you to..

Posts: 137
Canada
Gender: male

Re: Winfixer Spyware on Slinging.org
Reply #9 - Sep 28^th, 2005 at 4:29pm

I am not sure exactly how the winfixer program works...I have never had a problem with this site...and with ad/spy/maleware before.

have you gone through your system processes to see if there is an unususal program running in the background?

If any of the process names look strange you can just type them in google and it will let you know exactly what it is...This is how I id'd a trojan running on my old comp.

I have accessed this site with various types of computers, with various levels of protection (my personal security software, corporate security software, and basically no security at all!

I am interested to find out what is going on. Please keep us informed.

If the program does in fact run in the background, just end process until you figure out how to remove it...

also make sure it does not back-up into your save drive...many scanners will be able to ID it there but not remove it...may have to purge that after initial removal.

Just my thoughts!

Back to top

IP Logged

Curious Aardvark

Forum Moderation

Offline

Taller than the average
Dwarf

Posts: 13965
Midlands England
Gender: male

Re: Winfixer Spyware on Slinging.org
Reply #10 - Sep 28^th, 2005 at 5:49pm

Okay - first up slinging.org is clean.
Secondly - as someone who disenfects many computers every week, if you are getting popups then it is YOUR computer that is infected.
The best anti spyware program on the net is free.
go to www.download.com download spybot 1.4 - Do not download any other antispyware program.
install it. Update it.
boot your computer into safe mode.
run full check with spybot and remove everything it flags.
Let me know how many hits you get - my current record is 995 :-)
Next
go to www.free.grisoft.com and download avg free.
update.
boot into safe mode. run full scan. Again let me know how many you get - current record 570
If after that you're still getting popups.
email me.
There are other things to do - but I need a hijackthis log first. Hopefully that won't be necessary.

Actually I usually install and update both avg and spybot before booting into safe mode: to boot into safe mode. Press the f8 key AS SOON as you switch your computer on, press it repeatedly untill you see a boot menu. If you don't see a boot menu you did not start hitting thr f8 key soon enough. Try again.

While firefox is much better than IE - primarily because it has not been around as long. You can still get page hijackers and pop ups on it.
It's possible that some aspect of the slinging.org code is triggering your pop-ups, but at the end of the day it's your fault :-) Not theirs.

Back to top

Do All things with Honour and Generosity: Regret Nothing, Envy None, Apologise Seldom and Bow your head to No One - works for me

IP Logged

Curious Aardvark

Forum Moderation

Offline

Taller than the average
Dwarf

Posts: 13965
Midlands England
Gender: male

Re: Winfixer Spyware on Slinging.org
Reply #11 - Sep 29^th, 2005 at 6:42am

funslinger I note in another post you say you play a lot of online games.
The bad news is that's where you are picking up spyware. The good news is that once you've got a clean system and stop playing online games (also avoid mobile phone websites that offer free downloads, questionnaire sites and anything that looks like fun and offers stuff for free) you won't get any more popups :-)
Forums - on the whole - as long as they are not hosted on 'free' webspace are generally safe. And get rid of yahoo - it's definitely border line dodgy.

Unfortunately in the last 18 months the whole virus/spyware industry has commercialised and instead of students buggering about at college it's now proper programmers targeting the least conscientious group of heavy internet users. Teenagers. So if there is a website that looks professionally done with games that have obviously taken someone skilled time to write and they don't want money - be very suspicious, it's a commercial venture and they will get their pint of blood from you one way or another.

Most spyware is installed with 'implied consent'. You went to their website, therefore you agreed to have their software. This is one reason a lot of virus checkers won't pick it up. Anyway do what said in the previous post and let me know how you get on :-)
And look on the bright side - I usually charge for this stuff :-)

Back to top

Do All things with Honour and Generosity: Regret Nothing, Envy None, Apologise Seldom and Bow your head to No One - works for me

IP Logged

Yahweh Bless you in Yeshua Interfector Viris Spurii Offline Matthew 11:25-30 Posts: 1700 Gender:	Re: Winfixer Spyware on Slinging.org Reply #12 - Sep 29^th, 2005 at 6:55pm Hijack this is a nifty bit of freeware.....also Netveda is free and useful. Peace, TS
Back to top	Blessings in Yeshua!&& IP Logged

Curious Aardvark

Forum Moderation

Offline

Taller than the average
Dwarf

Posts: 13965
Midlands England
Gender: male

Re: Winfixer Spyware on Slinging.org
Reply #13 - Sep 30^th, 2005 at 2:23pm

There's no need to get sniffy - the problems with your computer are your fault, nobody elses.
If you choose not to do anything about it, fine :-)

And if you appear to have lost your sense of humour as a consequence - well there are millions of people out there having exactly the same problems so you're in good - if sour - company :-)

Instead of wingeing get it sorted.

Back to top

Do All things with Honour and Generosity: Regret Nothing, Envy None, Apologise Seldom and Bow your head to No One - works for me

IP Logged

Chris Slinging.org Administrator Offline Slinging Rocks! Posts: 1284 USA Gender:	Re: Winfixer Spyware on Slinging.org Reply #14 - Oct 1^st, 2005 at 1:56am As a few people have mentioned, the site is clean. It's all those other sites you visit that are giving you the spyware! Slinging.org will continue to be spyware and ad free. Chris
Back to top	IP Logged