WARNING!!! Spyware/Addware @ www.scifience.net/hl2

[phantomdesign]

There appears that one of the advertisements at www.scifience.net/hl2 does some nasty work on your computer.

It modifies your registry so that...

• It prevents you from changing your homepage
• It changes your homepage to http://default-homepage-network.com/start.cgi?new-hkcu (DO NOT CLICK LINK!!!)

It may do something else, but I cannot be sure. Basically it automatically sends you to that link, which has a crapload of popups. Easy fix? When you try to change your homepage, amazingly that feature has been disabled (woohoo!!!).

Have you been infected already?
Well, to alleviate some stress, download this simple 2mb file & the rest should be fairly easy to do.
ftp://ftp.download.com/pub/win95/utilities/aaw6181.exe

Here's what you need to mostly be concerned with:

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Bar.smartbotpro.net

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://server224.smartbotpro.net/7search/?new-hkcu"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://server224.smartbotpro.net/7search/?new-hkcu"

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Bar.smartbotpro.net

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://server224.smartbotpro.net/7search/?new-hklm"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://server224.smartbotpro.net/7search/?new-hklm"

Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainStart Pagedefault-homepage-network.com

Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://default-homepage-network.com/start.cgi?new-hklm"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Start Page
Data : "http://default-homepage-network.com/start.cgi?new-hklm"

Note to Moderators: You can move this thread if you must (I prefer you wait a day), but please leave a shadow in the HL2 discussion section.

 

[brink's]

thx for the warning

 

[hype.db]

Hm, to double check I did a quick scan with Adaware 6 on the newest content update and it found nothing other than the normal tracker cookies.
My homepage remains unchanged.

EDIT: ran an additional scan with SpySweeper and my registry is clean.

 

[phantomdesign]

No problem...just being Mr. Nice Guy.

Yes, I have confirmed that the add/spy ware came from that link.

 

[phantomdesign]

It probably doesn't happen to everyone every time, but it has happened to two people so far (minimum).

 

[DarkStar]

LOL. Why the hell did you insert the URL into your post and make it clickable if you don't want people to click on it? You could have just typed it out. Well, thanks for the heads up anyway.

 

[phantomdesign]

Check the url it links to.

http://dontclick/ <--

If you do click, nothing really happens.

EDIT: It also automatically does URL tags if you don't mess with the checkboxes in the "Additional Options" section...so...I was being lazy/ignorant I guess.

 

[PseudoKnight]

1 of a hundred reasons not to use IE.

 

[Murray]

Well that's just great, then is there anyone that is willing to mirror them movies so I don't have to get all this spyware? :|

 

[Estevan]

mozzila is teh best!

 

[Ahnteis]

Download Firefox

You get 0 popups, no active-x auto downloads, tabbed browsing, the ability to set a minimun font size, and a google search box (with hotkeys for url and search box among other things). If you want to download an extension, you even get mouse gestures.

 

[hype.db]

Well that's just great, then is there anyone that is willing to mirror them movies so I don't have to get all this spyware? :|

www.opera.com
From Ahnteis's description, it's pretty much like firefox. I've been using it for years and love it.

 

[phantomdesign]

General Gaming? Strange place to move this thread. Maybe off topic or the hardware forum seems more logical (or leaving it exactly where it was).

 

[crabcakes66]

Why the hell did this get put in GG.......

get off the drugs moderators...

 

[ComradeBadger]

fs whoever moved this.

Moved to Off Topic.

 

[The Dark Elf]

I moved it badger, got a problem with that?


And phantom, if you don't like where threads get moved to. Learn to post in the correct place to start with, Cheers.

 

[ComradeBadger]

No, no problem mate.

 

[Ghost Freeman]

Anyone who still uses IE deserves no better.

 

[jasonh1234]

www.opera.com
I've been using it for years and love it.

Werd!
:thumbs: :cheers: Far superior to Internet Exploder

 

[Fat Tony!]

Id use the alternatives but in order to download the huge files i need something better then my slow 56k

 

[Scifience]

This is no longer an issue; I found the offending advertiser and removed them from the ad rotation.

Try again and see if you still get it.

http://www.scifience.net/hl2/

I'm sorry about the trouble; I have spyware just as much as anyone else.

 

[ComradeBadger]

Id use the alternatives but in order to download the huge files i need something better then my slow 56k

They are not huge files Ben.

 

[Fat Tony!]

How big? Anything above 20MB and i usually dont bother

 

[ComradeBadger]

It's about 8mb

 

[Fat Tony!]

Must be CRAP then

 

[phantomdesign]

This is no longer an issue; I found the offending advertiser and removed them from the ad rotation.

Try again and see if you still get it.

http://www.scifience.net/hl2/

I'm sorry about the trouble; I have spyware just as much as anyone else.

Thanks for fixing it