I got HORKED by BadWare

Friends... don't let this happen to you:

So there I am allegedly using Morpheus to upgrade my alleged media collection...

Next time I open IE6 I get a weird error... My homepage has been changed... naked trollops frolic upon my screen... AVAST pops up with multiple warnings and until I lock the internet with Zone Alarm multiple popups of other naked femaleage appears one after the other...

Needless to say my wife, who was going to look at some of the new houses I had found; and was looking over my shoulder, was NOT AMUSED!!!

IE6 had no text on the menuline... the selector for web links had a NO sign on it (y'all know... that little circle with the diagonal line in it.)

I attempted to upgrade IE... nope. I have version 6.28000.999

noticed a couple of weird files... AdAware, Emco, Spybot... all ignored them.

Tht is what I write to you today:

I found a file called : obbn13t.dll
and one called: ksl48.bin

I had a terrible time fixing this (thank the writers of FIREFOX again!!!)

I downloaded a copy of HAXFIX

Wrote up a .BAT file that I named "unhorkme.bat" had to... my copy and paste would not work either...

rem Script used to manually reregister Internet Explorer and Shell related *.dlls
rem Also included the Digital Signing and Cryptographic Provider *. dlls if needed
rem rundll32.exe advpack.dll /DelNodeRunDLL32 C:\WINNT\System32\dacui.dll
rem rundll32.exe advpack.dll /DelNodeRunDLL32 C:\WINNT\Catroot\icatalog.mdb
rem regsvr32 setupwbv.dll /s
rem regsvr32 wininet.dll /s
regsvr32 comcat.dll /s
regsvr32 CSSEQCHK.DLL /s
regsvr32 shdoc401.dll /s
regsvr32 shdoc401.dll /i /s
regsvr32 asctrls.ocx /s
regsvr32 oleaut32.dll /s
regsvr32 shdocvw.dll /I /s
regsvr32 shdocvw.dll /s
regsvr32 browseui.dll /s
regsvr32 browsewm.dll /s
regsvr32 browseui.dll /I /s
regsvr32 msrating.dll /s
regsvr32 mlang.dll /s
regsvr32 hlink.dll /s
rem regsvr32 mshtml.dll /s
regsvr32 mshtmled.dll /s
regsvr32 urlmon.dll /s
regsvr32 plugin.ocx /s
regsvr32 sendmail.dll /s
rem regsvr32 comctl32.dll /i /s
rem regsvr32 inetcpl.cpl /i /s
rem regsvr32 mshtml.dll /i /s
regsvr32 scrobj.dll /s
regsvr32 mmefxe.ocx /s
rem regsvr32 proctexe.ocx mshta.exe /register /s
regsvr32 corpol.dll /s
regsvr32 jscript.dll /s
regsvr32 msxml.dll /s
regsvr32 imgutil.dll /s
regsvr32 thumbvw.dll /s
regsvr32 cryptext.dll /s
regsvr32 rsabase.dll /s
rem regsvr32 triedit.dll /s
rem regsvr32 dhtmled.ocx /s
regsvr32 inseng.dll /s
regsvr32 iesetup.dll /i /s
rem regsvr32 hmmapi.dll /s
regsvr32 cryptdlg.dll /s
regsvr32 actxprxy.dll /s
regsvr32 dispex.dll /s
regsvr32 occache.dll /s
regsvr32 occache.dll /i /s
regsvr32 iepeers.dll /s
rem regsvr32 wininet.dll /i /s
regsvr32 urlmon.dll /i /s
rem regsvr32 digest.dll /i /s
regsvr32 cdfview.dll /s
regsvr32 webcheck.dll /s
regsvr32 mobsync.dll /s
regsvr32 pngfilt.dll /s
regsvr32 licmgr10.dll /s
regsvr32 icmfilter.dll /s
regsvr32 hhctrl.ocx /s
regsvr32 inetcfg.dll /s
rem regsvr32 trialoc.dll /s
regsvr32 tdc.ocx /s
regsvr32 MSR2C.DLL /s
regsvr32 msident.dll /s
regsvr32 msieftp.dll /s
regsvr32 xmsconf.ocx /s
regsvr32 ils.dll /s
regsvr32 msoeacct.dll /s
rem regsvr32 wab32.dll /s
rem regsvr32 wabimp.dll /s
rem regsvr32 wabfind.dll /s
rem regsvr32 oemiglib.dll /s
rem regsvr32 directdb.dll /s
regsvr32 inetcomm.dll /s
rem regsvr32 msoe.dll /s
rem regsvr32 oeimport.dll /s
regsvr32 msdxm.ocx /s
regsvr32 dxmasf.dll /s
rem regsvr32 laprxy.dll /s
regsvr32 l3codecx.ax /s
regsvr32 acelpdec.ax /s
regsvr32 mpg4ds32.ax /s
regsvr32 voxmsdec.ax /s
regsvr32 danim.dll /s
regsvr32 Daxctle.ocx /s
regsvr32 lmrt.dll /s
regsvr32 datime.dll /s
regsvr32 dxtrans.dll /s
regsvr32 dxtmsft.dll /s
rem regsvr32 vgx.dll /s
regsvr32 WEBPOST.DLL /s
regsvr32 WPWIZDLL.DLL /s
regsvr32 POSTWPP.DLL /s
regsvr32 CRSWPP.DLL /s
regsvr32 FTPWPP.DLL /s
regsvr32 FPWPP.DLL /s
rem regsvr32 FLUPL.OCX /s
regsvr32 wshom.ocx /s
regsvr32 wshext.dll /s
regsvr32 vbscript.dll /s
regsvr32 scrrun.dll mstinit.exe /setup /s
regsvr32 msnsspc.dll /SspcCreateSspiReg /s
regsvr32 msapsspc.dll /SspcCreateSspiReg /s
regsvr32 licdll.dll /s
regsvr32 regwizc.dll /s
regsvr32 softpub.dll /s
regsvr32 IEDKCS32.DLL /s
regsvr32 MSTIME.DLL /s
regsvr32 WINTRUST.DLL /s
regsvr32 INITPKI.DLL /s
regsvr32 DSSENH.DLL /s
regsvr32 RSAENH.DLL /s
regsvr32 CRYPTDLG.DLL /s
regsvr32 Gpkcsp.dll /s
regsvr32 Sccbase.dll /s
regsvr32 Slbcsp.dll /s
exit

I ran this to repair Internet Explorer. USE IT AT YOUR OWN RISK I MAKE NO WARRANTIES EXPRESS OR IMPLIED OR EVEN HINTED AT IN THE LIGHTEST OF ALL POSSIBLE METHODS!!!

I had to run this puppy FOUR times to get it to work all the way through... you know it works when it runs ALL THE WAY and quits on its own...

I do so hope this helps y'all have a better time than me. Scan your drives fiends... Make sure you are clean as well!!!

PS all better now!

And that is why I do not touch P2P software.

Regardless, wouldn't a quick run of System-Restore have made your life easier?

Why would you use morpheus?

I downloaded "morpheus" about 2 years ago and advised a mate to download it.

We both suddenly went offline and I had to call him up and tell him we had been given a bad file. Both of our systems had to be reinstalled I think.

In a sentence: Never use Morpheus.

Ditto.

I don't want to associate myself with a tool that helps to spread illegal software and media across the world.

I'm going to admit to using it. i got Tekken Resurrection, before it was released. it was blooming awesome. The key here is that i *want* and *will* buy it when it is released, which according to the local shop, was yesterday....

*gets ready to go out*

It's not all bad. Just.. most of it :)

so...
you're not driving a car, because it helps with bank robbery.
you're not using air planes, because they caused 9/11.
you're not drinking water, because you know how many people get drown every day.
you're not breathing air, because oxidation causes your body to age.
and why the hell are you using a computer?!? do you know how much crimes are performed withem EVERY DAY?! so, you're now already associated with hackers and crackers!

think about it...

I wouldn't touch P2P with yours, mate. :)

> Next time I open IE6 I get a weird error

I do everytime I open it.

eMule is malware free and if you only download mp3's, there's no possibility of catching anything nasty.

Start downloading TEH KEWLEST WAREZ and you deserve everything you get.

We have a choice, either try-before-you-buy and risk losing your data, or show a bit of patience, wait until software is officially released and you'll have no problems (Sony rootkits and dodgy anti-piracy drivers aside).

I suppose the best advice really is "know what you're downloading before you click the button" and "know where to download from".

p2p downloads mean that you're a very trusting person because you're relying on 100+ strangers sending you stuff that bypasses your firewall and any real-time HTTP antivirus scanners you may have installed.

That probably isn't strictly true.

I once downloaded a video (purely as a backup copy of something I already own on DVD) ;). When I tried to play it (it was AVI format), it wasn't a proper video file at all. It installed hundreds on virus-infected files on my PC, opened up Limewire and shared those files so other people would download them, too.

When I closed Limewire, it re-opened by itself.

Managed to solve the problem and fix it all after about two hours, then discovered not only had it tried to screw with my OS, it had also put a password on system BIOS. Had to rip my PC apart and reset the BIOS via the motherboard to regain control.

Haven't used P2P since.

Yikes! :/

Planes caused 9/11? Are you sick? Heard of something called a terrorist? Get a grip, please.

Drinking water is the same as people drowning? What the? Oh, and breathing equates to some kind of crime now?

Driving a car has other uses apart from helping to rob a bank. The main use for P2P software is well known for getting holding of "less than legal" software and media, fact. Cygnus was man enough to admit he has used it, but he also knows the risks.

Seriously OJay - if you love P2P so much then that's your bag, but if this is the only way you can defend it then you really need help. I've never seen anyone try so hard to deliberately miss the point.

you are really not having the smallest clue of what p2p is about...please go ahead and read http://en.wikipedia.org/wiki/P2P before you go on on discussing about it...thanks.

you're talking about running and cannot even crawl!


and just to clear that out: you and big10p where the persons who hijacked that thread >;P
im just the one that tries to clarify things ;D

o_O

oops...of course it was 'Genexi2'...sorry...must have mixed something up :D

never mind ^^

I farted.

I never got nastness from leeched warez tho, due always run a scanner on leeched things.. :P

Only one time I got a virus, which was a situation where I could come in between.. back then in the ol' kazaa days, I clicked some update feature so kazaa would update itself. I assumed it would download a new version from the official site. What it actually did was looking for a new version over the kazaa network, so, if any user shared one, which had a virus, then I'm done for it: it automatically installed it.

And you know about Murphy.. I was in the middle of a movie project, I actually lost 80 minutes of soundscape source material, I only had a bounced version of which the CD with the only version of it still must be laying around at the soundeditor.. ohwell, old crap..

I stopped using Morpheus when it continually caused me BSODs. I have Shareaza running 24/7 and never have any probs (Gnutella1/2/e2k/bittorrent, appear to be safe networks) and that's with all ports open.

@GFK, if an mp3 is an mp3 there is absolutely no harm that can come of it. The reason avis can be suss is because avi is just a container format for the actual video/audio codec and with added MS MediaPlayer 'features' it is possible to execute scripts at timed intervals, among other things. An MP3 -IS- the codec format, there is no room for underlying nasties (the only exception is of course with things like an .mp3.exe file and people who run their systems with file extensions hidden).

Actually I used Shareaza but it kept dropping malware on my system as well and I had a couple of script kiddies try to climb in to my computer while I was using it... KPF (using at the time...) kept them out.

Actually I use Morpheus to share video clips... I am a stupid video clip nerd... Outtakes... Bloopers... Oops... I love them...

Never D/L warez though... Like writing games more than playing most of them... MP3s??? Not really out there for me... my tastes are more in line with my video clip infatuation... Anybody got a link to the Tra La La song???

I've no idea how you managed to get malware from Shareaza. Go take a look at the source.....

I think the point about mp3's was well made there by Toby ;)

WMV's available on p2p are almost guaranteed to be dodgy. "just download this new codec" - yeah, because I'm so sure that I need another codec when my machine already handles MOV, WMV, Xvid, DivX, H.264, Mpeg1 & 2 and RealPlayer.

Sure. He's wrong, but it was well made.



I have a couple of friends who know more about viruses than I suspect you or I ( certainly I ) will ever know. One of them works for one of the biggest AV developers, and they both wrote their fair share of destructive viruses. Trust me, they could give a *real* MP3 ( not an mp3.exe ) that would tear your hard drive up.

I'm suing you all for making me itchy.

The thing about container file formats, and even non container file formates, is the risk of unfound flaws in decoders.

Just look at how a TIF file was used to enable homebrew on the PSP and ultimately allow a downgrade of the unit.

Buffer overflow errors dont just cause crashes. the crash is (usually) caused by a pointer going somewhere it shouldn't. some carefully positioned executable code will have it doing what you want....

Exactly.

I would like them to produce one of them. Email me. I don't believe it for a second.

While it is possible, they would have to know an exploit in the Mp3 decoder on your machine- highly improbable when there are so many of them.

That's good enough to make me feel pretty secure about it all. I don't care if it's technically possible... we don't live in a theoretical world.

Sad but true... theoretically I am a Millionaire... but only in Argentinian or Italian Currency! ;)

Still I suspect it is possible... the only thing I have learned about computers that I can trust is that the idiot box (that is to say, the computer) does only what it is instructed to do... If you instruct it badly it behaves badly... GIGO etc... I suppose anything is possible if the method were composed correctly...