Linus' House of IT: 15 cents please

[Linus]

Originally Posted by Bit

Hi Linus!

Yesterday I came home to find our home page inaccessible and a yahoo wizard open asking me what text message we had received. There were multiple options, all related to changing my password. Closing out of the window did no good; I couldn't access the home page through the button on the navbar no matter what because the wizard kept popping back up. I could, however, access any other web page in any usual way.

Um, do I need to say we hadn't received any text messages at all? Or did you already know that?

Anyhow, we signed out of yahoo, closed down the browser, and ran Housecall. It found six items, all something to do with "root kits" from what Gryph told me; and it says it fixed them.

The %^$# yahoo wizard is still keeping us from using the homepage button. We can go in from a different link, but we don't know how to get this thing off our computer. Am I right in assuming that if I use the wizard, it will still send our password out to whomever hacked us in the first place despite our having run Housecall?

I guess Firefox has gotten popular enough to draw the attention of hackers now. It's really annoying.

If someone installed a keylogger (a small program that records all your keystrokes) your password to sites is probably the least of your worries. Root kits are never fun but it does sound like it's something more serious. You have a tool bar that you use, like a Yahoo bar or something? Do you remember which one you installed?

[Bit]

Hi Linus, thanks for the quick response!

The home page button is the standard one on Firefox, next to the address bar.

The other two toolbars on the browser are the bookmarks toolbar and the yahoo toolbar, but they don't seem to be affected; the only time this happens is when we click the home button on the Firefox tool bar--if we use a different link to get to the homepage, the wizard doesn't open at all.

Our homepage is linked to our ISP, which is att.net. Gryph's email is yahoo, but that doesn't seem to be affected at all.

I don't think this hacker is after website passwords; I think they're after our ISP password. Does that make sense?

The computer was totally clean according to Housecall on Tuesday; then yesterday after this happened we had the 6 root kits. I haven't run Housecall today; I have to close everything down for over an hour to run it, and I thought I should talk to you first.

[Linus]

Originally Posted by Bit

Hi Linus, thanks for the quick response!

The home page button is the standard one on Firefox, next to the address bar.

The other two toolbars on the browser are the bookmarks toolbar and the yahoo toolbar, but they don't seem to be affected; the only time this happens is when we click the home button on the Firefox tool bar--if we use a different link to get to the homepage, the wizard doesn't open at all.

Our homepage is linked to our ISP, which is att.net. Gryph's email is yahoo, but that doesn't seem to be affected at all.

I don't think this hacker is after website passwords; I think they're after our ISP password. Does that make sense?

The computer was totally clean according to Housecall on Tuesday; then yesterday after this happened we had the 6 root kits. I haven't run Housecall today; I have to close everything down for over an hour to run it, and I thought I should talk to you first.

It does make that they are after your ISP password. Go to the preferences of your browser and double check as to what is set for the homepage.

Additionally, download http://free.antivirus.com/hijackthis/

Do a scan with a log.

Copy and paste the contents of the log to me in a private message.

[PapaC]

Dear Linus,

Your triple increase in fees due to "inflation" gave me great pause.
I have this deep desire to under cut you and crush your head!

[ame="http://www.youtube.com/watch?v=YZWnMzYvMgc&feature=related"]YouTube- Kids in the Hall - fight picker[/ame]

Signed,

the other crazy 'techy' canuck

[Linus]

Originally Posted by PapaC

Dear Linus,

Your triple increase in fees due to "inflation" gave me great pause.
I have this deep desire to under cut you and crush your head!

YouTube- Kids in the Hall - fight picker

Signed,

the other crazy 'techy' canuck

LOL.. Well, if we're going to do this, let's do it right:

[ame="http://www.youtube.com/watch?v=lL9oA1LFoMw"]YouTube- Monty Python Live at the Hollywood Bowl - Argument Clinic[/ame]

[PapaC]

Dear Linus,

I would... however, it doesn't seem possible at this time:

http://screencast.com/t/YzMwNDUwYzk

LOL.. Well, if we're going to do this, let's do it right:

YouTube- Monty Python Live at the Hollywood Bowl - Argument Clinic

[Linus]

Originally Posted by PapaC

Dear Linus,

I would... however, it doesn't seem possible at this time:

http://screencast.com/t/YzMwNDUwYzk

Sorry. Wrong room. Go down the hall.

[ame="http://www.youtube.com/watch?v=teMlv3ripSM"]YouTube- Monty Python - Argument Clinic[/ame]

[Bit]

Thank you, Linus, the info is on its way. I still have hijackthis open on my desktop; haven't done anything other than send you the report--I notice that it said there were files missing from AVG. That might be because we uninstalled it. We run avast! now.