1. RE: VERY strange problem? HELP!
>From: CoJaBo <guest at RapidEuphoria.com>
>Reply-To: EUforum at topica.com
>To: EUforum at topica.com
>Subject: VERY strange problem? HELP!
>Date: Fri, 25 Jun 2004 18:44:00 -0700
>
>posted by: CoJaBo <cojabo at suscom.net>
>
<snip>
>I tried to create the problem in another program, but got another
>strange error:
>
>[ex.err]
>...\New Windows App.exw:11 in procedure w_onOpen()
>type_check failure, n is 486
> self = 3
> event = 4
> params = {}
> o = 6
>
>...
time() returns a decimal number that could possibly be something like
4.803424. Multiplying by 100 gives 480.3424 plus rand(100)->6 making
486.3424. You are trying to assign this result to an integer. The
interpreter prints out what it should be, and not what it really is that you
are assigning. It can be a bit confusing, yes. You can fix it by adding a
floor() around the entire expression.
<snip>
~[ WingZone ]~
http://wingzone.tripod.com/
2. RE: VERY strange problem? HELP!
Elliott S. de Andrade wrote:
>
> >From: CoJaBo <guest at RapidEuphoria.com>
> >Reply-To: EUforum at topica.com
> >To: EUforum at topica.com
> >Subject: VERY strange problem? HELP!
> >Date: Fri, 25 Jun 2004 18:44:00 -0700
> >
>
> >posted by: CoJaBo <cojabo at suscom.net>
> >
> <snip>
> >I tried to create the problem in another program, but got another
> >strange error:
> >
> >[ex.err]
> >...\New Windows App.exw:11 in procedure w_onOpen()
> >type_check failure, n is 486
> > self = 3
> > event = 4
> > params = {}
> > o = 6
> >
> >...
>
> time() returns a decimal number that could possibly be something like
> 4.803424. Multiplying by 100 gives 480.3424 plus rand(100)->6 making
> 486.3424. You are trying to assign this result to an integer. The
> interpreter prints out what it should be, and not what it really is that you
> are assigning. It can be a bit confusing, yes. You can fix it by adding a
> floor() around the entire expression.
On Win32, time()*100+rand(99) can only be an integer. At the time this
was hapening, a hacker broke into my computer. I think this might have
had somthing to do with it. I also found time() returning huge negetive
numbers (like -3812688).
>
> <snip>
>
> ~[ WingZone ]~
> <a href="http://wingzone.tripod.com/">http://wingzone.tripod.com/</a>
>
>
3. RE: VERY strange problem? HELP!
I can't get any of the problems I had yesterday to happen again.
I think it was "54484520454E44" again, similar problems each time:
-Eu acts funny
-Mouse moves on its own
-Browser opens up random page
-Internet connection is extremely slow
-And once(at another site) took control of my (and other
peoples) accounts and posted silly nonsense (like 
... or
4920414D2054484520454E442100 or spatchula?)
CoJaBo wrote:
>
> Elliott S. de Andrade wrote:
> >
> > >From: CoJaBo <guest at RapidEuphoria.com>
> > >Reply-To: EUforum at topica.com
> > >To: EUforum at topica.com
> > >Subject: VERY strange problem? HELP!
> > >Date: Fri, 25 Jun 2004 18:44:00 -0700
> > >
> >
> > >posted by: CoJaBo <cojabo at suscom.net>
> > >
> > <snip>
> > >I tried to create the problem in another program, but got another
> > >strange error:
> > >
> > >[ex.err]
> > >...\New Windows App.exw:11 in procedure w_onOpen()
> > >type_check failure, n is 486
> > > self = 3
> > > event = 4
> > > params = {}
> > > o = 6
> > >
> > >...
> >
> > time() returns a decimal number that could possibly be something like
> > 4.803424. Multiplying by 100 gives 480.3424 plus rand(100)->6 making
> > 486.3424. You are trying to assign this result to an integer. The
> > interpreter prints out what it should be, and not what it really is that you
> >
> > are assigning. It can be a bit confusing, yes. You can fix it by adding a
> > floor() around the entire expression.
>
> On Win32, time()*100+rand(99) can only be an integer. At the time this
> was hapening, a hacker broke into my computer. I think this might have
> had somthing to do with it. I also found time() returning huge negetive
> numbers (like -3812688).
>
>
> > <snip>
> >
> > ~[ WingZone ]~
> > <a href="http://wingzone.tripod.com/">http://wingzone.tripod.com/</a>
> >
> >
4. RE: VERY strange problem? HELP!
CoJaBo wrote:
>
> I can't get any of the problems I had yesterday to happen again.
> I think it was "54484520454E44" again, similar problems each time:
> -Eu acts funny
> -Mouse moves on its own
> -Browser opens up random page
> -Internet connection is extremely slow
> -And once(at another site) took control of my (and other
> peoples) accounts and posted silly nonsense (like ... or
> 4920414D2054484520454E442100 or spatchula?)
Have you run Ad-aware? Chances are good that there are some (few dozen)
trojans/spyware/keystroke loggers on there.
http://www.lavasoftusa.com/software/adaware/
Irv
5. RE: VERY strange problem? HELP!
irv mullins wrote:
>
> CoJaBo wrote:
> >
> > I can't get any of the problems I had yesterday to happen again.
> > I think it was "54484520454E44" again, similar problems each time:
> > -Eu acts funny
> > -Mouse moves on its own
> > -Browser opens up random page
> > -Internet connection is extremely slow
> > -And once(at another site) took control of my (and other
> > peoples) accounts and posted silly nonsense (like ... or
> > 4920414D2054484520454E442100 or spatchula?)
>
> Have you run Ad-aware? Chances are good that there are some (few dozen)
> trojans/spyware/keystroke loggers on there.
>
> <a
> href="http://www.lavasoftusa.com/software/adaware/">http://www.lavasoftusa.com/software/adaware/</a>
>
> Irv
>
I already have AdAware and I just ran a scan, and found nothing.
The time that the hacker took control of my computer and hacked my
accounts it had found well over 800. No, that is not a misteak.
I had to reformat the hard drive to get rid of them...
I also have SpyBot S&D, it just found the normal:
a what's related link and a bunch of cookies (Mmmm... cookies!)
6. RE: VERY strange problem? HELP!
CoJaBo wrote:
>
> I already have AdAware and I just ran a scan, and found nothing.
> The time that the hacker took control of my computer and hacked my
> accounts it had found well over 800. No, that is not a misteak.
> I had to reformat the hard drive to get rid of them...
> I also have SpyBot S&D, it just found the normal:
> a what's related link and a bunch of cookies (Mmmm... cookies!)
800 must be some kind of record!
Anyway, three of the symptoms you mentioned are common signs of infection:
> > -Mouse moves on its own
> > -Browser opens up random page
> > -Internet connection is extremely slow
If that's still happening, then perhaps something is still there, but
not recognized by Ad-aware/SpyBot. Do you have a really good firewall
in place? How about a way to monitor outgoing traffic to see if your
computer is busy sending out spam?
You might want to try formating and re-installing Windows (while not
connected to the net!) Replace IE and OE with safer alternatives.
It is very difficult to avoid getting re-infected once you connect
to the net, in fact it often happens before you can install the latest
MS patches.
Regards,
Irv
7. RE: VERY strange problem? HELP!
On 27 Jun 2004, at 6:27, irv mullins wrote:
>
>
> posted by: irv mullins <irvm at ellijay.com>
<snip>
> You might want to try formating and re-installing Windows (while not
> connected to the net!) Replace IE and OE with safer alternatives.
> It is very difficult to avoid getting re-infected once you connect
> to the net, in fact it often happens before you can install the latest
> MS patches.
Actually, almost any open port is an invite to a cracker to break in.
I remember a time when someone cracked into M$ itself, and pre-installed
trojans into an OS, and no one at M$ noticed till customers complained.
Kat
8. RE: VERY strange problem? HELP!
irv mullins wrote:
>
> CoJaBo wrote:
> >
> > I already have AdAware and I just ran a scan, and found nothing.
> > The time that the hacker took control of my computer and hacked my
> > accounts it had found well over 800. No, that is not a misteak.
> > I had to reformat the hard drive to get rid of them...
> > I also have SpyBot S&D, it just found the normal:
> > a what's related link and a bunch of cookies (Mmmm... cookies!)
>
> 800 must be some kind of record!
Sorry, I forgot to include the additial 300 that SpyBot S&D found.
I had also fuond the source: an active X super-virus, it got past
2 firewalls and my virus scanner. This one alone was the reason I
had to reformat and reinstall; no mater what it would reinstall
itself and at least 500 others.
>
> Anyway, three of the symptoms you mentioned are common signs of infection:
> > > -Mouse moves on its own
> > > -Browser opens up random page
> > > -Internet connection is extremely slow
>
> If that's still happening, then perhaps something is still there, but
> not recognized by Ad-aware/SpyBot. Do you have a really good firewall
> in place? How about a way to monitor outgoing traffic to see if your
> computer is busy sending out spam?
I use Norton Internet Security and a router with a hardware firewall.
None are reporting anything odd except connections to unknown computers:
192.168.100.1
10.150.1.103
>
> You might want to try formating and re-installing Windows (while not
> connected to the net!) Replace IE and OE with safer alternatives.
I use Mozzilla FireFox for searches and sites I don't know.
This was the one opening random pages. The last one was a countdown
to somthing.
> It is very difficult to avoid getting re-infected once you connect
> to the net, in fact it often happens before you can install the latest
> MS patches.
>
> Regards,
> Irv
>
9. RE: VERY strange problem? HELP!
On 27 Jun 2004, at 9:40, CoJaBo wrote:
>
>
> posted by: CoJaBo <cojabo at suscom.net>
>
> irv mullins wrote:
> >
> > CoJaBo wrote:
> > >
> > > I already have AdAware and I just ran a scan, and found nothing.
> > > The time that the hacker took control of my computer and hacked my
> > > accounts it had found well over 800. No, that is not a misteak.
> > > I had to reformat the hard drive to get rid of them...
> > > I also have SpyBot S&D, it just found the normal:
> > > a what's related link and a bunch of cookies (Mmmm... cookies!)
You realise cookies can be made executeable too?
> > 800 must be some kind of record!
> Sorry, I forgot to include the additial 300 that SpyBot S&D found.
> I had also fuond the source: an active X super-virus, it got past
> 2 firewalls and my virus scanner. This one alone was the reason I
> had to reformat and reinstall; no mater what it would reinstall
> itself and at least 500 others.
Yes, isn't ActiveX great? The thing is: *ALL* scripting languages run thru
firewalls like rain thru clouds. That includes ActiveX, VB, VBS, Java, JS,
everything on an html "link" tag (great for hiding java/script downloads!). And
it's true IE will execute html in a .jpg or other pic file, and while i haven't
tried
it, i imagine netscrape will also execute html in a web url ending in .jpg.
> > Anyway, three of the symptoms you mentioned are common signs of infection:
> > > > -Mouse moves on its own
> > > > -Browser opens up random page
> > > > -Internet connection is extremely slow
> >
> > If that's still happening, then perhaps something is still there, but
> > not recognized by Ad-aware/SpyBot. Do you have a really good firewall
> > in place? How about a way to monitor outgoing traffic to see if your
> > computer is busy sending out spam?
> I use Norton Internet Security and a router with a hardware firewall.
> None are reporting anything odd except connections to unknown computers:
> 192.168.100.1
> 10.150.1.103
Pop open mirc, and type:
/dns 192.168.100.1
and you should see yourself. Errr,, your computer's name, or something else
you'd recognise.
Those are both LAN addresses. I suspect the 192.168... is your computer or
router, and the 10.150.. (unless it's you) is on your isp. Neither address
should be on the internet, and you should firewall the following to/from the
internet:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Kat
10. RE: VERY strange problem? HELP!
Kat wrote:
>
> On 27 Jun 2004, at 9:40, CoJaBo wrote:
>
> >
> > posted by: CoJaBo <cojabo at suscom.net>
> >
> > irv mullins wrote:
> > >
> > > CoJaBo wrote:
> > > >
> > > > I already have AdAware and I just ran a scan, and found nothing.
> > > > The time that the hacker took control of my computer and hacked my
> > > > accounts it had found well over 800. No, that is not a misteak.
> > > > I had to reformat the hard drive to get rid of them...
> > > > I also have SpyBot S&D, it just found the normal:
> > > > a what's related link and a bunch of cookies (Mmmm... cookies!)
>
> You realise cookies can be made executeable too?
>
> > > 800 must be some kind of record!
> > Sorry, I forgot to include the additial 300 that SpyBot S&D found.
> > I had also fuond the source: an active X super-virus, it got past
> > 2 firewalls and my virus scanner. This one alone was the reason I
> > had to reformat and reinstall; no mater what it would reinstall
> > itself and at least 500 others.
>
> Yes, isn't ActiveX great? The thing is: *ALL* scripting languages run thru
> firewalls like rain thru clouds. That includes ActiveX, VB, VBS, Java, JS,
> everything on an html "link" tag (great for hiding java/script downloads!).
> And
> it's true IE will execute html in a .jpg or other pic file, and while i
> haven't tried
>
> it, i imagine netscrape will also execute html in a web url ending in .jpg.
>
> > > Anyway, three of the symptoms you mentioned are common signs of infection:
> > > > > -Mouse moves on its own
> > > > > -Browser opens up random page
> > > > > -Internet connection is extremely slow
> > >
> > > If that's still happening, then perhaps something is still there, but
> > > not recognized by Ad-aware/SpyBot. Do you have a really good firewall
> > > in place? How about a way to monitor outgoing traffic to see if your
> > > computer is busy sending out spam?
> > I use Norton Internet Security and a router with a hardware firewall.
> > None are reporting anything odd except connections to unknown computers:
> > 192.168.100.1
> > 10.150.1.103
>
> Pop open mirc, and type:
> /dns 192.168.100.1
None of the 3 computers or the router use 192.168.100.1, also,
the router only assigns addresses in the 192.168.2.1-100 range.
192.168.100.1 doesn't respond to a PING, but 10.150.1.103 does.
I have confirmed 10.150.1.103 isn't part of the LAN, the ISP
probably uses it for somthing. The LAN addresses are:
192.168.2.1 (router)
192.168.2.30 (this one)
192.168.2.8
192.168.2.44
> and you should see yourself. Errr,, your computer's name, or something else
> you'd recognise.
>
> Those are both LAN addresses. I suspect the 192.168... is your computer or
> router, and the 10.150.. (unless it's you) is on your isp. Neither address
> should be on the internet, and you should firewall the following to/from the
> internet:
>
> 10.0.0.0 - 10.255.255.255
> 172.16.0.0 - 172.31.255.255
> 192.168.0.0 - 192.168.255.255
>
> Kat
>
>
11. RE: VERY strange problem? HELP!
On 27 Jun 2004, at 18:13, CoJaBo wrote:
<snip>
> > > I use Norton Internet Security and a router with a hardware firewall.
> > > None are reporting anything odd except connections to unknown computers:
> > > 192.168.100.1 10.150.1.103
> >
> > Pop open mirc, and type:
> > /dns 192.168.100.1
> None of the 3 computers or the router use 192.168.100.1, also,
> the router only assigns addresses in the 192.168.2.1-100 range.
> 192.168.100.1 doesn't respond to a PING, but 10.150.1.103 does.
> I have confirmed 10.150.1.103 isn't part of the LAN, the ISP
> probably uses it for somthing. The LAN addresses are:
> 192.168.2.1 (router)
> 192.168.2.30 (this one)
> 192.168.2.8
> 192.168.2.44
Ok, traceroute it, block it, then report it.
Kat
12. RE: VERY strange problem? HELP!
Kat wrote:
>
> On 27 Jun 2004, at 9:40, CoJaBo wrote:
> > > > I already have AdAware and I just ran a scan, and found nothing.
> > > > The time that the hacker took control of my computer and hacked my
> > > > accounts it had found well over 800. No, that is not a misteak.
> > > > I had to reformat the hard drive to get rid of them...
> > > > I also have SpyBot S&D, it just found the normal:
> > > > a what's related link and a bunch of cookies (Mmmm... cookies!)
>
> You realise cookies can be made executeable too?
>
> > > 800 must be some kind of record!
> > Sorry, I forgot to include the additial 300 that SpyBot S&D found.
> > I had also fuond the source: an active X super-virus, it got past
> > 2 firewalls and my virus scanner. This one alone was the reason I
> > had to reformat and reinstall; no mater what it would reinstall
> > itself and at least 500 others.
>
> Yes, isn't ActiveX great? The thing is: *ALL* scripting languages run thru
> firewalls like rain thru clouds. That includes ActiveX, VB, VBS, Java, JS,
> everything on an html "link" tag (great for hiding java/script downloads!).
> And
> it's true IE will execute html in a .jpg or other pic file, and while i
> haven't tried
>
> it, i imagine netscrape will also execute html in a web url ending in .jpg.
......
> > I use Norton Internet Security and a router with a hardware firewall.
> > None are reporting anything odd except connections to unknown computers:
> > 192.168.100.1
> > 10.150.1.103
The really interesting thing about this is - here we have a computer-savvy
person who understands and uses firewalls plus all the anti-whatever software
available, but STILL gets infected.
What do you think happens to the average clueless grandparents', or
teenagers' computer which sits around unattended all day, connected to
DSL. Is it any wonder we get hundreds of spam e-mails every day?
Irv
