Localhost : Port Hi-Jacked

[sponge]

3721 is a known parasite. Yes, you've been hijacked.

The standard advice applies: run the "Big Three" -- Ad-Aware
(http://www.lavasoft.de), SpyBot (http://security.kolla.de), and
SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html).
Make sure to run their updaters and, for SpyBot, exit out and then
restart the program in order to have the most current updates. Do
yourself a favor against future and more serious incidents and use
either Mozilla or Firebird instead of IE.

Sponge
Sponge's Secure Solutions
www.geocities.com/yosponge
My new email: yosponge2 et yahoo dot com

[John]

I did check my hosts file & it's fine

On 20 Oct 2003 21:17:00 -0700, yosponge@yahoo.com (sponge) wrote:

>3721 is a known parasite. Yes, you've been hijacked.
>
>The standard advice applies: run the "Big Three" -- Ad-Aware
>(http://www.lavasoft.de), SpyBot (http://security.kolla.de), and
>SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html).
>Make sure to run their updaters and, for SpyBot, exit out and then
>restart the program in order to have the most current updates. Do
>yourself a favor against future and more serious incidents and use
>either Mozilla or Firebird instead of IE.
>
>Sponge
>Sponge's Secure Solutions
>www.geocities.com/yosponge
>My new email: yosponge2 et yahoo dot com

[John]

removed all adware/spyware/malware but still cannot change the Proxy
Server under Tools - Internet Options - Connections - LAN setting to
anything - it simply refuses to be reset

any ideas would be greatly appreciated


y On 20 Oct 2003 21:17:00 -0700, yosponge@yahoo.com (sponge) wrote:

>3721 is a known parasite. Yes, you've been hijacked.
>
>The standard advice applies: run the "Big Three" -- Ad-Aware
>(http://www.lavasoft.de), SpyBot (http://security.kolla.de), and
>SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html).
>Make sure to run their updaters and, for SpyBot, exit out and then
>restart the program in order to have the most current updates. Do
>yourself a favor against future and more serious incidents and use
>either Mozilla or Firebird instead of IE.
>
>Sponge
>Sponge's Secure Solutions
>www.geocities.com/yosponge
>My new email: yosponge2 et yahoo dot com

[Giel]

i must say, i dont know now, but it maybe caching or DNS settings.
i do know that the script below overides proxysettings, and i made a
do-it-yourself facility:
dowload and edit the script so that it points to your proxy.
this way your browser must use the proxy, if not, i start eating my shoes...
but this off couse is not a sollution but it may help...

--
__________________________________________________
Stop those lagging advertisements and spies, they're slowing up your
internet!
Use this simple ProxyAutoConfig script:
http://nina.xs4all.nl/pac/no-ads_no-proxy.pac
ps;this overrides other proxysettings, you will be surfing without
one(direct).

A dutch howto and help is here:
http://nina.xs4all.nl/pac

For nerds:
I like the above pac-script extended !
How 'bout uploading me a beter one here:
http://nina.xs4all.nl/upnav.htm

Like all cool services at giel's, this is free and continues as long as it
does not constipates my connections.
"John" <blizzard1234@hotmail.com> wrote in message
news:85eepvodphtlqta5dhr1mmj811f9bo8om8@4ax.com...
> removed all adware/spyware/malware but still cannot change the Proxy
> Server under Tools - Internet Options - Connections - LAN setting to
> anything - it simply refuses to be reset
>
> any ideas would be greatly appreciated
>
>
> y On 20 Oct 2003 21:17:00 -0700, yosponge@yahoo.com (sponge) wrote:
>
> >3721 is a known parasite. Yes, you've been hijacked.
> >
> >The standard advice applies: run the "Big Three" -- Ad-Aware
> >(http://www.lavasoft.de), SpyBot (http://security.kolla.de), and
> >SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html).
> >Make sure to run their updaters and, for SpyBot, exit out and then
> >restart the program in order to have the most current updates. Do
> >yourself a favor against future and more serious incidents and use
> >either Mozilla or Firebird instead of IE.
> >
> >Sponge
> >Sponge's Secure Solutions
> >www.geocities.com/yosponge
> >My new email: yosponge2 et yahoo dot com
>

[Jay T. Blocksom]

On Wed, 22 Oct 2003 22:12:43 -0400, in <alt.privacy.spyware>, John
<blizzard1234@hotmail.com> wrote:
>
> removed all adware/spyware/malware but still cannot change the Proxy
> Server under Tools - Internet Options - Connections - LAN setting to
> anything - it simply refuses to be reset
>
> any ideas would be greatly appreciated
>
[snip]

<http://www.litepc.com/ieradicator.html>


--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[John]

here's my answer:
locate a file under winnt\system32\helper32.dll
stop this service from running - solved my problem


On Thu, 23 Oct 2003 17:16:43 -0400, Jay T. Blocksom
<not.deliverable+USENET@appropriate-tech.net> wrote:

>On Wed, 22 Oct 2003 22:12:43 -0400, in <alt.privacy.spyware>, John
><blizzard1234@hotmail.com> wrote:
> >
> > removed all adware/spyware/malware but still cannot change the Proxy
> > Server under Tools - Internet Options - Connections - LAN setting to
> > anything - it simply refuses to be reset
> >
> > any ideas would be greatly appreciated
> >
> [snip]
>
><http://www.litepc.com/ieradicator.html>