hey myron,
as i told you i would, i posted of your prob on a netscape communicator newsgroup. i just checked back in and see that there's a response. i will print it here in it's entirety. there is a portion that i think you could try and maybe eradicate this unwanted porno site. i will highlight the text in bold type. here goes:
___________________
"Subject:
Re: porno on 'my netscape'
Date:
Fri, 31 Dec 1999 23:34:26 -0500
From:
Kevin Hecht <khecht19@idt.net>
Organization:
Villanova University
Newsgroups:
netscape.communicator
References:
1
mark wrote:
>
> i am trying to help a friend who says he encounters a porno site when he
> clicks on the 'my netscape' icon. he has young children and obviously
> wants this to go away.
>
> i have tried all sorts of suggestions, ranging from deleting his
> cookies, to changing what url he uses for his netscape home page. i
> don't think there is anything he can change in the 'my netscape'
> preferences. member services doesn't seem to have any way to help
> either.
>
> should he just create a new communicator profile? that seems like
> giving in. but i don't know how to help him. any ideas?
>
> :)
>
> mark
There have been a number of entertaining little programs recently that
do things like this to browsers. See if the below dialog sheds any light
on the matter.
--
Kevin Hecht, Netscape Champion
College of Commerce and Finance, Villanova University
khecht19@idt.net Kevin.Hecht@villanova.edu
idt.net
-------------------
Date: Thu, 02 Dec 1999 23:21:43 -0500
From: Kevin Hecht <khecht19@idt.net>
Organization: Villanova University
Newsgroups: netscape.navigator
Subject: Re: Mail folders disappearing, porn sites in Netscape
Jamie Moloney wrote:
>
> I have a client who is suddenly (since Thanksgiving) having problems
> with her Netscape Mail using Netscape Navigator 4.5 on a Windows 98 (not
> 2nd edition) Compaq computer. She went into her mail, and her personal
> folders were gone. Some of her inbox messages were there, some were
> not.
>
> Yesterday I went over to help her, and I found more mail messages in a
> "mail" and "mail2" folder, but only inbox messages - all her personal
> folders were gone, her personal addresses were gone, and her bookmarks
> were gone. It's odd because one day 2 new messages were in her inbox,
> no old ones. The next day, 6 new e-mail messages, the 2 previous were
> gone, and no old ones. The third day, some of her old messages were
> there, and she didn't have any new messages.
>
> I then deleted Netscape from her computer, and re-installed 4.5 from her
> CD.
>
> Now today, she was on Netscape's site ready to select Lycos to do a
> search when suddenly her browser took off, taking her from one
> pornographic site to another. When she tried to do CTRL-ALT-DELETE, the
> program in use said "slutfest.exe".
>
> I had her reboot the computer, and now when she tries to use Netscape
> she gets an error message saying she is not authorized to view the
> selected site and she is unable to use her browser at all!
>
> I am having her call tech support, I went to both Netscape's site and
> McAfee's site looking for any known viruses that can cause this.
>
> If any of you have had any experience with either of these issues (I am
> assuming they are related, but they might not be) using Netscape, please
> let me know!!!
>
> Thanks for any help you can give-
> Jamie.
slutfest.exe is probably something similar to the freesex.exe listed
below that cropped up about a year ago. Without a copy, I can't say what
the one she has does to the browser, but this freesex.exe wasn't really
a true virus, since it was really something intended to "enhance" the
browser - for those frequenting porn sites, that is. It is highly likely
that this is something that she or some other user of the system
downloaded and executed, perhaps thinking it was something else or
harmless.
Try the repair procedure below. I think you're looking at a different
situation, but the same fix may be applicable.
--
Kevin Hecht, Netscape Champion
College of Commerce and Finance, Villanova University
khecht19@idt.net Kevin.Hecht@villanova.edu
idt.net
-----------
From: Kevin Hecht <khecht19@idt.net>
Newsgroups: netscape.navigator
Subject: Re: changing My Netscape button
Date: Thu, 05 Nov 1998 19:54:54 -0500
Organization: Villanova University
Message-ID: <364248DE.8ADCA164@idt.net>
Gerard J Verrett wrote:
>
> ALL OF THE BOOKMARKS SEND YOU TO THE SITE: www.rbabenet.com/ but that's not
> the address once you get there. I also have never been to the sight that the
> bookmarks are set to. So I don't know where they REALLY came from. It Also set
> the search button to go to a site called www. gohip.com/hipsearch (it says
> searching for www.rbabenet.com while it is loading though. I did find
> something on my computer that I did not know what it was and clicked it
> (called freesex) and clicked it. nothing happened but later noticed these
> button changes. I am attaching the freesex app that I clicked.
>
> Kevin Hecht wrote:
>
> > Gerard J Verrett wrote:
> > >
> > > After visiting a web site it added bookmarks to my book mark folder,
> > > changed my home page, and changed the "My Netscape" button.
> >
> > Which web site did this, and were you warned?
> >
> > > I fixed all
> > > of the stuff it changed except for the "My Netscape button". I can't
> > > find where I can change it back to netscape instead of the web site that
> > > I visited that changed it in the first place. Please help!
> >
> > It's not a user-configurable setting, though if we know what site did
> > it, we might be able to figure what they did so it can be undone.
> > --
> > Kevin Hecht, Netscape Champion
> > College of Commerce and Finance, Villanova University
> > khecht19@idt.net khecht@email.villanova.edu
> > idt.net
>
> ------------------------------------------------------------------------
> Name: freesex.exe
> freesex.exe Type: unspecified type (application/octet-stream)
> Encoding: base64
This 'freesex.exe' is your problem. I didn't run it on my system, but I
did look at it with a hex editor, and it claims to be a "browser
enhancement". It does not appear to contain any viruses. It appears to
rather extensively patch both Netscape and IE plus registry settings and
bookmarks redirecting you to their site, r.babenet.com
To fix it, open the bookmarks file (press CTRL-B) and delete all
references it may have created. Next, exit Communicator and open Windows
Explorer, then go to your ...\Netscape\Users\{username}\ directory.
Rename prefs.js to prefs.bad, then restart Netscape. ** Note that this
renaming will require you to reset most of your preferences in
Communicator, but should get rid of most if not all of the changes made.
If the browser is still not back to normal after this procedure, such as
if the My Netscape button still points to the r.babenet.com URL,
reinstall Communicator.
I strongly recommend deleting freesex.exe from your system.
(For those interested in the changes this thing makes, open it in a hex
editor and have a good look, especially between offsets
00007A6C-0000858E.)
--
Kevin Hecht, Netscape Champion
College of Commerce and Finance, Villanova University
khecht19@idt.net khecht@email.villanova.edu
idt.net "
_____________________
it does appear that this is probably a redirect program. you should check to see if you have freesex.exe on your hard drive. you never know, you may have it there. or something similar. if you provide feedback, i'll shuttle it to the guy who is helping. unless you got into newsgroups yourself.
:)
mark |
