An irritating invasion!

Vivaldi · 2002/07/05

Before puchasing Zonealarm Pro. I was invaded by an irritating program which changed my desktop settings, and home page etc. Although I reversed all these irritations, everytime I have a problem connecting to a webpage the original invader (Lop.com) pops up again. Taking over my page!! I have no idea how to go about tracking down this invader within my system and irradicating it permanently, can anyone out there help me?? I'm a real beginner when it comes to computing, which is how I got caught out in the first place, so plain language, would be an asset.

Daizy · 2002/07/05

Hi Vivaldi
Welcome to the boards.
Yep...we can help you. You've got to download and run Ad-aware. It'll clear up dear old Lop.com for you.

Daizy

Vivaldi · 2002/07/05

Thank you Daisy, you're a star!!

Daizy · 2002/07/05

You're most welcome Vivaldi!
Post back and let us know how it goes for you?

Daizy

Welshjim · 2002/07/05

Vivaldi--If you need more info go here
http://www.spywareinfo.com/hijacked.html
(See Related Articles at bottom of the page for specifics on lop.com which leads to page 2 on uninstalling lop.com
http://www.spywareinfo.com/lopgone.html )
It suggests you may need to do more than use Ad-Aware. I never had lop.com (thank heaven) so cannot comment.

Vivaldi · 2002/07/05

Thank you Welshjim, but Daizy's information has done the trick. My interloper is no more!! And I am a very grateful demented computer user!!

Welshjim · 2002/07/05

Daizy--Good job!!!

Daizy · 2002/07/05

Well thank you Welshjim
And you had two fabulous links that I've now bookmarked...thank you! I bet I've answered this dang Lop.com one a dozen times now. Those links will come in handy I'm sure. Thank you again.

Daizy

Alice · 2002/07/06

Jim,

I looked over the link you gave. Just yesterday I noticed that free.aol.com was in my IE trusted zone and I removed it (I installed NetScape 4.79 on May22, which included AOL Instant Messenger).

http://www.spywareinfo.com/hijacked.html
AOL has started doing something similar recently by placing it's web site free.aol.com in IE's trusted sites security zone, thereby bypassing the most frequently used security settings. This occurs after installing their AOL software, AOL Instant Messenger, Netscape 6.x, and even the latest ICQ2001b has reportedly done this.
Click to expand...

Welshjim · 2002/07/06

Alice and Daizy--Glad my post was of some help after all. You both have given me lots of good ideas in the past.

Alice · 2002/07/06

Jim,

I always find lots of good information in your posts.

I was still angry over Netscape/AIM changing my IE security settings so I did a groups.google search and found lots of complaints. This one suggested adding free.aol.com to your IE restricted sites zone, which I did:

From: Phil (sorry_I'm_not@home.now)
Subject: AOL IE settings concern
Newsgroups: comp.security.firewalls, alt.os.windows-xp, alt.os.windows.xp
Date: 2002-05-02 16:39:27 PST

*AIM USURPS IE SECURITY CONTROLS

By Shawna McAlearney
Calling a problem in AOL's Instant Messenger (AIM) an "issue of
critical importance to both home and business users," several security
experts have expressed concerns that some AIM installations can modify
users' Internet Explorer (IE) security settings.

These concerns stem from an AIM modification to IE security settings
that places https://free.aol.com in the Trusted Sites Zone, a security
setting in IE that grants user-defined trusted Web sites and intranets
special rights on a target computer.

"I think it's a high security risk," says Christian Piper, technical director of FuzzyGroove Media Network. "The whole idea of the Trusted Zone policy, according to Microsoft, was to give the user more control to either accept or deny the storing of sensitive information. The AIM installer just throws that whole concept out of the window. "

However, the situation appears to have taken on a new complexity,
according to Michael Damm, a freelance security expert and a network
administrator at Irwin Research & Development. He says that if a
typical user clicks one of the many "Free AOL and Unlimited Internet "
icons on their system, or one of the 5,800 links to this domain that
Google turns up, AOL can run the code of choice without prompting.

"This in itself is a large security hazard, allowing a Web site to run potentially malicious code without consent. I have also located two cross site scripting vulnerabilities in AOL's signup Web site that could be used by a malicious Web site to inject its own dangerous
JavaScript or ActiveX content," says Damm. "Since Internet Explorer
interprets this code as coming from free.aol.com and trusts it under
the security settings configured for that domain. "

Researchers say potentially malicious JavaScript and ActiveX controls
can be placed into this imbedded code and could lead to a compromise
if users click on links found on Web sites, inside e-mails, or from
chat and instant message conversations.

"By utilizing these methods in my research I was able to execute
programs both from a users local hard drive and downloaded automatically from the Internet without any prompts or warnings from Internet Explorer," says Damm.

"This is not an issue that can be directly dealt with by a vendor
patch, since it deals with the products installers and misconfigurations of AOL's Web servers," adds Damm. "All users should check their computers by opening Internet Explorer, clicking Tools, Internet Options, the Security tab, the Trusted Sites icon, the Sites
button, and removing https://free.aol.com, if it is listed. "

(Add it to your Restriced sites)

SECURITY WIRE DIGEST, VOL. 4, NO. 29, APRIL 15, 2002
Click to expand...

More here

BillyBob · 2002/07/06

I need ideas also.

I keep taking out the free. aol. com and the darm thing keeps coming back into the trusted sites.

Could it still be coming for ICQ. As that is when it appeared after I messed it up and had to re-install ICQ.

BillyBob

Alice · 2002/07/06

BB,

Did you add it to your Restriced sites after removing it from the trusted sites?

BillyBob · 2002/07/06

Did you add it to your Restriced sites after removing it from the trusted sites?

No, I had not done that but I did just before I Posted.

BillyBob

brett · 2002/07/06

Enough is Enough!

Alice · 2002/07/06

BB

Now that you added *.free.aol.com to your Restriced sites zone see if that keeps it from reappearing in the trusted sites. I'm going to keep an eye on my trusted sites from now on, especially after upgrading Netscape/AIM.

BillyBob · 2002/07/06

DARN !! Now I am confused.

As I stated in my previous reply I found the mention URL in the trusted sites, removed it and added it to Restricted sites.

I also went hunting thru the registry and found the AOL url in a couple of places there and deleted them.

Now the confusion starts.

Previous to the above I was having pointer hangups, system do nothing for a few seconds. Also the Taskbar ( or what ever it is called ) at the top of the screen would flicker.

After doing the above mentioned things and restarting Windows I have no more hangups or flickering.

Could that AOL thing have been trying to pull ( or actually doing ) a Phone Home deal on me ? I saw nothing in the NIS log that indicated it was.

Just maybe I learned something here. Just deleting the stupid Shortcut form the desktop ain't enough.

BillyBob

Alice · 2002/07/07

I also went hunting thru the registry and found the AOL url in a couple of places there and deleted them.
Click to expand...

Make sure you didn't delete the registry entry that you just created when you placed free.aol.com in the IE restricted sites zone! I had a key for
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\free.aol,com along with keys for all the other domains I've restricted.

PS I don't know about pointer hangups and flickering windows but maybe it was just a coincidence, or simply rebooting fixed it (some problems are fixed just by rebooting)

BillyBob · 2002/07/07

Thanks Alice.

I cleaned the reg first. But I did check the Restrickted sites and it is still there after restarting.

So far it has not come back in the Trusted Sites. I will need to check things out after I run ICQ again as I know for sure that that is how it got back on the machine.

Plus as usuall I made sure I had the latest backup of the Reg BEFORE editing.

Burned myself too many times to do otherwise

Coincidence; Could be. But previous rebooting ( for two days ) did nothing.

Strange things do happen with this here Micrisoft Windows and associated software. And sometimes it even fixes itself if we leave it alone.

BillyBob

Newt · 2002/07/07

Brett - nice one (Enough-is-Enough).

BillyBob - if you haven't already, you might want to take a look at that one. I liked the sound of it and plan to give it an install later.

Log in or Sign up

An irritating invasion!

Vivaldi Inactive Thread Starter

Daizy Inactive

Vivaldi Inactive Thread Starter

Daizy Inactive

Welshjim Inactive

Vivaldi Inactive Thread Starter

Welshjim Inactive

Daizy Inactive

Alice Banned

Welshjim Inactive

Alice Banned

BillyBob Inactive

Alice Banned

BillyBob Inactive

brett Inactive Alumni

Alice Banned

BillyBob Inactive

Alice Banned

BillyBob Inactive

Newt Inactive

Share This Page

Log in or Sign up

An irritating invasion!

Vivaldi Inactive Thread Starter

Daizy Inactive

Vivaldi Inactive Thread Starter

Daizy Inactive

Welshjim Inactive

Vivaldi Inactive Thread Starter

Welshjim Inactive

Daizy Inactive

Alice Banned

Welshjim Inactive

Alice Banned

BillyBob Inactive

Alice Banned

BillyBob Inactive

brett Inactive Alumni

Alice Banned

BillyBob Inactive

Alice Banned

BillyBob Inactive

Newt Inactive

Share This Page

Useful Searches