Auto Download, Possible?

[Untitled]

Ok, I was surfin' the web yesterday, lots of popups right, and there’s this one that says Auto Download or something, with a little blue status bar thingy. There was no prompt for me to download anything so I figured it was just an ad and closed the damn thing.

The next day I turn on my computer, get on the net, and all my settings are f'd! The back/forward, etc. buttons are all huge-a** format now; the search thing is open to some weird new search site, etc. I was pissed!

Next, I went to the C drive and noticed the bottom had a scrollbar, which only happens when there is something new in there and you/comp hasn't arranged the icons. So I look at what it is and there’s a file called sp.reg, registry file! I open it in notepad, and I find all the changes that were made in my ie, as well as one string that runs that damn sp.reg file every time you restart to re-screw-up your ie.

That damn popup ad downloaded something to my comp with out authorization, how the f*** did it do that?! Has anyone else had this happen? Any solutions so this doesn't happen again?!

Damn those advertising pirates!

- Aron m

[Jason]

use a popup blocker, or you can get mozilla which doesn't allow popups. Either way I haven't seen it before but I know its possible through javascripts...


Jason

[Untitled]

Thanx, but I have a popup blocker, and I don't use it, but that's not really a solution anyhow.

What if next time that crap isn't in a popup window!? Is there no way to stop it from invading my computer, again?!

[Jason]

if you allow javascript and you don't have a antivirus then no, Norton doesn't allow registry changes without your knowldege that I know of...especially significant one. You might try and run an internet antivirus to make sure you didn't catch something else....

Jason

[oracleguy]

Jason is correct about the anti-virus, it will probably catch that as malicious behavior and block it.

You should use a pop-up blocker, it will help cut down on junk like that. If you are using IE, the one built into the google toolbar is a pretty good one.

btw, there is no need for a poll.

[kwhubby]

Javascript doesnt have the power to do anything like that!, you must have somehow gotten that from accidentally downloading some kind of adware/spy ware program. I know there are a bunch of good free anti spyware/adware programs out there that might help you remove that

[nightguy]

Javascript can execute automatic downloading. Javascript will by-pass norton ONLY IF the user does not disable it. Javascript itselft cannot by itself initiate auto download. Using, web designers will have the javascript execute a JS file to execute a certain command.

[kwhubby]

well yes the download can be initiated, but the user must push yes. the user permision cant be avoided, unless the user is using some browser that has an unpatched glitch that can initiate that.

also to note... that auto download thing sounds like something some customized browsers for specific dialers have for upgrading clients, like aol: which I have seen auto download aol updates.

[Untitled]

Thanks everyone, but here is the thing, I have Norton Antivirus, I have script blocking enabled (and it is supposed to ask me what to do when suspicious scripts are found), I have IE6 and Windows ME! Nothing too crazy! Here are the file specs, in case you get it.


FILENAME: sp.reg

CODE: (I replaced the search url with google to get rid of that problem before I started fixing my registry. I didn't make a backup of the original, stupid me, so I don't know what was there to begin with. If you know, please post, I need to write them a nasty letter!)

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer]
"SearchURL"="http://www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]'
"Default_Search_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
"Search Bar"="http://www.google.com"
"SearchURL"="http://www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.google.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBarLayout"=hex:11,00,00,00,4c,00,00,00,00,00,00,00,30,00,00,00,1b,00,00,00,\
64,00,00,00,01,00,00,00,a0,06,00,00,e9,02,00,00,05,00,00,00,62,04,00,00,26,\
00,00,00,02,00,00,00,a1,06,00,00,f7,02,00,00,04,00,00,00,a1,00,00,00,11,03,\
00,00,03,00,00,00,a9,02,00,00,0b,03,00,00,00,00,00,00,00,00,00,00,00,00,00,\

<< all zero's here >>

00,00,00,00,00,00,00,00,00,00,00,00,01,24,d0,30,81,6a,d0,11,82,74,00,c0,4f,\
d5,ae,38,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

SIZE: 2,456 bytes


And yes, I realize some of you are sceptical of this, I would've been one of you myself, had this not happened to me. I didn't think this was possible and yet, it must be! Oh, and no, I don't have a virus, and no, no one else used my pc, and no, it wasn't magic elves either! If you don't care, that's fine, but be warned.

[cg9com]

Originally posted by oracleguy
If you are using IE, the one built into the google toolbar is a pretty good one.
I find that it doesn't block everything, I still get popups.
Firebird's popup blocker however works like a charm, and has the google search integrated into it anyway.

[kwhubby]

a popup blocker, nor anti virus program wont do anything to protect you from somethign like this... it sounds like something spyware/adware did.... by chagning you search settings and stuff, without you wanting it too... ive seen adware/spyware do that alot.... ... have u checked what startup programs you have (use msconfig), and wahts in your installed programs, to find anything that looks somewhat suspicious (things like date and time manager, save, gator, WurldMedia, BonziBuddy, Xupeter, DownloadWare, etc.)... as I said earlier there are many free spyware removal tools.:: heres one that works pretty well:http://www.safer-networking.org/index.php?lang=en&page=start

ps. there are infact some glitches IE did have that allowed websites to run code/ download files on a system without prompt, but if you have downloaded windows updates, and are running a currect version of IE, you should be fine.