Ongoing problems since hijacked browser [Archive]

finchie

02-13-2005, 02:28 PM

Hi -

My browser was hijacked a few weeks ago while entering Statcounter. I posted the problem here and received very helpful advice on this forum and the situation was resolved. I appreciated your help so much!

Now I have a worse problem. Suddenly, since Feb 10th, my site on GeoCities has disappeared but visiting their FTP site reveals that all folders and html are there and everything appears as it always has on the FTP site. I don't know what the problem is ???!?? Their ads appear but no website?? My stats, of course, reveal no activity since Feb 9th. I am so upset and cannot think clearly about what may have happened.

May I ask you to visit the site and let me know what you think has happened? I have e-mailed geocities but have received no answer. I would appreciate your input so much!

http://www.geocities.com/perrykingnow/

Thank you in advance!

Gerri

webado

02-13-2005, 02:44 PM

Well, your index page is either not existent, or you have some .htaccess file in your folder which prevents display. To see if that is the case, use your FTP program and enable it to show hidden files.

Having that Geocities garbage advertising doesn't help at all. Their stuff modifies your page's code to favor showing their crap first fo all. if you have any scripting error on your page that conflicts with theirs, you may never know it.

Go into your site by FTP and rename your index page to index.txt and try to access it this way. This will bypass the adverts and we may be able to tell what is wrong.

finchie

02-13-2005, 04:39 PM

webado

02-13-2005, 05:30 PM

Hi, Chris -

Thanks so much for responding!

I will do what you have suggested. However, I use GeoCities FTP service so I am not sure I will be able to reveal any hidden files but I will try.

Thanks again.

Gerri
Well, then just rename the index file to .txt and try to access it.

Not sure how Geocities FTP service works. You might be able to access your space by using any other FTP program though, I don't see why not.

Peg-as-is

02-13-2005, 10:07 PM

I've accessed the first page and, as has been suggested, there's nothing there.

<html>
<head>
<meta NAME="generator" CONTENT="Web Studio, Version 2.0 for Windows">
<meta NAME="creation-date" CONTENT="Tue, 01 Feb, 2005 08:26:56 GMT">
<meta NAME="author" CONTENT="Finchie">
<meta NAME="keywords" CONTENT="Perry King, actor, biography, Hollywood, Olive Crest Homes, The Discontents, Riptide television show">
<title>Perry King</title>
<style TYPE="text/css">

</STYLE>

If you've got a back up copy of the page, you'll need to insert that and the noticed of "Remove the code" is actually one of three. You'll need to go in and tidy that up, too.

Wish I could be more help.

Peg[/code]

webado

02-13-2005, 10:41 PM

What you're seeing is what the server serves after Goecities adds its ads. If there's any scripting error it can easily cut off all other information from being displayed.

finchie

02-14-2005, 09:32 PM

Well -

I am stumped. I went into Geo Cities FTP and everything is there just as always. The index.html and each page .html are marked with little check boxes and are separate from each page folder.

The folders only hold the graphic elements of each page - not the .html code.

Nothing extra has been added that I can detect. Everything is as always.

I re-loaded the .html. But nothing has changed. I just see the blank white page.

One thing has occurred to me. Since my browser hijack a few weeks ago, a pop-up ad (separate/different from the GeoCities ad strip) has been occuring. I have just been closing it.

Do you think my page may have been banned because of the extra ad and they aren't notifying me?

Also, I had started deleting all cookies from my computer after the hijack. Could I have been banned because of it?

But everything had been working fine for 6 weeks since the above until the 10th which makes me doubt I was suddenly banned.

Gerri

webado

02-14-2005, 11:22 PM

Well, if it were related to your browser hijack, then it would be only who'd not be able to see your page. But I cannot see it either.

Did you rename it as I advised you to index.txt ? You didn't, obviously, because I tried it and it's not there.

Please do so and then we can all look and see what's bugging it.

Also try to enable viewing hidden files in your folder there and see if there's an .htaccess file. If you find one, download it (as text or ASCII) and let's see what contents it has.

finchie

02-16-2005, 12:07 PM

Hi, Chris -

I appreciate help SO much!

You can see my files now. I have re-named my index.html to index.txt. You're right the page does show but the home page link does not work. It just reveals the blank white page.

This is very weird as everything was working perfectly until Feb 10th. I had updated some pages on Feb 1st.

Hey, guys, please don't copy & post all the contents here. I'm very nervous about the files being exposed this way!

http://www.geocities.com/perrykingnow/

Chris, I still haven't figured out how to reveal hidden files. I tried my old copy of the free WS-FTP but it didn't work. GeoCities doesn't allow external FTP for their free pages. But I'll see if I can figure out another way to get in with it.

I am not a computer geek and am really confused about what has gone wrong.

Thank you so, so much again!

Gerri

webado

02-16-2005, 03:27 PM

OK, it is Geocities messing up your site. None of the html files are rendered at all.

Get a different hosting package. If you want to continue with free hosting, I can recommend www.netfirms.com . They too add some advertising in a banner across the top of the page but I think it's less disruptive than Geocities.

And then again, there is a lot of very affordable hosting available, some even with full service. Shameless plug here, you're welcome to check out what I can offer at www.webado.net .

You would also benefit a lot from getting an actual domain name.

finchie

02-16-2005, 08:15 PM

Chris -

Thank you SO much for clearing up my confusion!

I had many problems following my browser hijack which I think have been cleared up. But from what I have read on the multitude of malware help sites, one often can't be completely certain. Also with all the antispyware programs I am using now with their blocking devices, I suspect I have violated some GeoCities rule. Daily deleting all of my cookies may well have been the the big one! I never had a problem with GeoCities for 5 years before this. And I have been unable to find a way to contact them. There is no support for free sites that I can discover except for member forums which are a joke. But until this unhappy occurance I had been very happy with them.

Thanks so much for your suggestions regarding new host providers. I visited both the sites you recommended and will seriously consider my next move. Your site is great! I am thinking about it.

I am also interested in NetFirms because they offer free hosting. Since my site is a hobby and not a business, the free bit attracts me. But do you know if one can use their own software and FTP to their site - or must one use their NetObjects? It isn't clear on the website.

Regarding your host program - I use Web Studio webpage builder which has its own internal uploader. Will your site accept this type of upload or must one something like WS-FTP (which I've never done)???

You've been so generous with your help and support! I just can't thank you enough!

Gerri

webado

02-16-2005, 09:29 PM

I have used Netfirms and you can build your site in any which way you wish and then upload it. They give you an FTP account you can access using an FTP program or maybe Frontpage and other similar web publishing programs. Never tried this actually, always used my old trusted ws_ftp program. Media files are limited there however (such as audio or video). Nothing bigger than 250k may be accessed so if you need that, then you're out of luck with Netfirms. I'm not even sure what the NetObject thing is. I think it's for their paid hosting, not the free one. I should pay them a visit again I guess.

As for my hosting, I have the possibility to enable FrontPage extensions. I dont know if those are the same thing that your web publishing program needs. I would have to look into it, as nobody's used that so far.

FTP programs are very easy to use, nothing to it. I have tutorials on at least one of them.

You can also opt to just treat your entire hosetd web site as a big FTP folder in Explorer and work directly (i.e. copy, delete, rename) with the files as if it were an extension to your own pc. You simply copy a file as you would in Windows Explorer. Of course there is a sign in step involved, so it is secure.

--- later ---
OK, at Netfirms you have to use either just an FTP program, or their File Manager interface. netObjects is for the paid up accounts.

finchie

02-16-2005, 11:14 PM

Oh, my gosh -

Chris, you are such a wonderful ongoing help. I can't thank you enough!

I did get into a GeoCities Users forum and one person has suggested I delete my entire website and then sign up for a new one. He said that solved his problems.

But right at this minute I am not sure what I am going to do. My brain is exhausted from all the computer/Internet problems of the past 2 months! Think I'll sleep on it for a few days before deciding. Actually, I'm wondering if I even want to continue on the Internet since it's turning into such a nasty place? But I'm not going to make a hasty decision. Maybe things will look better in a day or two! I did love doing that page!

Thanks for clearing up my questions regarding your website hosting suggestions. NetFirms could be a problem since my graphics are photos and often larger than 250 k in Photoshop. In every other way, my website is a very simple, uncomplicated one. I've saved your info.

Thanks again for everything!

Gerri

webado

02-16-2005, 11:41 PM

No, it's not image files that Netforms has a restriction on size for. It's audio and video files, if you wish to have them played on the web. Just storing them is not a problem.

Naturally there's the overall size of the site and the bandwidth question. I suspect Geocities has limits on those as well.

finchie

02-17-2005, 04:12 PM

Oh, my gosh, I think I found the problem - but I don't know what to do about it?

I was inspired to click on Windows USER.DAT last night while checking out my directory to make sure no new weird files have appeared. I found a line in my registry called URL history that has been there for who knows how long. I won't write all the info but, in short:

URL_1http://My ISP shown as a www.its name
URL_2http://My GeoCities website address
URL_3-10 http://each one either an advertising site or a website I have visited. Some of listings include TARGET_about
Followed by a paragraph of code in language I don't understand listing months as items (Item1=Jan, Item2=Feb,) etc

Following this "URL history" is code in an unknow language which includes words such as: Trimestre (sense espai), Zkretsky dnr, Kv.bez mezer, kvarta, Monate(Abkurzungen), Meser abreviados. These are followed by "Items" (1,2,3 etc)

I also found code in the same language earlier in the registry, none of which I could understand. The word ECHAVOY appears often.

Is my computer being used to send out info to unsuspecting users or does this just affect my computer?

What should I do about it? I have never worked with the registry but am willing to try it.

E-gads! I am sorry to be such a bother but am so unnerved by this discovery!

Thank you once again!

Gerri

finchie

02-17-2005, 04:24 PM

The URL1-10 actually appear in one long string like a very long web address - not one under the other.

Gerri

robinev

02-17-2005, 04:32 PM

If you're using IE, select "internet options" from the Tools menu. On the "General" tab look for the "History" options. Select the "Clear history" option to remove all the history items.

You might also consider downloading the free AntiSpyware (http://www.microsoft.com/athome/security/spyware/software/default.mspx) program from Microsoft. Not only will it delete most of the nastier spyware bits from your computer, but it also includes under its "Advanced tools" options a number of nifty utilities. For example, the "Erase tracks" tool lets you remove the registry histories kept by a wide array of programs. It also provides a simple way to view and/or update your hosts file which is used for bad purposes by some spyware or viruses.

There are other options as well... It doesn't hurt to run scans from various different vendors since each of them considers slightly different things to be bad.

webado

02-17-2005, 05:18 PM

Gerri, this is a sorry state of affairs, to be sure, but one you will eventually bring under control with all the various tools. You can clean up viruses and spyware, but it will take some time and effort and probably a lot of cussing.

None of this explains the problem you're facing with your Geocities hosted web site. As I said, I get blank pages from there (except for the Geocities garbage ads). Yet, as you found, by simply renaming the html files to .txt is turns out everything is perfectly available.

Geocities for whatever reason has chosen to effectively block your pages from being rendered.

I hope you have your original pages on your computer. You can have an entire site with pages all named as .txt, as long as you modify the links to reflect this as well. This will also bypass all of Geocities "added-value" crap, fooling it in effect so it won't add the scripts with the advertising.

It's not a really a long term solution, of course, it's just a trick, but it is one way to bypass the Geocities nonsense until you solve the problem with them or you acquire new, more decent hosting.

finchie

02-17-2005, 11:38 PM

Hi, Chris,

Thanks for the suggestions. I appreciate them!

Robinev - Thanks for suggesting the new Microsoft Antispyware. I will try it.

I am running Spybot Search & Destroy, Adaware, Spy Guard, Spyblaster, and Regblock, and have used Hijack This. Besides my own antivirus, I've run Panda Active Scan, RavOnline Scan, and Housecall. I look for updates at least weekly and run the anispyware scans daily.

Just goes to show what an ugly mess the Internet is in! So, if you have an ongoing problem, click on "USER.DAT" in Windows directory and read it all the way to bottom. You might discover a similar surprise.

Thanks, again for all of your everybody.

Gerri