Root Access

there are MANY alternatives -- it really doesn't matter what you use

but you never answered my first question

is it opening it up in your existing browser window (if so, which browser?) or is it spawning a separate window?

1:17 AM

@allquixotic it's more typical that they just launch a URL (shellexecute, which opens in the browser)

its open in the existing broweser

I adds new tabs

@JebediahKerman which browser does it open in? and is this your default web browser?

chrome

I had chomre o[pen at the time

hm

@Bob does event viewer have any kind of shellexecute log? that'd be nice

1:20 AM

also a new window pops up with this

@JebediahKerman sounds like it's trying to run malicious javascript (or just a lot of javascript) and failing ... not very surprising that it's failing

Q: Monitoring certain system calls done by a process in Windows

@allquixotic not that I know of

but there are third party programs

rohitab.com/apimonitor

jacquelin.potier.free.fr/winapioverride32

17

I would like to be able to monitor certain system calls made by a process, primarily file I/O calls. On Linux I can probably get away using strace with suitable parameters, but how can I do this on Windows? I'm primarily interested in running a process and figuring out which files it has read an...

speaking of third party programs, you could probably use process monitor or process explorer (I always forget which does which)

this is all assuming you have malware as a separate program

if it's a browser extension or something...

oh, don't forget to check what you have running at startup

technet.microsoft.com/en-us/sysinternals/bb896645

1:22 AM

anything you installed recently?

@Bob speaking of that, he could check his chrome extensions

@allquixotic they don't seem to trace arbitrary win32 api calls

me?

@JebediahKerman yes you

if the malware is intentionally self-limiting in just how mal it is, simply removing the chrome extension might do the trick

1:23 AM

I only have 3 extensions

@allquixotic a lot of malware just goes for the lowest hanging fruit

@Bob yeah, exactly

it isn't going to try and rootkit you

Adblock
Ghostery
Magic Actions for YouTube

@allquixotic (usually)

this only started last week or so

did not install nothing untrusted recently

1:24 AM

@JebediahKerman try disabling them temporarily - one might have updated silently at some point

@JebediahKerman so what .exe file did you download and run in the last week or so? :)

@JebediahKerman did you install anything at all? trusted or not

yes

one sec

nothing I do not trust as you can see

never heard of tune-up utilities, but apparently AVG, so, meh

even did a AV scan of everything, nothing popped up

could It be another site opening the tabs?

1:27 AM

@JebediahKerman how 'bout trying malwarebytes? it's one of the more effective on-demand (i.e. not real-time) scanners

@JebediahKerman if you have popup blocking engaged (and not allowed for a site that's creating popups), it is definitely not another site opening the tabs

@JebediahKerman there is some possibility

I hear malwarebytes is shit. appearnlty its a virus itself? idk

another thing you could do - when one of those tabs open, fire up the debugger (F12) and type in window.parent.location in the console

@JebediahKerman: Untrue

its effective enough some viruses try to block it

1:29 AM

@Bob good idea

@JebediahKerman where on earth did you hear that?

ekaj

but he has that windows virus.. I heard it's a nasty rootkit

the problem is there are lots and lots of ways that this behavior could be happening so we have to narrow it down some

malwarebytes will help

as far as on-demand scanners go, it's the first port of call in a lot of guides, forums, tech communities, etc.

@JebediahKerman: I'd also try opening chrome incognito

1:30 AM

not entirely sure what gave you the impression that it was malware :\

if it still happens, it may not be an addon

wait

let me try that f12 now

for f12

than where do I type window.parent?

@JebediahKerman select console in the tabs up the top

and type window.parent.location

you can add a .toString() to the end, probably easier to read

it returns this

reader24h.com/architecture-hide/…

hm..

1:34 AM

also that out of memory on line 1 windows pops up agian after I hit okay for about 20-50 times

@JebediahKerman that's the same as the current address, yea?

is it a virus?

@Bob yes they are the same

I still have that message from Page pop up open

Google update is using 1.5gb of ram

wtf

@JebediahKerman that's... not weird at all

yes it is

nope...

1:37 AM

its normally not even on the top part of the list

when he's doing stuff... yes it is

probably decompressing a uncompressed 7z file

hmm

still somethings wrong

also look at this

any use in that???

@allquixotic wait, the window.parent thing doesn't help - it would be window.opener for popups, and it doesn't work across domains anyway

XSS protection has been more a hindrance than a help to me :P

I got UIspy now

@Braiam ...1.5 GB is still, uh, rather a lot

the entirety of a Chrome update seems to be about 100 MB uncompressed (which is still bloody large)

1:42 AM

@Bob there was a build in canary channel that used trice that amount... ASYSan or something... they bloat it on prupose

How do i figure out which process is hosting it?

as soon I i typed my last message

@Braiam that's the updater, not the browser itself

I wouldn't bat an eye at a browser taking 1.5 GB

though, that's total - a single Chrome process taking that much would be slightly unusual

@allquixotic how do I figure out which process is hosting it?

Q: What Easter Eggs do the chat sites have?

36

According to balpha, the SE chat sites may have individual Easter eggs, depending on the site. If you find them, please post. Edit: Because it's so easy to make this stuff up, a screenshot as proof would be nice. (Although Photoshop ain't that hard either...)

discussion chat hidden-features

@JebediahKerman I think @allquixotic suggested that one under the assumption that those were not opening in the browser

1:44 AM

okay bob thanks

How often do you think this happens?

is it consistent?

does it happen while the browser is closed?

once a day

...

well.

@Bob hard to say, browser i almost always open

what I can suggest now is to set another browser (Firefox, IE) as the default for now

and see if it opens in the new default, or in Chrome

1:46 AM

hmm

I will do that starting tomorrow

that will narrow it down to either a W32 ShellExecute or a Chrome extension/currently open tab, hopefully

I re-installed chrome btw yesterday and it still happnes

I'm leaning towards a ShellExecute

you can also grab that API Monitor

<(?:"[^"]*"['"]*|'[^']*'['"]*|[^'">])+>

and when it happens, look at the last ShellExecute or ShellExecuteEx.

1:47 AM

or if you really want to be meticulous...

I get some many message saying out of memory on line 1

go into task manager and look through every single running exe and select "open file location" and see if you trust it

and do the same for the running services

@JebediahKerman that's a script running on the site

we're trying to figure out what's opening that site

at this point, I couldn't care less what the site is or doing, as long as you close it

I closed all the sites

the pop-ups are still coming

it's possible there's another malicious script on the site, but that's immaterial if you have something on your computer already

@JebediahKerman end all Chrome related processes

1:49 AM

this on too?

hmm

Should probably call a priest.

brb moving to FF

check your chrome shortcut.

if the popups still come after that...

1:50 AM

some malware just changes that

then they're not actually from the browser

I'd still recommend you give MalwareBytes and/or Spybot S&D a shot.

They're fairly effective as on-demand scan and removal tools.

Not so much as realtime scanners, but meh.

looks like firefox also got some shit

new homepage is this

websearch.searchguru.info/?pid=34&r=2013/12/…

this pops up

Obviously they want your WoW account.

@JebediahKerman seriously, just grab a malware scanner or nuke it from orbit

Anonymous

^

1:53 AM

you have far more than the single problem at this point

Anonymous

this is the easy kind of malware ffs

also this is new

another one

jdm.findfor.net/sd/…

@Bob okay

what scanner should I use?

malwarebytes.org

that one ^^?

and how do I nuke it?

Yes.

@JebediahKerman That's usually my first recommendation, yes.

Install and full scan.

1:55 AM

@JebediahKerman nuke from orbit == reformat, reinstall, rebuild from backup

I do not use backups

probably not something you want to do, but it's actually the only truly safe way (if you're slightly paranoid)

imma uninstalled all cracked software I have now

@JebediahKerman That would be your own fault/problem, then. Now would be a good time to start. Well, after sorting this.

@JebediahKerman ...that may or may not help anything in this particular situation, just sayin'

Here's the thing - you got a relatively benign adware type this time. At least, on the surface - there may be more crap hidden.

where can I download malwarzesbytez?

I keep on gettings some spam exe

1:57 AM

There's other malware that will go and encrypt your data, holding it hostage until you pay them.

hmm

In those cases, backups are all you can do.

@JebediahKerman downloads.malwarebytes.org/mbam-download-exe.php

also I got norton

norton has this

I might run that

...good lord

as a (former, thankfully) user of norton products...

@Bob Trollmuch?

1:59 AM

yea, running that, especially without a backup... probably isn't a great idea

@MichaelFrank ?

why it says the actions can be undone?

Anonymous

lol norton

@JebediahKerman What says what now?

@Bob Seems like you're all being trolled.

malwarebytesz just blocked an attack apperantly

2:04 AM

@MichaelFrank yea, whatever

having a slow day here anyway

thats the result of a quick scan

Ouch, infected PyInstaller? Where did you get that?

a link on SO

I found this in a log file

2014/01/12 21:02:33 -0500 JAN-HP Jan IP-BLOCK 50.62.128.121 (Type: outgoing, Port: 50960, Process: googleupdate.exe)

just again

is google chrome the virus?

or is it infedcted?

...that's a new one

I tired accessgin the ip in my browser, but I cannnot

2:11 AM

might explain the massive memory usage

@JebediahKerman well, MB did block it

just popped up again

hmm

whois.domaintools.com/50.62.128.121

 ads789.com ptp22.com

yea, stinks of malware

777seo.com as well

support.clean-mx.de/clean-mx/…

new one

forums.malwarebytes.org/index.php?showtopic=134635

may or may not be rootkit related

at this point, nuke from orbit sounds good :P

you could try a system restore to, say, two weeks ago

that sometimes works

2:14 AM

162.210.192.22

depends if the malware has decided to modify the shadow copies as well

193.169.104.1

those just popped up as well

@JebediahKerman ...I think we get the point

more popped up btw

so

what are my options

re-install should be a last ditch effort

looks like firefox is also getting blocked

@JebediahKerman see above.

I'm going to lunch.

2:17 AM

k

If you want more step-by-step kind of removal instructions, log analysis, whatever, try posting on the malwarebytes or bleepingcomputer forums

^

okay thanks Bob

i gtg as well

this one seems related: forums.malwarebytes.org/index.php?showtopic=107985

I will be back in 12hrs

2:18 AM

but with stuff like hijackthis, you really want to know what you're doing

or post the logs for others to look through

but we don't really have anyone in here who can do that, AFAIK

reinstall looks like a good optiton now

so those forums are your best bet

ja

bye

thanks for the help

Good Luck.

what he said :P

Q: Need to create an antivirus application for mobile

2:41 AM

-3

I need to create an antivirus android application which should be able to scan and identify malwares, trojans and other unwanted files.Is there any method in Java/C# or Android that would help me do this? Please advice.I don't want to create that fake notepad antivirus though. (Please don't put t...

c# java android antivirus utility

Please don't put on -Too late!

3:10 AM

Emergency software development? OH NO. MY PHONE HAS BEEN COMPROMISED BY A ROGUE AI! I NEED TO WRITE AN AV APPLICATION NOW SO THAT I CAN SAVE THE WORLD! YOU FOOLS. YOU HAVE DOOMED US ALL BY DENYING ME THE ABILITY TO ASK QUESTIONS!

2

3:21 AM

@MichaelFrank yet another guy suggesting SU when it's way off topic -_-

@JourneymanGeek Quink changed their packaging :(

went from that nice little cardboard box to some plastic monstrosity

for the bottles?

@JourneymanGeek ya

ahh ;p

I have enough HOD for quite a while :)

@JourneymanGeek I still need to find some way to get my hands on some :P

3:43 AM

@Bob: heh, I'll probably mail you a bottle when things get less crazy.

between school, family drama, and other stuff I'm just too worn out for anything :/

3:54 AM

@JourneymanGeek wouldn't want to trouble you like that, but thanks for the offer

it'd probably be cheaper for me to ask one of the local stores to import some, anyway... shipping a bottle full of ink is surprisingly heavy => expensive :P

4:44 AM

you guys are freaks... manual assembly of pens?! wat

@Bob: or load up an international cart with it ;p

@allquixotic: not yet, no ;p

I might try building my own if I get a lathe ;p

ChatBot John Cavil

@allquixotic Command suatmm learned

Gowtham

!! suatmm

ChatBot John Cavil

dear Revolution @ Broken Sword 5

!!suatmm

ChatBot John Cavil

4:47 AM

A: How do I split a string??? Help plz? (code trolling)

5:14 AM

oh wow

14

C My homework assignment is take a string and split it into pieces at every new line. I have no idea what to do! Please help! Tricky problem for a beginning C programming class! First you have to understand a few basics about this complicated subject. A string is a sequence made up of onl...

That is brilliant

hehehe

Every VB introduction should be firmly founded in a solid understanding of monads! — Christopher Creutzig Dec 28 '13 at 20:22

@JimmyHoffa ^ :)

ugh. My school

"t3 final exam results"

whoot

will be released from 17th january onwards

damnit

lol

@JourneymanGeek bit late

when were the exams?

we got our results over a month ago

early december

Don't forget, they also have put off my graduation due to what I believe is a clerical error ;p

ah

that was a bit later then

@JourneymanGeek o.O

@Bob: I could pick an elective when I started, they changed the course structure to remove the elective I think

so they told me I hadn't completed all necessary modules when I clearly had.

ekaj

5:41 AM

cheater[

7:03 AM

picked up a gig-e/power line networking switch for my desk

7:16 AM

need to reorganise stuff here tho, I'm a little short of sockets near my desk

and someone left an old desktop at the void deck ;p

seems to be in decent shape, DIY athelon XP box by the look of things

hm, 2003ish era if the label is right, so probably a museium piece ;p

KJ4IPS

7:34 AM

/part

Arrgggghhh...

This isn't irc ;p