Netscape plays drums on arbitrary web pages (spyware? trojan? virus?)

[Orak Listalavostok]

For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak

 

[FromTheRafters]

For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak

Sounds like adware to me (although it is not something I have
any specific knowledge about). Have you tried Ad-Aware
and Spybot Search and Destroy yet?

 

[sh4d03]

There is a Netscape feature (which most browsers now use) which enables
you to type text to find within a web-site. I'm a user of Firfox myself
and I know it makes a percussive/drum sound if I use this feature - i.e.
every character I input there is a drum sound. Is this perhaps what is
happening for you?
sh4d03

 

[Tim Smith]

....
Sounds like adware to me (although it is not something I have
any specific knowledge about). Have you tried Ad-Aware
and Spybot Search and Destroy yet?

That would be a pretty strange ad...what would they be advertising?

 

[default]

That would be a pretty strange ad...what would they be advertising?

Slinglerland?

 

[Orak Listalavostok]

and I know it makes a percussive/drum sound if I use this feature - i.e.
every character I input there is a drum sound. Is this perhaps what is
happening for you?

Thanks guys for your help so far.

I guess I got my main answer, which is this is NOT a common thing to
occur to any of you. It's seemingly a trojan program of some sort,
albeit a strange one at that. It's almost certainly a malware
program that wormed its way onto my disk & avoids McAfee.

This malware program doesn't play a drum "sound", it plays an
entire "dum da da dum dum" song for about twenty seconds,
seemingly arbitrarily on web pages which I KNOW are not causing
it per se as they are quite 'normal' pages like google & the
like.

The malware activation is reproducable in that it WILL happen
during any given browser session and in that any particular page
which causes the drums to play will play them again during that
session upon a browser reload. Also, it's always the same
twenty-second song that the drums play. But, it's not reproducable
in that, in another session, it won't have the same pages play
that same song. So it's not in the home page view source.

Since it's not in the browser "view source", do you guys have
any idea how I can debug the source of the drum song? When it
plays, for example, I have twenty seconds to DO SOMETHING to
debug.

But what?

How can I debug a trojan playing a song for twenty seconds
only when I am in a Netscape browser session on arbitrary pages?

Orak

 

[data64]

(e-mail address removed) (Orak Listalavostok) wrote in

How can I debug a trojan playing a song for twenty seconds
only when I am in a Netscape browser session on arbitrary pages?

Orak

Getting a list of processes running at the point would be useful. Also, have
you run HiJack This! ?

data64

 

[JM]

For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak

Someone else suggested using a program called Hijack This.
It is good.

My ideas :

Search your hard drive for midi files and play them all and
see which one sounds like the one you heard. mid extention

Also search for small wav files or small mp3 files.

Does this drumming happen with other browsers like Opera or
IE or Mozilla ?

You also might try an online virus checker called House Call
by Trend Micro. I have used them before, but it seems they
can only work with IE.

The VBS.Chick.E@mm worm does indeed play an embedded midi
file. But it doesn't mention Netscape or browser tabs.
I guess you could follow the removal instructions for the
heck of it, just to be sure.

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

JM

 

[JM]

For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak

Ohhh, here is another website to read over as it might apply
to this situation.

http://www.pcworld.com/howto/article/0,aid,112026,00.asp

ciao,

JM

 

[Orak Listalavostok]

have you run HiJack This! ?

I temporarily 'solved' the problem by locating the drum-playing
file (it was, interestingly, the first wav file, alphabetically,
in the Windows "My Music" folder) & then renaming that wav file.

The drums stopped playing in Netscape immediately.
However, I'm sure the malware program is still there.

I never even heard of "HiJack This!" before.
So, I summarize my research links so far in case you have this problem:
-----------------------------------------------------------------------
HijackThis:
http://www.webattack.com/download/dlhijackthis.shtml
-----------------------------------------------------
What is spyware:
http://www.spychecker.com/spyware.html
---------------------------------------
SpyBot-S&D:
http://www.webattack.com/download/dlspybot.shtml
-------------------------------------------------
Ad-aware:
http://www.webattack.com/download/dladaware.shtml
--------------------------------------------------
Trojan Remover:
http://www.simplysup.com
-------------------------
KL-Detector:
http://www.webattack.com/download/dlkldetector.shtml
-----------------------------------------------------
X-Cleaner Free:
http://www.webattack.com/download/dlxcleaner.shtml
---------------------------------------------------
SpywareBlaster:
http://www.webattack.com/download/dlspywareblaster.shtml
---------------------------------------------------------
SpywareGuard:
http://www.webattack.com/download/dlspywareguard.shtml
-------------------------------------------------------
SpySites:
http://www.webattack.com/download/dlspysites.shtml
---------------------------------------------------
Keylogger Hunter:
http://www.webattack.com/download/dlklhunter.shtml

 

[FromTheRafters]

What is spyware:
http://www.spychecker.com/spyware.html

From the above link:

"Spyware is Internet jargon for Advertising Supported software (Adware)."

I still think that "spyware" and "adware" are two different things. Why
would anyone need another name for adware - it already has a name
*adware*.

 

[David W. Hodgins]

I still think that "spyware" and "adware" are two different things. Why
would anyone need another name for adware - it already has a name
*adware*.

My understanding...

Adware - any sofware that displays advertisments. May be valid software,
where you choose an ad displaying version, rather then a pay-for-use version,
but is usually used to refer to trojans that display unwanted, ads, such as popups,
or extra/different banner ads.

Spyware - any software that gathers info without your knowledge, or without
your permission, for access by someone other then yourself. Includes, but
is not nessicerly limited to key loggers, password sniffers, and adware that
reports home, without your permission.

Regards, Dave Hodgins

 

[data64]

(e-mail address removed) (Orak Listalavostok) wrote in

I never even heard of "HiJack This!" before.
So, I summarize my research links so far in case you have this problem:

You might find the FAQ from alt.privacy.spyware helpful. It has a bunch of
useful links.

http://shplink.com/misc/FAQ.htm

data64

 

[FromTheRafters]

My understanding...

Adware - any sofware that displays advertisments. May be valid software,
where you choose an ad displaying version, rather then a pay-for-use version,
but is usually used to refer to trojans that display unwanted, ads, such as popups,
or extra/different banner ads.

Spyware - any software that gathers info without your knowledge, or without
your permission, for access by someone other then yourself. Includes, but
is not nessicerly limited to key loggers, password sniffers, and adware that
reports home, without your permission.

I agree, I just think that it is misinformation to have such a statement on a
website purporting to offer such as a definition. If they are only dealing with
"spyware" that is associated with "adware" then the fact is that they are not
really dealing with "spyware". It seems that the only reason they even mention
"spyware" is because it sounds more menacing than "adware" does.

There are already enough people that think that the two terms are equivalent
and also equivalent to "malware". They buy an anti-virus product and expect
it to handle these as well - 'cause it's all "malware". How are people expected
to learn the difference with garbage *definitions* such as this on the web?

True, it does go on to clarify somewhat, but many people get only the text at
the top of the page stuck in their heads. This "spyware = adware" is rubbish!