Netscape plays drums on arbitrary web pages (spyware? trojan? virus?)

  • Thread starter Thread starter Orak Listalavostok
  • Start date Start date
O

Orak Listalavostok

For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak
 
Orak Listalavostok said:
For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak
Click to expand...

Sounds like adware to me (although it is not something I have
any specific knowledge about). Have you tried Ad-Aware
and Spybot Search and Destroy yet?
 
There is a Netscape feature (which most browsers now use) which enables
you to type text to find within a web-site. I'm a user of Firfox myself
and I know it makes a percussive/drum sound if I use this feature - i.e.
every character I input there is a drum sound. Is this perhaps what is
happening for you?
sh4d03
 
....
Sounds like adware to me (although it is not something I have
any specific knowledge about). Have you tried Ad-Aware
and Spybot Search and Destroy yet?
Click to expand...

That would be a pretty strange ad...what would they be advertising?
 
sh4d03 said:
and I know it makes a percussive/drum sound if I use this feature - i.e.
every character I input there is a drum sound. Is this perhaps what is
happening for you?
Click to expand...

Thanks guys for your help so far.

I guess I got my main answer, which is this is NOT a common thing to
occur to any of you. It's seemingly a trojan program of some sort,
albeit a strange one at that. It's almost certainly a malware
program that wormed its way onto my disk & avoids McAfee.

This malware program doesn't play a drum "sound", it plays an
entire "dum da da dum dum" song for about twenty seconds,
seemingly arbitrarily on web pages which I KNOW are not causing
it per se as they are quite 'normal' pages like google & the
like.

The malware activation is reproducable in that it WILL happen
during any given browser session and in that any particular page
which causes the drums to play will play them again during that
session upon a browser reload. Also, it's always the same
twenty-second song that the drums play. But, it's not reproducable
in that, in another session, it won't have the same pages play
that same song. So it's not in the home page view source.

Since it's not in the browser "view source", do you guys have
any idea how I can debug the source of the drum song? When it
plays, for example, I have twenty seconds to DO SOMETHING to
debug.

But what?

How can I debug a trojan playing a song for twenty seconds
only when I am in a Netscape browser session on arbitrary pages?

Orak
 
(e-mail address removed) (Orak Listalavostok) wrote in
How can I debug a trojan playing a song for twenty seconds
only when I am in a Netscape browser session on arbitrary pages?

Orak
Click to expand...

Getting a list of processes running at the point would be useful. Also, have
you run HiJack This! ?

data64
 
Orak said:
For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak
Click to expand...

Someone else suggested using a program called Hijack This.
It is good.

My ideas :

Search your hard drive for midi files and play them all and
see which one sounds like the one you heard. mid extention

Also search for small wav files or small mp3 files.

Does this drumming happen with other browsers like Opera or
IE or Mozilla ?

You also might try an online virus checker called House Call
by Trend Micro. I have used them before, but it seems they
can only work with IE.

The VBS.Chick.E@mm worm does indeed play an embedded midi
file. But it doesn't mention Netscape or browser tabs.
I guess you could follow the removal instructions for the
heck of it, just to be sure.

http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

JM
 
Orak said:
For the last few days, Netscape 7.x plays drums for about 10 seconds
on arbitrary web pages. Why?

I searched google, but all the keywords are too common to be successful:
"netscape" "play" "drum" "trojan" "spyware" "virus" etc.

Per chance, does anyone in these key netscape, virus, or spyware groups
have pointers to help me either understand *why* my browser is suddenly
(seemingly) arbitrarily choosing web pages to play drums on (apparently
on tabbed pages placed in the background)?

Better yet, does this *look* like anything known in trojan, virus, or
spyware land? If so, can you suggest a fix? (A McAfee anti-virus scan
with an up-to-date DAT found plenty of web-based java trojans but all
those had been previously automatically quarrantined on the spot by
McAfee into the C:\quarrantine directory.)

Help pointing me in a more productive direction is appreciated,
Orak
Click to expand...


Ohhh, here is another website to read over as it might apply
to this situation.

http://www.pcworld.com/howto/article/0,aid,112026,00.asp

ciao,

JM
 
data64 said:
have you run HiJack This! ?
Click to expand...

I temporarily 'solved' the problem by locating the drum-playing
file (it was, interestingly, the first wav file, alphabetically,
in the Windows "My Music" folder) & then renaming that wav file.

The drums stopped playing in Netscape immediately.
However, I'm sure the malware program is still there.

I never even heard of "HiJack This!" before.
So, I summarize my research links so far in case you have this problem:
-----------------------------------------------------------------------
HijackThis:
http://www.webattack.com/download/dlhijackthis.shtml
-----------------------------------------------------
What is spyware:
http://www.spychecker.com/spyware.html
---------------------------------------
SpyBot-S&D:
http://www.webattack.com/download/dlspybot.shtml
-------------------------------------------------
Ad-aware:
http://www.webattack.com/download/dladaware.shtml
--------------------------------------------------
Trojan Remover:
http://www.simplysup.com
-------------------------
KL-Detector:
http://www.webattack.com/download/dlkldetector.shtml
-----------------------------------------------------
X-Cleaner Free:
http://www.webattack.com/download/dlxcleaner.shtml
---------------------------------------------------
SpywareBlaster:
http://www.webattack.com/download/dlspywareblaster.shtml
---------------------------------------------------------
SpywareGuard:
http://www.webattack.com/download/dlspywareguard.shtml
-------------------------------------------------------
SpySites:
http://www.webattack.com/download/dlspysites.shtml
---------------------------------------------------
Keylogger Hunter:
http://www.webattack.com/download/dlklhunter.shtml
 
I still think that "spyware" and "adware" are two different things. Why
would anyone need another name for adware - it already has a name
*adware*.
Click to expand...

My understanding...

Adware - any sofware that displays advertisments. May be valid software,
where you choose an ad displaying version, rather then a pay-for-use version,
but is usually used to refer to trojans that display unwanted, ads, such as popups,
or extra/different banner ads.

Spyware - any software that gathers info without your knowledge, or without
your permission, for access by someone other then yourself. Includes, but
is not nessicerly limited to key loggers, password sniffers, and adware that
reports home, without your permission.

Regards, Dave Hodgins
 
David W. Hodgins said:
My understanding...

Adware - any sofware that displays advertisments. May be valid software,
where you choose an ad displaying version, rather then a pay-for-use version,
but is usually used to refer to trojans that display unwanted, ads, such as popups,
or extra/different banner ads.

Spyware - any software that gathers info without your knowledge, or without
your permission, for access by someone other then yourself. Includes, but
is not nessicerly limited to key loggers, password sniffers, and adware that
reports home, without your permission.
Click to expand...

I agree, I just think that it is misinformation to have such a statement on a
website purporting to offer such as a definition. If they are only dealing with
"spyware" that is associated with "adware" then the fact is that they are not
really dealing with "spyware". It seems that the only reason they even mention
"spyware" is because it sounds more menacing than "adware" does.

There are already enough people that think that the two terms are equivalent
and also equivalent to "malware". They buy an anti-virus product and expect
it to handle these as well - 'cause it's all "malware". How are people expected
to learn the difference with garbage *definitions* such as this on the web?

True, it does go on to clarify somewhat, but many people get only the text at
the top of the page stuck in their heads. This "spyware = adware" is rubbish!
 
Back
Top