anyone get hit with thesten.com BS - GoFuckYourself.com

pussyluver · 10-24-2003, 12:33 PM

Got this spyware hack from thesten.com. Nasty shit! Can't get rid of it. deleted from registry, all files with the name, checked my startup programs etc.

WTF - is this a rebuild?

Who's spreading it?

Whois gives the usual noname....

chowda · 10-24-2003, 11:32 PM

JDog · 10-24-2003, 11:34 PM

What's it doing? Going to thesten.com? If it is, you just remove your hosts file!

jDoG

irishfury · 10-24-2003, 11:46 PM

I have found that it is in DNSerr.dll in winnt, iedll.exe in windows media player, loader.exe in windows media player, and wmplayer.exe. When ever any of these executes it infects the registry again.
I used windows explorer to search for any file containing thesten and dnserr. It takes a long time but at least it ids the files.

Also, these things infect the hosts file in winnt and the hosts file in system32/drivers/etc with bad ip addresses. You need to delete the bad addresses or it will redirect IE and here you go again.

WiredGuy · 10-24-2003, 11:53 PM

Nope, never heard of it.
WG

JSA Matt · 10-24-2003, 11:54 PM

Quote:

Originally posted by chowda
no

10-24-2003, 12:33 PM	#1
pussyluver Clueless OleMan Join Date: Mar 2003 Location: ICQ - 169903487 Posts: 11,009	anyone get hit with thesten.com BS Got this spyware hack from thesten.com. Nasty shit! Can't get rid of it. deleted from registry, all files with the name, checked my startup programs etc. WTF - is this a rebuild? Who's spreading it? Whois gives the usual noname....

10-24-2003, 11:32 PM	#2
chowda Confirmed User Join Date: Jun 2003 Location: Gooch city Posts: 9,527	no __________________ Someone finds you... 2007 PS: Nationalnet is the best host I've ever had. And i tried alot of them.

10-24-2003, 11:34 PM	#3
JDog Confirmed User Join Date: Feb 2003 Location: Canby, OR Posts: 7,453	What's it doing? Going to thesten.com? If it is, you just remove your hosts file! jDoG __________________ NSCash now powering ReelProfits.com ALSO FEATURING: NSCash.com :: SoloDollars.com :: ReelProfits.com :: BiminiBucks.com :: VOD PROGRAMS COMING SOON: Greedy Bucks :: Vengeance Cash NOW OFFERING OVER 60 SITES CONTACT :: JAMES SMITH :: CHIEF TECHNOLOGY OFFICER :: ICQ (711385133)

10-24-2003, 11:46 PM	#4
irishfury Confirmed User Join Date: Aug 2003 Location: In the hearts of cowards Posts: 2,611	I have found that it is in DNSerr.dll in winnt, iedll.exe in windows media player, loader.exe in windows media player, and wmplayer.exe. When ever any of these executes it infects the registry again. I used windows explorer to search for any file containing thesten and dnserr. It takes a long time but at least it ids the files. Also, these things infect the hosts file in winnt and the hosts file in system32/drivers/etc with bad ip addresses. You need to delete the bad addresses or it will redirect IE and here you go again. __________________ Trust no one there all snakes

10-24-2003, 11:53 PM	#5
WiredGuy Pounding Googlebot Industry Role: Join Date: Aug 2002 Location: Canada Posts: 34,504	Nope, never heard of it. WG __________________ I play with Google.