Page 1 of 1

Hijacked?

Posted: 2008-12-14 02:52am
by Joviwan
So, interesting story boiled down to the brass tacks:

Mom's computer occasionally plays movie audio. I've discovered that whatever is doing this is doing it through Firefox. I figure this is the case because after closing firefox, the sound stays, and firefox uses anywhere from 200 to 500 megs of memory until I force-quit the process, which, hilariously enough, abruptly kills the audio. None of mom's browsing has anything to do with these movies, nor are these movies ever otherwise brought near the computer, let alone committed to memory, volatile or otherwise. I figure this has something to do with the virus that I thought I killed about a week ago.

Thoughts? I'm probably going to nuke the site from orbit anyway, but I thought I'd get some other opinions first.

Re: Hijacked?

Posted: 2008-12-14 05:44am
by Edi
Nuke from orbit, obviously. There is nothing to discuss in this sort of situation.

Re: Hijacked?

Posted: 2008-12-14 05:28pm
by Joviwan
Yeah, that's what I figured I'd be doing. Any clue what it is? My suspicion is that she was rootkitted, and someone's using her to stream movies.

Re: Hijacked?

Posted: 2008-12-14 07:27pm
by Oskuro
Something like what happens to this guy at 15:30?

Re: Hijacked?

Posted: 2008-12-14 09:10pm
by Joviwan
...Holy shit, that is exactly the problem. Mom's computer was playing Ghostbusters audio. I don't know what it was the first time, because it's happened before, but the most recent case was, in fact, ghostbusters.

Re: Hijacked?

Posted: 2008-12-15 01:46am
by Dominus Atheos
I just want to be clear here. Your mother and the guy from thatguywiththeglasses.com were both infected with some type of spyware or virus who's sole purpose is to play the audio track from the Ghostbusters movie?

Re: Hijacked?

Posted: 2008-12-15 02:01am
by Joviwan
Fuck if I know. Mom's first response was to ask if I could find where it was, because if she has ghostbusters on her computer she wants to watch it. I told her to get her files together because I was going to drop the format bomb.