just got home - 5 more on the desktop!
5 more new similar files on the desktop since I just got home. Here are the file names the html codes and text within them:
reftmp19457.tmp
PHP Code:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://www.ad-aware.net/error.htm">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.26 Server at [url]www.hypergate.de[/url] Port 80</ADDRESS>
</BODY></HTML>
reftmp37261.tmp
PHP Code:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://www.ad-aware.net/error.htm">here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.26 Server at [url]www.hypergate.de[/url] Port 80</ADDRESS>
</BODY></HTML>
reftmp33873.tmp & reftmp194821.tmp
these ones show no text content, and properties show then as zero filesize.
I am very concerned about this, obviously, and I'm concerned with whatever could be happening with reboots and even being online, of course, too! The sygate site mentioned in the texts I put in my restricted zone, for starters, but notice that there is mention of
port 80
a Lavasoft Adaware url,
"content.redirect"
"robot"
"script"
and more slimy looking stuff. What can I do? I've read Steve Gibson's site before and he recommends getting offline if something is detected as mentioned, but then what? I have run his tests before, but getting no hits thins time is not going to explain the contents of these files mysteriously appearing on my desktop - WHAT should I do?
TIA...
Well, no more desktop mystery docs...
Renamed normal.dot to normal.old, the GRC.com site's check for "6667" and "113" came up clean, as did my AVG with new refs, housecall, Script Sentry in place and ZA with mailsafe plural extensions...
Although I'm not exactly clear how I set this problem in place (oh, but I know it was my fault, alright!), I think I'm going to be ok.
Thanks