www.runtimeware.com

[Anonymous]

Derek, I'm running win98 and Opera 7
Any link I hit, or address I enter makes a request to http://127.0.0.1:xxxx
After seeing completed request to the same address/port# the actual link I pressed is allowed to continue. (tracking my moves?)
This seems very dangerous to me and even my programmer friends are a bit confused. (confused reports from google searches as well.) I'm asking about it here because you helped my quite a while ago with some Sentinel issues, and it appears that you've got brains galore. (Obvious compliment for obvious reasons.)
Also, I've been seeing the quote below in my REGWATCH window for quite a while now and I'm thinking it has something to do with this. (YesI should have looked into it when I first noticed it.)
The quote is:
These files are to be Deleted or Overwritten on the next Reboot (Wininit.ini and Registry). Is this really telling me that some kind of malware is resetting things for it's own nasty ends? (I scan regularly with every known proggie I can afford, as well as all the top freebies, and I'm getting nothing.)

[RWareDerek]

First off: My apologies for my late reply. I'm usually quick to reply but I havent checked up on these boards lately.

It sounds like a piece of malware has 'hijacked' your browser. There's a great tool out there called "Hijack-this" that can be used to clean up the issues. I don't have the link with me right now, but I'm sure you can find it on Google (http://www.majorgeeks.com/download3155.html) I belive that this is the same file - don't be fooled by its simple interface - it is a great tool.

The files being deleted or overwritten on next reboot are generally orphans from setup files that need to delete themselves before windows actually locks specific files. The same case applies to files that are to be written over before they are locked.
_________________
Runtimeware.com Software Developer

Ask me anything!!! (About Sentinel of course)