Comet Cursor Hijack

Chronos:

You say that the box that came up was a CometCursor error… You couldn’t get a CometCursor error unless you first had CometCursor installed

That error is not from the CometCursor program. The way OpalCat explained it it is from the Javascript previous to installing. That is why she was saying if I got that error it should not be able to install. It makes sense to me… except it did install.

I cannot explain how it happened but I can assure you it did happen.

I am kind of surprised to see so much certainty ine everybody telling me it couldn’t have happened. Well, I can assure you all it did happen. How you are all so certain is beyond me. Here is a system that continously does all sorts if glitchy things, freezes when it feels like it, etc. and you are telling me it could not have happened? Sorry, I know what I saw and what I did and what happened.

Are you telling me it is 100% absolutely positively impossible that something like this could have happened: That Windows intended to display the window OpalCat shows but never did and yet, my next click was interpreted as clicking OK in that window (which had not been displayed). Are you telling me this or something like this is metaphysically impossible? This about WIN95?? Come on! Nobody here has run WIN95 without experiencing all sorts of glitches. Come on! Not even Bill Gates has that kind of faith in Windows.

I am not making a big deal out of this. Initially I was scared because of the way CometCursor appeared on my machine and I was concerned about its effects. Would you be concerned too if something similar happened to your computer?

I want to add I am impressed by CometCursor’s interest in explaining what their program does and is. Good job.

sailor, I think people here are just not convinced that you got CometCursor from the site you think you did. It’s not that we’re positively certain that it couldn’t happen, but we’re weighing to possible explanations:

  1. You are absolutely right in where it came from.

  2. You are mistaken, because you saw the error only when you went to that site.

To believe number 1, this would involve believing that a large security hole exists in IE which has not been exploited except accidentally by CometCursor. Put a little JavaScript on a web page that installs a Trojan Horse program, without the user ever having to do more than click “OK” to an arcane-sounding error message. Seeing as how there are legions of hackers working around the clock to discover security holes in IE, this seems the more unlikely of the two.

None of us means any offense, but it’s easy to be mistaken about computers.

Of course the much cooler explanation is that I am a man cloaked in mystery and intrigue and that it is unwise to attempt to probe deeper into the legend that is moi.

Sailor:

First some background: I’m a computer and network technician, and a web designer. I’ve been doing internet design since the web was text-only and Lynx wasn’t the best browser, it was the ONLY one. I was using that internet thingie when GOPHER and FTP were the big deal protocols, the <IMG> tag was an earth-shaking new development, and Mosaic was an astounding new revolution in Information dissemination (“you mean I can have pictures next to my text??”).

The reason I say all of this is to establish credentials for when I say that it’s my professional opinion that you’re blowing this way out of proportion.

Not that she needs my help, but I wanted to chime in on OpalCat’s behalf. Her assessment is correct. If you’re getting an error dialog, that means that a) the script is NOT working, and b) it’s probably already installed on your computer. Since you’ve already stated that you are not the only person who uses the computer AND you admit that you don’t know much about the technical side of things, you are not in a position to say for certain how it got installed. Because I can tell you for a fact that Comet does not install itself covertly. I’ve come across it many times, and it does, in fact, show the dialog Opal showed you. Every time. What you got was a JavaScript error saying that it couldn’t run the script that gives you the option to download & install it.

It’s true that ActiveX can do some nasty things, but Comet is not a virus. It’s most likely not spyware (although I wouldn’t necessarily bank on that…click-tracking is turning into big business of late). It is at worst an annoyance, and at best a neat toy. And I’m almost 100% Certain that OpalCat is not in the privacy-mangling business.

It is extremely difficult to force a download of executable code, let alone to install that code for you without your intervention. Trust me: Somebody installed that program on your computer. It didn’t put itself there. How am I so certain? It’s my JOB to know. Comet may bother you, but it’s not a security risk.

Just delete it and relax. And “JUST SAY NO” next time it asks if you want to download and install it.

It’s worth noting that the standard and full installations of Real Player 8 will install Comet Cursor. Is it possible this is where it came from?

Joe, I am the only mammal that uses this computer. I seem to share it with a few bugs also.

As I already explained above, I started the computer, only visited the SDMB and OpalCat’s site. There I got the error message and a few seconds later the Comet icon appeared. While OpalCat’s makes sense to me, OTOH I have no doubt whatsoever that there is no chance the download was started from anywhere else. The odds against that are even greater than they are against whatever glitch made it happen.

I already gave you a scenario about a click intended for one window going to another. Are you telling me it’s never happened to you? Are you telling me this is “impossible”?

Look, You may be the inventor of Windows but I have used it enough (and reinstalled it probably a couple dozen times) to know it is full of glitches everywhere. I find your telling me this cannot be a glitch ludicrous.

That the link to Comet Cursor was from Opalcat’s site I have absolutely no doubt. I am not blaming her for whatever glitch may have caused the software to be installed. But to say now that it was not initiated by her code is just ludicrous.

I mean, I have been surfing the net daily for years and never come across Comet Cursor. Then one day I happen to land on OpalCat’s site, which has a link to it, and you are telling me that because her code had an error in it the program could not have been downloaded?

I have several times come across Tech people who, when I explain the problem, say “that’s impossible”. Idiots! Do they think I’m making it up? Am I lying? Why would I? The solution is to hang up and call again, then you gat another rep who says “ah yes, we get that all the time”.

I have already said I am not blaming anyone or making a big deal out of this but to tell me I must have installed it voluntarily is to insult my intelligence. Look, I am not gramma who has never used a computer OK? I am very familiar with WIN95 and all the crap it entails. Your assurances that it has to be me because it cannot be a Windows glitch just seem laughable to me. I have not seem ONE WIN95 system that did not have it’s own glitches and quirks. I have also learnt that often the only solution the “experts” have for them (other than saying “that’s impossible”) is “reinstall everything”.

I do not have the original code from Opalcat’s site any more but is anyone willing to offer $5000 if I can make it happen again? Maybe it would be worth my time then. For that amount I am willing to try the “impossible”.

>> Updated Real Player lately?

Nope. No changes at all. As I said, I started the computer, opened IE5, came to the board, saw Ed Zotti’s announcement and opened OpalCat’s site in a second window. When I clicked on Alphagene’s profile, the error message popped up and I clicked on it. A few seconds later the Comet cursor icon appeared on the tray and a shortcut on the desktop.

THAT IS ALL! OK? Don’t tell me “maybe it was the kids” etc. I have no kids, I have no wife, I have no pets, I did not run any other programs, I did not visit any other sites, I did not step away from the computer which would have allowed aliens to do anything. It all happened in a period of a few minutes. I do not drink alcoholic beverages. I do not use any medication or drugs. I am not distressed by any recent traumatic events. I was calm and paying attention. I was wearing a green sweatshirt. I was not playing with my pizzle as I might do at other times. OK?

BTW, At this point most of what we are discussing is irrelevant. I am certain the link was started from OpalCat’s site (this is no blame in any way) but this is irrelevant.

The point is that when you initiate the link (it does not matter from where), you should get a window asking you if you want to install CometCursor. I have no doubt in my mind this is the way it is designed to happen and CometCursor has no responsibility in what actually happened.

The fact is that I NEVER saw that window before the program ws installed. NEVER. I am not stupid and I know I never saw that window until OpalCat posted the graphic.

Obviously this is not the way it is designed to work but that is what happened.

I can think of one million explanations as to what happened rather than that I may be totally stupid and losing my short term memory. For example that WIN95 somehow thought it had displayed the window but id had not, OR it was behind another window OR is was about to start displaying it OR… THEN my next clcik which was directed to something else was taken by WIN95 to be the OK button in that window.

So everybody is telling me this is or something like this is impossible? And I am lying or making the whole thing up or tottaly and utterly stupid?

So it has never happened to anyone here where they were typing in one window and another one popped up so fast the next keystroke went into the new window without a chance to even see it?

If this has never happened to you then you have not used Windows for more than a few minutes.

Actually, the Javascript error is still there. All I was saying is that I set security to low/none and tried it, and it still didn’t install CC.

I’m not saying at all that it didn’t find some way to happen. I know things do magically install themselves, and mysteriously seem to work illogically.

Here is an example that kicked my ass the other week:



float ammonia_active_fraction = CalcNH3();

(stuff deleteed)

if(ammonia_active_fraction < (float)0.01)...


Well, at that point, ammonia_active_fraction is EXACTLY equal to 0.01, and both values are 32-bit floats.

Yet the test thinks that the floating point variable ammonia_active_fraction (at 0.01) is less than (float) 0.01. And this is with Visual C++ 6.0 SP3.

Things like this happen all the time - “equal” numbers that aren’t, memory overruns and strange pointers that do crazy stuff. So I know it’s very possible that due to some crazy-assed event CC was installed by accident. Just not easy to prove that was the case if it can’t be repeated. Like most bugs of this type.

sailor, nobody is saying that the symptoms you’re reporting are inaccurate, just that your diagnosis of them is. Have you ever updated RealPlayer, for instance? Consider this scenario: A year ago, you got RealPlayer, and CometCursor installed at that time. CometCursor does nothing (or at least, nothing visible) except at sites that use it, and as you said, you’d never before been to a site that uses it, so it never before did anything. Then today, you go to Opal’s site, which uses (or did use) Comet, and so it starts doing something, and you notice it. Does this seem possible?

Anthracite, I returned to that page and for a while kept reloading the page and getting the error message and trying to get it to happen again but it won’t do it. Oh well.

I see the link is there: http://files.cometsystems.com/javascript/cometzone.js I tried linking to it directly but, sure enough, my IE security settings prevent it from loading.

Somehow, all this was circumvented yesterday. Now it all seems like the product of a harmless glitch but when it happened I did not know what the program was and so I was alarmed.

Chronos:

>> sailor, nobody is saying that the symptoms you’re reporting are inaccurate, just that your diagnosis of them is

But I have NO diagnosis other than the thought that it was probably an irreproduceable glitch. I just tell you what happened.

>> Have you ever updated RealPlayer, for instance? Consider this scenario: A year ago, you got RealPlayer, and CometCursor installed at that time. CometCursor does nothing (or at least, nothing visible) except at sites that use it, and as you said, you’d never before been to a site that uses it, so it never before did anything. Then today, you go to Opal’s site, which uses (or did use) Comet, and so it starts doing something, and you notice it. Does this seem possible?

NO, that is impossible. I know my way around my folders like the palm of my hand. CometCursing was NOT there when I started the computer. It was downloaded and installed yesterday when I visited that site. I saw it!

Besides there is no way something is in my disk and I am not aware of it. Nor in the register where I browse fairly often. I have investigated pretty much everything on my system and I know what is there. I regularly clean out stuff I do not want. If anything new shows up, I’ll know it immediately. Same thing if any program runs. I often hit ctrl-alt-del just to see what is there and there is nothing that I do not know exactly what it is doing.

Re, RealAudio I recently posted my opinion in another thread: it sucks, I hate it and I try not to use it. I do have it installed for the very few times I may need it but, in general, I will not click on RealAudio links. Whatever version I have, I have not updated in a long time and if it had installed anything I would be well aware.

In any case, it was obviously some glitch and it alarmed me because it installed something I did not know. Looking back now I can see the entire thing was totally harmless.