bbbbbbbbbbbbbbbbbbbb

[Yang]

Our Internet explorer getting 20 bs on our top left corner of Internet
explorer once a while. Anyone have any idea how to fixed this? It is a virus
or something? Thanks.

[Rob ^_^]

Ne Ho Yang!

Usually the Title bar of Internet Explorer displays the Page title of the
currently displayed document and then a brand name (ususaly ' - Microsoft
Internet Explorer')

When you see the 'bbbbbbbbbb's appear on your title bar, select the
File>Properties menu item. It will show you the location (url) and Title of
the currently loaded web document. If the Document title does not match what
is on the IE Title bar, then you may have some malware on your computer that
is changing the title bar or you could be using a 'Branded' version of
Internet Explorer.

More than likely, it is the web page that you are visiting,,, the web
designer has forgotten to change the page title to something meaningful.

Also. If you are seeing
?'s intead of b's then this could be caused because the title of the web
page you are visiting is in a foreign language that your browser does not
support.

Regards.

"Yang" <Ya...@discussions.microsoft.com> wrote in message
news:19A4845D-DA2B-4D39...@microsoft.com...

[M8RIX]

In addition to what Rob has said, it could be a registry key that is
responsible.
Does this happen only when a certain user is logged on?
If so, while logged on as that user open the registry editor and navigate
to:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

Look at the key values at the right hand side for a key named Window_Title,
If it is present, does it say bbbbbbbbb...?

"Yang" <Ya...@discussions.microsoft.com> wrote in message
news:19A4845D-DA2B-4D39...@microsoft.com...

[Yang]

Thank you so much for Rob and M8RIX.
But it seems like it is not appearing on the IE title bar, however it's
appear only in the content of HTML (Top left corner).
I'm sure that web sites are fine because we able to view the web page
correctly using other VLANs and other places.
It is only happen in one of our VLAN (Range of PC with the same gateway) and
using and Intranet web page.
I still couldn't figure out how to fix this thing.
Any idea?

[gov...@gmail.com]

Its a virus, its called W32.Arpiframe
Please see http://www.symantec.com/security_response/writeup.jsp?docid=2007-061222-0609-99

[pau...@gmail.com]

On Jun 16, 6:22 am, gov...@gmail.com wrote:
> Its a virus, its calledW32.Arpiframe
> Please seehttp://www.symantec.com/security_response/writeup.jsp?docid=2007-0612...

We are experiencing the same problem. 20 B's on the top of some pages.
The virus could be an explanation but they mention an IFRAME, not a
chain of B's...
I guess we must search all computers in the network...

[pau...@gmail.com]

We found the infected machine and we cleaned it.
We don't have the problem anymore.
The infected machine was the one that never had the problem :)
When we disconnected the network cable from it nobody had the BBB
problem, when we connected it some people had it :)

[atle.s...@gmail.com]

I'm having the same problem with IE7 and firefox, sometimes a string
of 20 Bs followed by dozens of questions marks are inserted into
webpages at the very beginning, before the first html tag. In IE7 the
question marks seem to be replaced by regular spaces, so only the Bs
are visible on the webpage. This happens on and off on various pages,
like google.com

Neither Ad-Aware, Spybot, Norman antivirus or the Kaspersky online
scanner could find anything related to it. It also slows down the
internet connection, I think. Sometimes it also fails to show pages
like developerfood.com, instead just showing some garbled junk
(starting with the Bs, of course...) kinda like viewing a zip or rar
file as plain text.

If you managed to clean the infected machine, what exactly was it
infected by?

[Lam]

This problem can be temporarily fixed by changing DHCP IP to Static
IP. Once you change it back to DHCP IP, the problem will be back.

However, we still couldn't explain what is causing this. Does anyone
out there know how to fix this problem permanently? Hope you can share
with us.

[jdr2...@gmail.com]

In my case it was caused by problems at the Internet Service Provider,
no virus or malware. So call your ISP and let them fix it!

[KirkLa...@gmail.com]

The 20 B's at the top is caused by a machine on the local segment
infected with W32.Arpiframe, or some variant.
It's called ARP Spoofing or ARP Poisoning. HTTP packets are being
intercepted on the local segment and injected with text or code.

if you have a small environment, start unplugging one machine at a
time from the network until you can identify the source. Start with
the one computer on the network that doesn't display the 20 B's in the
browser. That's most likely the one infected.

You can also search for a computer with the WinPCAP libraries
installed on the C: drive.
See the Symantec link for Arpiframe in the earlier post for filename
details.

If you have a larger network or multiple segments, you'll probably
need a network sniffer.