Various Malware problems

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by shepherd, Dec 2, 2006.

  1. shepherd

    shepherd Private E-2

    I have followed the procedure shown on the "Read and Run me First" thread as best I can, although unfortunately many parts I couldnt do:

    0. Prelim house cleaning & setup:
    ok..no malware to uninstall

    1. Secondary house cleaning:
    Norton Antivirus had been corrupted and so couldnt access quarantine. could not succesfuly reinstall NAV. I dont think there was much in quarantine and may have been deleted previously anyway.
    recycle bin emptied.

    2. Hidden files etc: viewing enabled.

    3. Dont use multuiple AV or firewalls:
    Ok. Note: ZA firewall had become corrupted / inoperable at the same time as NAV.

    4. Downloads:
    Ok for getrunkey and shownew.
    already had spybot but wouildnt open because of missing shortcut( same time a sNAV and ZA went wrong).
    Reinstallation didnt help.
    Could not install Counterspy due to incorrectly installed Windows Installer.

    [I had tried to reinstall Windows installer yesterday because of something I read on A symantec page when I was trying to get NAV back. however The extraction failed and I dont know how to get back the old files (although they are saved as .old files).]

    AVG installed ok but created problem to do with Explorer. Computer kept freezing.

    Hijack This installed ok.

    5. Cleaning Malware:

    Couldnt use Safe mode.
    Ccleaner ran ok.
    no spybot to use.
    no counterspy to use.
    no avg.

    6a online scans:
    both programs ok..logs attached.

    NOTE: prior to starting this, i had run another online scan which discoverd :
    w32/Bagle.KR.worm virus at C:\winnt\system32\adlm2.exe, and
    Worm Generic Virus at C:\Docs and settings\administartor\application data\Real\Real one Player\history\bsr72_0404_04.lnk.
    Both were deleted manually.


    6b: additional scans
    both ok..attached.

    7. hijack this posting
    attached.

    I would massively appreciate any guidance you would give me. I can't leave the pc online (I'm sending this from another pc) as it is mass mailing viruses.
     

    Attached Files:

  2. shepherd

    shepherd Private E-2

    The other two files.
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    You have some serious problems which are the cause of your problems with all the security programs not working.

    W32.Beagle.FF@mm is a mass-mailing worm that uses its own SMTP engine to spread. It attempts to lower security settings. The worm may also download and execute remote files. The worm uses rootkit technology to hide its processes and files. The rootkit will disable and remove files related to security applications including Symantec products!

    Let's see what we can do to get this removed. Hopefully it has not disabled or deleted the Registry Editor. In fact let's check.

    Click Start, Run and enter regedit and click OK. Does the Registry Editor open up? I will need to know this before I start to form a full fix but I will try giving some steps in my next message to help get us started too. BUT FIRST another serious warning about another trojan I see.

    edlm2.exe is a process which is registered as Trojan.W32.Tabela. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you can keep this PC disconnected from the internet and download any tools that we need to it by using burned CDs, it would be a very good idea. Do you have this ability?

    I see the below installed.
    CA eTrust PestPatrol
    PC Pitstop Exterminate 1.0
    PCPitstop Panda AntiVirus Scan (remove only)

    Are these paid programs or free trials?

    Since Norton/Symantec is broken anyway (right now), uninstall the below:
    Symantec Technical Support Web Controls

    Also uninstall the below since it may also be broken:
    AVG Anti-Spyware 7.5


    To start will some tools we will need, please download the below and get them onto this PC. We may or may not need them all but it will be useful to have them available.

    Pocket KillBox - this is an EXE file. Just copy it to its own folder where you can find it when needed.

    Process Explorer - extract the files from this ZIP into its own folder

    Please download and install Registrar Lite Make sure you select a Majorgeeks download link and not the Authors!
     
  5. shepherd

    shepherd Private E-2

    Thanks ChasLang for the welcome and your help. It is very much appreciated .

    The computer is disconnected right now and I can install tools via cd as you advise.
    Regedit opens ok.
    The 3 security programs you list are all trials/free.

    I'll uninstall the other 2 items you advise and download those tools.

    First, though, I'd better change some online passwprds. I assume the attacker wouild be able to read word documents etc as well?

    Thanks again.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay then uninstall all three of these tools too.

    There is no telling what they may have had access to or even if they even did get any information at all. However it is in your best interest (especially if you use the PC for anything financial related) to check and to change all passwords anyway.

    I trying to work up some fixes but I just don't have enough time right now as I have to go out and will not be back until late tonight. So I will try to put something together then that is more comprehensive. In the meantime just do the below and let's see what improvement it makes.



    You need to remove the below from your email Inbox old folder!
    Local Folders\Inbox\old\COHEJ.BMP.vbs


    Now Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O4 - HKLM\..\Run: [msnsyslog] C:\WINNT\msnlogm.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [eTrust PestPatrol Active Protection] none
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} - file://D:\system\intralaunch.CAB
    O20 - Winlogon Notify: ldr64 - ldr64.dll (file missing)

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now run Pocket Killbox by doubleclicking on killbox.exe
    Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    Then after it deletes the files click the Exit (Save Settings) button.
    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


    C:\Documents and Settings\Administrator\Application Data\hidn\hidn.exe
    C:\Documents and Settings\Administrator\Application Data\hidn\hidn1.exe
    C:\Documents and Settings\Administrator\Application Data\hidn\hidires1.exe
    C:\Documents and Settings\Administrator\Application Data\hidn\m_hook.sys
    C:\WINNT\msnlogm.exe
    C:\WINNT\MSNImport.exe
    C:\WINNT\system32\edlm2.exe
    C:\WINNT\system32\edlm.exe
    C:\WINNT\eSellerateEngine.dll
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.
    If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).
    If Killbox does not reboot just reboot your PC yourself.

    After reboot locate the below folder and delete if found:
    C:\Documents and Settings\Administrator\Application Data\hidn

    Also delete all files and subfolders in the below folder except ones from the current date (Windows will not let you delete the files from the current day).
    C:\Documents and Settings\Administrator\Local Settings\Temp

    Also uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 4
    J2SE Runtime Environment 5.0 Update 6
    Mozilla Firefox (1.5.0.8)

    Now install the current version of Sun Java from: Sun Java Runtime Environment You can download this to your other PC and transfer it to this PC to install. It is still advisible to stay offline for now.

    Now attach the below new logs and tell me how the above steps went.

    1. GetRunKey
    2. ShowNew
    3. HJT


    Make sure you tell me how the above steps went and how things are working now!

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
  7. shepherd

    shepherd Private E-2

    I can't find this file or those folders! The search box can't find them either.
     
  8. shepherd

    shepherd Private E-2

    "Since Norton/Symantec is broken anyway (right now), uninstall the below:
    Symantec Technical Support Web Controls"
    Couldn't do this as Windows Installer broken.

    CA eTrust PestPatrol would not uninstall and add/remove window froze and needed closing through Task manager. When tried again got error message saying that it may have already been uninstalled. There are still a number of files in PestPatrol folder, which I've left there for now.

    The HijackThis fixes went ok. The 04...Pest patrol ..Line wasnt there to fix.

    The killbox process went ok and afterwards C:\Documents and Settings\Administrator\Application Data\hidn could not be found.

    The old versions of Java could not be uninstalled and the new one could not be installed because of the broken Windows Installer.

    Files attached!
     

    Attached Files:

  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to be running your email program to locate this.


    Not true! Look in your newfiles.txt log and you will find this:
    Code:
    C:\Documents and Settings\Administrator\Application Data\
    HIDN          Nov 30 2006              "hidn"
    You need to see if you can delete this folder. If any files are in this folder, it could mean the infection came back. You will probably know if it came back because if you try to delete the folder, it would be denied. If you cannot delete this folder, tell me what file names are found in the folder.

    Have you tried to install Windows Installer again after applying the fixes. When you try to install Windows Installer, give me the exact word for word error message you get.

    When you go to Add/Remove programs to uninstall any of the programs mentioned, tell me the exact word for word error message that you get.
     
    Last edited: Dec 3, 2006
  10. shepherd

    shepherd Private E-2

    I still can't see Local Folders\Inbox\old\COHEJ.BMP.vbs even with email open. Where do I look. In the program itself, all I see under my "old" directory is a list of old mails, one of which has an attachment named something else.
    I use Outlook whic stores all mails and attachments in a single .pst file apparently.

    I have looked again for the hidn folder but still dont see it.

    Windows Installer still wont install.
    When I try, the first box that appears is entitled "Extracting Files". This runs through a series of files and when it stops it contains the text "Extracting File: update\langspecific\enu\update.exe" and on the next line typically (digits/characters change each time) "To Directory: c:\58c95f5e22313345643"

    A second box immediately appears entitled "Extraction Failed" containing the text "The system cannot find the file specified."

    I followed the procedure here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001112111324439 for windows 2000.

    When trying to install/uninstall Java or the Symantec program I get the message "The Windows Installer service could not be accessed. Contact your support personnel to verify that the Windows Installer service is properly registered."
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That is why I said you need to run the email program. Is there anything in the old Outlook folder you still need? If not, delete all of it.

    Download the current version of ShowNew (get it here Using ShowNew )and get a new log from it. See if the hidn folder is still there and if it lists anymore details (I added a dump of the folder if found). Attach the new log for me too look at.


    Try using these articles from Microsoft to see if they help.

    MSKB 315346
    MSKB 315353
     
  12. shepherd

    shepherd Private E-2

    Thanks for the reply.

    Deleted All.


    The folder is still there but no matches found for w2.Beagle.FF@worm.

    The first part of MSKB 315346 requires operation in safe mode which is still not working. The second part is what I had already done. Note I still have the .old versions of the original files. Could I re-instate them?

    MSKB 315353 relates to WinXp - I'm using win2000.
     

    Attached Files:

  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But if you try to delete it, it still tells you that you cannot?



    Not sure! You could try and see what happens. How much worse could it get! ;)

    Some of it still may apply. Did you do the below:

    4.At the command prompt, typemsiexec.exe /unregister, and then press ENTER.5.Type msiexec /regserver, and then press ENTER.

    Did you check permissions in the HKEY_CLASSES_ROOT registry key?
     
  14. shepherd

    shepherd Private E-2

    Sorry, I meant it appears in the log. I still can't see it in Explorer.

    :) I did try renaming them back, e.g. by typing 'ren msi.old msi.dll' in the cmd window but get the response "a duplicate file name exists, or the file cannot be found". And I can'r delete the file first afaik, or can I?

    Did the first bit, but there isnt a "permissions" under the Edit menu.
     
  15. shepherd

    shepherd Private E-2

    I probably shouldn't have done this but...

    I noticed a directory C:\!Killbox had been created. There were 4 files in it including edlm2.exe and m_hook.sys. i shouldn have remembered the others. i deleted them all before thinking unfortunately. I couldnt delete the folder
    !killbox though..got message "Cannot delete !Killbox: The directory is not empty."

    I have just tried again and this time the folder was moved to the recycle bin, but when trying to delete from there got message " cannot remove folder Dc5: The folder is not empty"
     
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    First run this Using Sophos Anti-Rootkit and attach the log.

    Install and run this ExplorerXP Does it see it?
     
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not a problem! These are just backups that Killbox makes just incase you remove the wrong thing.

    Have you simple tried just emptying the Recylce Bin (this is not the same as deleting the files manually)? Also what about running CCcleaner.
     
  18. shepherd

    shepherd Private E-2

    Attached Sophos Anti-Rootkit log. The file is very large so have split in order to upload.

    I still can't see the hidn folder even with ExplorerXP.

    I cant get rid of !killbox by emptying recycle bin or by Ccleaner.

    Is it time to get the hammer out?:)
     

    Attached Files:

  19. shepherd

    shepherd Private E-2

    More files....
     

    Attached Files:

  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    See if Sophos can kill/delete that hidden process:

    Hidden: process C:\Documents and Settings\Administrator\Application Data\hidn\hidn2.exe

    Let me know what happens.
     
  21. shepherd

    shepherd Private E-2

    No success unfortunately.Under details states "Removable:no".
    The "clean up checked items" button remains grayed out and I can't check any items.
     
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay then let's give another rootkit tool a try.


    Download Blacklight Beta
    • Download blbeta.exe and save it to the Desktop.
    • Once saved... double click blbeta.exe to install the program.
    • Click accept agreement and Click scan
      This app too may fire off a warning from antivirus. Let the driver load.
      Wait for it to finish.
    • If it displays any items...don't do anything with them yet. Just hit exit (close)
    • It will drop a log on Desktop that starts with fsbl....big number
    Please post contents of the BlackLight log.

    Also I want a new log from HJT but I want you to run it differently as given below.

    Copy the below quoted text into a new notepad document.
    Click File> Save as... and change Save as type to all files, set the File name to runhjt.bat and save it to your Desktop.
    Now execute runhjt.bat by double clicking on it. A new HJT log will come up. The file is already saved in the folder where HJT is run from. This should be C:\Program Files\HJT if you followed our directions for installing HJT. Attach this new log. HJT is also still running minimized. You can close it.
     
  23. shepherd

    shepherd Private E-2

    Thanks again.

    Logs attached.
     

    Attached Files:

  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I also want to see if the below registry key is missing:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot

    This trojan will typically delete this registry key and that would be the reason that you cannot boot in safe mode. Download the attached GetSB.zip file into the same folder where you put GetRunKey.zip or ShowNew.zip. Then also extract the GetSB.bat from the ZIP file into a folder where either GetRunKey.bat or ShowNew.bat are located. Then double click on GetSB.bat from a Windows Explorer prompt. It will create c:\safeboot.txt attach this file to your next message.



    Now Copy the bold text below to notepad. Save it as fixme.bat to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it to run it.
    Now attach a new log from ShowNew.
     
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Can BlackLight fix the below three files?
    12/04/06 18:38:01 [Info]: Hidden file: c:\Documents and Settings\Administrator\Application Data\HIDN\HLDRRR.EXE
    12/04/06 18:38:01 [Info]: Hidden file: C:\Documents and Settings\Administrator\Application Data\hidn\hidn2.exe
    12/04/06 18:38:01 [Info]: Hidden file: c:\Documents and Settings\Administrator\Application Data\HIDN\M_HOOK.SYS

    Also Copy the bold text below to notepad. Save it as fixBAGLE.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
     
  26. shepherd

    shepherd Private E-2



    Not attached.
     
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sorry! Got a phone call in the middle and had to run out. I clicked Submit before attaching. Here it is.
     

    Attached Files:

  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I just noticed I had a typo in the fixme.bat file. Also I added the other filenames to the list so here is a new version of fixme.bat.


    Now Copy the bold text below to notepad. Save it as fixme.bat to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it to run it.
    Now attach a new log from ShowNew.
     
  29. shepherd

    shepherd Private E-2

    All ran ok ..thanks

    Noticed that the hidn folder is now visible in explorer..though no files visible inside, and m_hook.sys.ren is visible in C:\!killbox (which i couldn't delete before).
     

    Attached Files:

    Last edited: Dec 4, 2006
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay your registry key for SafeBoot mode has been deleted as I suspected.

    Also the folder named C:\Documents and Settings\Administrator\Application Data\HIDN is still present. What happen when you tried to have BlackLight remove the three files?
     
  31. shepherd

    shepherd Private E-2


    To add to my edited post before yours , both the hidn folder and the !killjoy folder have deleted without a problem! woohoo!
     
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Was it BlackLight or the fixme.bat the removed the 3 hidden files.


    Let's se if we can fix your safe boot mode problem. Download the attached safeboot.zip file and extract the safeboot.reg file from it. Then double click on the safeboot.reg file and say yes when it asks about allowing it to be added to the registry. Then try booting in safe mode and see if it works.


    Please note that this trojan may have messed lot's of other things on your PC. There's no telling how much. Some items are going to be outside the scope of this forum to fix.
     

    Attached Files:

  33. shepherd

    shepherd Private E-2

    Great! Safe Mode works ok now!

    Also noticed in normal mode that Windows Installer will load ok now , though I didnt complete it. Also Zone Alarm loads ok.

    I didn't check to see if Blacklight had removed the files before running fixme.bat I'm afraid.

    Many thanks!
     
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome!

    Great!

    This trojan messes with ALL security software so you really should uninstall all security type applications (antivirus, antispyware, firewall...etc) and then reboot and then reinstall all of them and then verify that they all work.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
  35. shepherd

    shepherd Private E-2

    Chaslang, I would have been entirely lost without your help. You have my heartfelt thanks!
     
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely and wisely! ;)
     
  37. shepherd

    shepherd Private E-2

    Thanks again. Everything was fine except for Norton AV ! I think I've opened another can of worms trying to fix it...


    I couldn't install Norton AV. I got this error:

    Internet Explorer Script Error
    Line:316
    Char: 2
    Error : Unspecified Error
    Code: 0
    URL: res://C:|Program%20Files\Norton%20AntiVirus\CfgWizRoadmap.htm

    Googling for CfgWizRoadmap.htm I got http://support.gateway.com/s/issues/667605320.shtml which advised to Download and install the latest version of Microsoft® Internet Explorer.

    I wanted to uninstall it first but it didn't appear in the Add/Remove Programs list. From http://support.microsoft.com/default.aspx?scid=kb;EN-US;q293907 I read, (in order to get IE6 to re-appear in Add/remove
    programs) "If you are running Windows 2000, run the w2kexcp.exe /u command from your Internet Explorer\IE Uninstall folder. If this does not work, you need to reinstall Windows"

    It didn't work so set about reinstalling windows 2000.
    Elected to "Upgrade to Windows 2000" instead of the clean install option, and elected not to upgrade drive to NTFS.
    At soem point I was asked to insert The Norton AV disk.
    During the final "Performing Final tasks" part of the installation I got error messages during the "register components" part.

    First message:
    Installation Failed!

    Second message
    Error during installation of the Task Scheduler service; openScmanager error = 1115

    Third message:
    NtmsSvc
    Couldn't open Service Manager

    Finally, after installation was completed, on boot up most or all of the start up programs wouldnt open and I got a series of
    messages referring to Windows installer and or services manager. I didn't take note of these, though can repeat if needed.
     
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I'm sorry to tell you that you are now outside the scope of this forum. Problems with installations or re-installations etc are really issues for the Software Forum. If you actually did a re-install already (and thus did not mind losing and personal data & settings), perhasp your best and fast solution would be to delete your partitions, create new partition, format, and then reinstall your OS and everything else from scratch. And then immediately get all Service Packs and updates for all your applications.

    And based on the problems you alone have been experiencing with Norton, I would not reinstall it. Get something that is less of a headache and not so resource hungry. Even free tools like AVG, AntiVir, and Avast are very good and provide better protection in many regards than Symantec. They also don't get broken as easily and when you uninstall them, they actually uninstall which Symantec just does not seem to be able to figure out how to write software to do.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds