| Author |
Message |
    
George Hutchinson
Inspector
Username: Philip
Post Number: 152
Registered: 1-2005
| | Posted on Sunday, January 16, 2005 - 5:15 pm: | 
|
Thanks John. It is intermittant. The test if all of Sir R A's help will have worked will come at about 11pm (that's an hour away for you folks in the US) when the predictable every-day-slow-down comes. It's been OK for most of this afternoon, though. Slow at times but it picks up again after a few minutes.
Casebook - discuss the Ripper and your eBay download problems!
Thanks guys.
PHILIP 
Tour guides do it loudly in front of a crowd!
|
George Hutchinson
Inspector
Username: Philip
Post Number: 155
Registered: 1-2005
| | Posted on Sunday, January 16, 2005 - 5:43 pm: |
|
Yeah! Just won the rare 1996 'An American View' for £22 on eBay - signed by the late author! About time - I lost 3 lots of Ripper books today. Damn those people with huge bank accounts!
PHILIP
Tour guides do it loudly in front of a crowd!
|
Sir Robert Anderson
Detective Sergeant
Username: Sirrobert
Post Number: 148
Registered: 2-2003
| | Posted on Sunday, January 16, 2005 - 5:46 pm: |
|
"discuss the Ripper and your eBay download problems"
Not that any of us have a collecting obsession or the like. Nope, not here.
Sir Robert
"I only thought I knew"
SirRobertAnderson@gmail.com
|
George Hutchinson
Inspector
Username: Philip
Post Number: 158
Registered: 1-2005
| | Posted on Sunday, January 16, 2005 - 7:15 pm: |
|
Alas, folks, it hit 11pm and it all went to pot again as per usual. I was amazed just how much rubbish I had in my PC that Norton had not found - 8 SpyBots and 152 Adware cookies - a system Norton says is CLEAN! Nevertheless, I still cannot get eBay at night any more.
I know this thread is supposed to be about eBay items but I think this is relevant.
When / if eBay ever come up with a coherant and direct answer, I will let you know. In the meantime, I lost 3 lots in the last 24 hours because I couldn't get into eBay to bid on them. The title page will eventually come up half the time after 3 or 4 minutes, I can sign in quickly - and my actual MY EBAY will never download afterwards, just the download quantity bar very slowly advancing to the halfway point and a blank screen.
Someone is going to pay!
PHILIP
Tour guides do it loudly in front of a crowd!
|
Alan Sharp
Chief Inspector
Username: Ash
Post Number: 758
Registered: 9-2003
| | Posted on Sunday, January 16, 2005 - 8:44 pm: |
|
Hi Phil
You probably have a worm. Your Norton anti-virus is only as good as the latest upgrade and worms can often slip past it. You really need to have a firewall running as well, that will tell you when anything unauthorised is trying to get into or out of your system.
Unfortunately that's locking the door after the horse has bolted. This worm is sitting deep in your pc recreating all the spybots every time you delete them. You can run AdAware as many times as you like, but each time you clean the system everything will come back before very long.
What you need is a program called HijackThis. Do a google search and you will find a site to download it from. This will create for you a map of every process running in your system. Undoubtedly some of them shouldn't be, but unless you are an expert you won't know which ones.
So.... you then go to a chatboard full of experts, cut and paste the trace in, and some helpful soul will tell you which ones to delete. However, worms won't let you delete them when they are running, so you have to restart your pc in safe mode first, then delete the little buggers then restart, with the firewall running, clean the system again, and bob's your uncle.
(Actually all this took me about five hours all told when I had to do it, so bob is really your second cousin three times removed).
"Everyone else my age is an adult, whereas I am merely in disguise."
|
George Hutchinson
Inspector
Username: Philip
Post Number: 160
Registered: 1-2005
| | Posted on Sunday, January 16, 2005 - 9:01 pm: |
|
Thanks Alan - this is all WAY beyond me! What I am finding is that everyone has a different idea of what I need to do - ALL of it can only be to my benefit, but I have no clue how to do it. Could a worm like this only affect one site and only at certain times of day?
I do have to say that I was away for 4 weeks up to Xmas. I came back to over 170 e-mails, and one of them was a NETSKY which Norton detected and removed before I could open it, but the eBay problems at night started shortly after. Could this be it?
PHILIP
Tour guides do it loudly in front of a crowd!
|
George Hutchinson
Inspector
Username: Philip
Post Number: 161
Registered: 1-2005
| | Posted on Sunday, January 16, 2005 - 9:27 pm: |
|
Alan - your assertion could well be true. I downloaded SpyBot S&D on advice from Robert A earlier tonight and cleared out 8 SpyBots. I have only been on this site and eBay since (and a couple of download sites to remove such things) and have, in an hour or so, picked up 4 more SpyBots I have just removed.
Does this confirm I have a worm?
PHILIP
Tour guides do it loudly in front of a crowd!
|
Alan Sharp
Chief Inspector
Username: Ash
Post Number: 759
Registered: 9-2003
| | Posted on Monday, January 17, 2005 - 3:51 am: |
|
Phil
I'm no expert but it definitely sounds to me like you have something in there that will need to be removed manually (the way I described). Here is a url of one of the expert help forums and an example of someone submitting a HijackThis log. I'm afraid a lot of it is trial and error and getting rid of mine was a pain in the 'arris!
http://computercops.biz/postitle93563-0-0-.html
"Everyone else my age is an adult, whereas I am merely in disguise."
|
Sir Robert Anderson
Detective Sergeant
Username: Sirrobert
Post Number: 149
Registered: 2-2003
| | Posted on Monday, January 17, 2005 - 8:52 am: |
|
"You probably have a worm. "
I agree. The telltale sign is when something bad keeps happening at the same time each day.
Reformatting your HD is the ultimate solution; start afresh but this time with anti-spyware software loaded.
Sir Robert
"I only thought I knew"
SirRobertAnderson@gmail.com
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 719
Registered: 5-2003
| | Posted on Monday, January 17, 2005 - 12:01 pm: |
|
There is another program called CWShredder that specifically addresses browser redirect viruses. Search for it and download. It's free and it usually works!
By all means if you haven't already, try running (with the latest updates) Ad-Aware, Spybot Search and Destroy (SSD), the web-based scan at antivirus.com, and your resident anti-virus software (Norton or McAfee). You can also do an online scan at the Symantec (Norton) or McAfee websites. Also run Hijack This and look over the log. You have to be careful here and it's best to get expert advice, but sometimes the offending bug is obvious. Do a system backup so you can restore it if you mess things up and then delete the obvious offender. This will delete it from your registry but the bad news is that sometimes the real offender is well-hidden and the bug comes right back.
Also download and install SpywareBlaster (free) and SpywareGuard (free) to help prevent future infections. Make sure you update everything regularly. There is also another neat program but I can't remember the name -- I think maybe IE Shield? -- that places hundreds of websites into the IE's restricted zone that are known to inflict trojans.
Finally, but most importantly, make sure you go to Microsoft and install all the latest security updates!
Using this cocktail of armour, I have been able to fend off any recent attacks. By the way, don't worry about the "tracking cookies" Ad-Aware or SSD will find. Go ahead and delete them, but hey are harmless (just invasive, is all).
Andy S. |
George Hutchinson
Inspector
Username: Philip
Post Number: 162
Registered: 1-2005
| | Posted on Monday, January 17, 2005 - 12:46 pm: |
|
Thank you all so much for your help, gents. I have tried to run HijackThis but it won't run. It says I am missing a DDL file or something.
Both eBay and my ISP got back to me today. One suggested changing a setting that was already set to their suggestion, the other gave me some changes to make to my Advanced tab in Internet Options, which were a few alterations and they have since been fine.
Yesterday it broke down in the day as well as my usual night-time one, but today it has been fine so far.
Sure enough, I found 6 more Adware cookies in the PC this morning. Nothing else odd is happening on my PC in Outlook Express, on the net or any software function. It's just the nightly breakdown of eBay.
My problem now is that I have done everything I understand but a lot of the tips I'm being given I don't know what it means! It doesn't help not being able to run the HijackThis system. Ad-Aware and SpyBot S&D are installed, Norton 2004 is up to date and run frequently. I delete my Temporary Internet Files every few days and am currently updating even the non-critical Microsoft extras. I'll then more onto the antivirus.com and then the CWShredder and anything else you've suggested I can actually DO.
The big problem is that the major thing I need is HijackThis but it won't run once installed!
PHILIP
Tour guides do it loudly in front of a crowd!
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 722
Registered: 5-2003
| | Posted on Monday, January 17, 2005 - 1:08 pm: |
|
I assume you've tried un-installing and re-installing Hijack This?
Andy S. |
George Hutchinson
Inspector
Username: Philip
Post Number: 164
Registered: 1-2005
| | Posted on Monday, January 17, 2005 - 1:19 pm: |
|
Nope. I don't even know how to uninstall it! I have also tried to download CWShredder but it won't link to the page from the website (maybe try another website). I'm not a technical whizzkid, I'm afraid.
PHILIP
Tour guides do it loudly in front of a crowd!
|
George Hutchinson
Inspector
Username: Philip
Post Number: 165
Registered: 1-2005
| | Posted on Monday, January 17, 2005 - 1:36 pm: |
|
I think I may have discovered my worm (no jokes please!).
I may need help as to how I get rid of it though if anyone can help.
I have just run a free system scan from NoAdware. I didn't remove the infected files as it wanted to charge me $30 for it and I'm sure now I have probably found it I can do it for free if someone can tell me how.
It came up with 14 non-important adware infections (since last night!) that had a low priority, but it also came up with a critical infection. I double-clicked it and it said it is a worm that will cause strange things to happen to my PC. I wrote it all down, but one of the characters I don't recognise. It is like this : '|v' except it is only one character - the v is joined onto the upright. If I represent it here with a '*', then this is what the worm came up as : w32/Noala.b@*HKEY_LOCAL_MACHINE\software\m and is is marked as a Registery Value.
What do you suggest, my international saviours?
PHILIP
Tour guides do it loudly in front of a crowd!
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 723
Registered: 5-2003
| | Posted on Monday, January 17, 2005 - 3:21 pm: |
|
OK, Philip. I'm no expert either, but I have dealt with these buggers before. What you found was a registry entry. These are tricky.
First, be aware that these "try-first and then pay" spyware removal engines are sometimes not trustworthy. I wouldn't put it past some people to create a fake infection just to get the $30 out of you! But let's assume it is genuine.
Best bet is to try Hijack This again. Go to your Windows Control Panel and find the Add/Remove Programs icon. Click and find Hijack This. Un-install it. Then download it again and re-install. If you get it to work, do a system scan and look for the offending registry entry you have identified. Remove it and hope that got it. It could be that the worm is preventing you from running Hijack This.
As an alternative, you can use the regedit command. Run this through the Run box in the Windows Start menu. Search for the offending entry and delete it. But you have to be very careful here that you don't delete the wrong entry by mistake. In any case, it's a good idea to take a "snapshot" of your system before deleting anything so that you can restore it. But if you find that you fix your problem then be sure to delete the snapshot so that you don't re-infect your own system should you have to perform a restoration later for some other reason.
Note that you may have to do this from Safe Mode.
A lot of good info can be found here: http://www.spywareinfo.com/~merijn/
Also check the computercops.biz site mentioned above, especially the forums.
Good Luck!
Andy S. |
Sir Robert Anderson
Detective Sergeant
Username: Sirrobert
Post Number: 150
Registered: 2-2003
| | Posted on Monday, January 17, 2005 - 4:01 pm: |
|
As traumatic as it sounds, sometimes it makes sense to just reformat your hard drive and start afresh. At first I was terrified at the thought of losing so much stored data, but once I did it it was downright liberating!
Sir Robert
"I only thought I knew"
SirRobertAnderson@gmail.com
|
George Hutchinson
Inspector
Username: Philip
Post Number: 166
Registered: 1-2005
| | Posted on Monday, January 17, 2005 - 7:22 pm: |
|
Gents
I have been sent a link by a friend and it is fairly definite the worm has been identified. The thing is, he has given me a link about it that is total gobbledegook to me. I don't have a clue how to do what it is telling me to do to remove it.
There are masses of links for HijackThis. I can't find the one from last night and in spite of downloading it twice it actually isn't in my Programs folder at all! All the ones I can find are detecting 8 nasty files and all of them then want me to pay for the software. I don't know how to find a link to remove it for free.
I have tried this Run box and regedit thing but it just came up with masses of brief innocuous file names and I don't know what to do from there - there is certainly nothing like this long name I detected above.
I also have no idea how to take a snapshot. I do have most of my software ghosted on E drive from when my PC was put together by my friend though, but that is only what was there to start with. I have masses of programs I have downloaded since that are only on C drive.
The Merijn link I tried to get the software from earlier today and it just went to a PAGE NOT FOUND.
I am kind-of worried that if I go to the computercops link I will be sent a whole list of instructions that mean absolutely NOTHING to me, but I will try it in a minute.
I really, really don't want to reformat my Hard Drive. Not only would it remove a great deal of things I HONESTLY don't want to lose or track down again, but I have no idea how I would do it anyway!
Needless to say, it is the middle of the stopped period here and eBay is inaccessible to me right now as per usual.
I am getting really confused - I am putting in download after download onto my PC and not getting anywhere.
Are any of you three brilliant guys able to give me (private e-mail is fine) a set of simple instructions, step by step, to get this ba@t*rd thing out of my PC?
PHILIP
Tour guides do it loudly in front of a crowd!
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 725
Registered: 5-2003
| | Posted on Monday, January 17, 2005 - 7:56 pm: |
|
OK, Phil, don't panic.
First, what version of Windows are you running? If it is XP it takes care of the restore backup for you automatically. Probably best for you to just consult your Windows Help rather than have me try to explain it to you.
Running regedit should take you to the registry editor. Press cntrl-F to get the search box. Type in all or part of the registry entry you want to get rid of. If it returns more than one entry, identify the entry you need to delete and do so. That might do it.
The volunteers at Computercops should lay everything out for you. I have used the SWI Forums (http://www.spywareinfo.com/forums/) in the past and they are very helpful and they know how to keep it simple. But they will probably want you to have HiJack this.
Another thing you can do it paste all or part of the offending registry entry into Google and see what hits come up. There will probably be forums dealing with this problem.
This is Symantec's page dealing with the same worm: http://securityresponse.symantec.com/avcenter/venc/data/pf/w32.lofni.worm.html
Also, don't forget to do the online scan at antivirus.com (this is actually the trendmicro.com website).
Go to this site: http://spywareinfo.com/~merijn/cwschronicles.html
It is working right now. Read it carefully and try to get HiJack This downloaded and installed.
Andy S. |
George Hutchinson
Inspector
Username: Philip
Post Number: 167
Registered: 1-2005
| | Posted on Monday, January 17, 2005 - 8:21 pm: |
|
Hi Andy.
I am 98 SE.
I typed in what you said and it came up with half a dozen things (well, actually about 100, but half a dozen had part of that registry address in it) but they all look the same and I have no way of knowing where the virus is kept.
I have posted the enquiry with ComputerCops. It would be OK if I could download HijackThis - but I assure you I have just tried your new link and both CWShredder and HijackThis go straight to PAGE NOT FOUND.
A friend sent me the Symantec page. This is one of the list of instructions that goes completely over my head - I don't know how they expect anyone who isn't a computer genius to know what the Hell any of the page means! The removal instructions might as well have been written in Esperanto.
I can't get into trendmicro.com either - it appears this worm is managing to disable a lot of the things that can remove it. This is hit by the same snail pace and freeze I get on eBay at night. It's then taking me to an Adware page.
In short, Andy - I can't download any of the stuff that would clear it it seems!
PHILIP
Tour guides do it loudly in front of a crowd!
|
Alan Sharp
Chief Inspector
Username: Ash
Post Number: 760
Registered: 9-2003
| | Posted on Monday, January 17, 2005 - 9:39 pm: |
|
Phil
I'm afraid I can't help much on Win98 (except to say "but a new PC, that one's out of the ark!)
I realise that all too often the experts explain things in ways that go right over non-experts heads, that's because they wrongly expect everyone else to be as fascinated with this stuff as they are. A bit like another group of people I can think of!
Anyway, all I can recommend is that you open your windows explorer and do a "files and folders" search on "My Computer" for the word Hijack to see if HijackThis is there at all. If it is, write down the exact location then reboot your pc in safe mode.
I'm not sure how you do this on Win98. On XT you hold down the F8 key while rebooting. You may need to find out if 98 is the same.
Once in safe mode. Find HijackThis again and try to run it. You might find that it will run now, as whatever was stopping it running before will not be active. Save the log in a notepad file (the program will probably do this for you), reboot in ordinary mode, then go to the ComputerCops site and post the log, and one of those nice techie people will tell you which entries you should delete and which you should not. Then back to safe mode, delete, and bob is some indeterminate relation!
"Everyone else my age is an adult, whereas I am merely in disguise."
|
Sir Robert Anderson
Inspector
Username: Sirrobert
Post Number: 153
Registered: 2-2003
| | Posted on Monday, January 17, 2005 - 9:51 pm: |
|
" because they wrongly expect everyone else to be as fascinated with this stuff as they are. A bit like another group of people I can think of! "
Probably the most inspired effort to get a thread back on topic I have ever seen.
I stand in awe.
Sir Robert
"I only thought I knew"
SirRobertAnderson@gmail.com
|
George Hutchinson
Inspector
Username: Philip
Post Number: 170
Registered: 1-2005
| | Posted on Tuesday, January 18, 2005 - 12:06 am: |
|
Hi guys. Probably my last mention on this one. Sorry it was off-thread but thanks for your help. Hope you appreciate that when your PC breaks down and you don't know what to do, then help is rather important!
Now -
I have NO W32 worm after all. That has been confirmed. It was erroneously picked up by a free scan that confused a necessary file with a bad one. I have downloaded loads of scan software tonight (it is 5am and I'm still up) and run about a dozen types of scan. They are now all clear. A lot of help has been given by a guy on the computercops board. I've also changed to Firefox.
eBay has not altered one bit. It's still bust. I would say 'I give up' but I can't stop using the site I use most (yes, even more than this one!) because of something that's not working!
However, it has just passed 5am and it has suddenly come back again - exactly 6 hours from 11pm to 5am; there must be a reason for this?
PHILIP
Tour guides do it loudly in front of a crowd!
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 726
Registered: 5-2003
| | Posted on Tuesday, January 18, 2005 - 12:11 am: |
|
Philip,
Your best bet now is probably to wait for a reply from Computercops. This could take a while as they are very busy. Most such forums allow you to reply to your own post when it scrolls off the first page to bump it back to the top (so that it doesn't get forgotten). I'm surprised the worm lets you into that site.
By the way, I agree on the Symantec instructions. They are generally the most confusing I have seen. But actually the removal instructions for this one are not too bad. Take them step by step (you don't need to worry about system restore in WIN98). I would suggest running the scan in safe mode. Follow the directions for removing the registry entry as indicated (but follow the directions for making a registry backup first).
Andy S. |
George Hutchinson
Inspector
Username: Philip
Post Number: 172
Registered: 1-2005
| | Posted on Tuesday, January 18, 2005 - 12:27 am: |
|
Hi Andy - I take it you wrote this message before you read my message above?
I'm clean. There was no worm. It was a scan error that said it. Nevertheless, eBay is down for exactly 6 hours from exactly 11pm to exactly 5am every night but my system is error free according to the computercops experts.
Cheers
PHILIP
Tour guides do it loudly in front of a crowd!
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 728
Registered: 5-2003
| | Posted on Tuesday, January 18, 2005 - 10:36 am: |
|
Philip,
Yes, apparently we were writing our posts at the same moment!
Glad you seem to be free of the worm after all, though I am still a bit puzzled that you can't get into the spywareinfo.com site. This sounds like a CWS virus to me -- they usually target that website and they often are not picked up by scans. I would advise you to try getting CWShredder and run it. I'll bet it removes a virus.
For my part, don't worry about being offthread. I know how frustrating it is to get one of these little buggers in your system and how desperate you get to get rid of it.
Andy S. |
George Hutchinson
Inspector
Username: Philip
Post Number: 177
Registered: 1-2005
| | Posted on Tuesday, January 18, 2005 - 12:45 pm: |
|
Hi Andy.
I can't remember if it was yourself who recommended it or not - but someone here recommended I change my browser to Mozilla Firefox. I have done that but it keeps doing something really annoying on this site. When typing into the message board it keeps randomly coming up with a pink toolbar at the bottom of the screen that is working as something like a Spellcheck or is finding another use of the same word on the board. I can't stop it happening, and every time, it shoots up to the top of the thread (or somewhere seemingly arbitrary somewhere down it) and I have to scan back down to the message I'm writing. Would you know what this function is and how I can remove it?
Cheers
PHILIP
(This will go on and on!)
Tour guides do it loudly in front of a crowd!
|
Sir Robert Anderson
Inspector
Username: Sirrobert
Post Number: 155
Registered: 2-2003
| | Posted on Tuesday, January 18, 2005 - 1:06 pm: |
|
I think I recommended Firefox to you. I could be wrong, but this sounds like a browser hijack attempt. Very odd.
Sir Robert
"I only thought I knew"
SirRobertAnderson@gmail.com
|
Andrew Spallek
Chief Inspector
Username: Aspallek
Post Number: 731
Registered: 5-2003
| | Posted on Tuesday, January 18, 2005 - 1:17 pm: |
|
Philip,
Sorry, I don't know anything about that browser. Is still use IE and don't have any trouble.
Go to this page: http://computercops.biz/modules.php?name=Downloads&d_op=search and search for CWS. Download CWShredder 2 and let it do its thing. I'll bet you have an infection!
Then maybe we can all get back to watching eBay!
Andy S. |
Sir Robert Anderson
Inspector
Username: Sirrobert
Post Number: 156
Registered: 2-2003
| | Posted on Tuesday, January 18, 2005 - 1:53 pm: |
|
"Then maybe we can all get back to watching eBay!"
We will leave no man behind.
Sir Robert
"I only thought I knew"
SirRobertAnderson@gmail.com
|
Jfripper
Sergeant
Username: Jfripper
Post Number: 25
Registered: 1-2005
| | Posted on Tuesday, January 18, 2005 - 6:05 pm: |
|
Philip,
Your best bet is to get rid of your NORTON software and get a copy of BITDEFENDER Pro 8 Plus.
I swapped to this software a few weeks ago. On its initial scan it found 5 Virus' and 3 Spyware programs that NORTON never even detected.
If you want to know how to get this email me at my personal address.
Cheers,
Michael
|
George Hutchinson
Inspector
Username: Philip
Post Number: 189
Registered: 1-2005
| | Posted on Tuesday, January 18, 2005 - 7:25 pm: |
|
Thanks Michael.
It has all got a great deal more complex than that. Masses of scans have been run on about a dozen items of software and I have had an entire Hijack This scan looked at by experts on ComputerCops and my system is entirely clear.
I didn't have a firewall - which is now downloaded and blocking Adware & Spybots - but it is no better with my eBay access from 11pm to 5am GMT. That is all that is wrong (I happen to hate this Mozilla browser I've installed though - everyone says it's great then as soon as I install it a couple of people tell me it's crap!!!).
I have just reached a limit to how much more I am willing to reconfigure on my PC. It has made operating it rather difficult and hasn't sorted the problem. I am fairly sure the fault is something to do with eBay - why else would connection to that site alone stop for exactly 6 hours a day from pretty much spot-on 11pm to almost spot-on 5am (incidentally, it can move a few minutes here and there so I think it is being operated manually). The story continues (I am now posting my woes on this on the PubTalk thread by the way).
PHILIP
Tour guides do it loudly in front of a crowd!
|
Jfripper
Sergeant
Username: Jfripper
Post Number: 26
Registered: 1-2005
| | Posted on Tuesday, January 18, 2005 - 10:57 pm: |
|
Philip,
I don't know how much reconfiguring you have done, but what about this:
Try changing your system clock just b4 11pm and set it back six hours.
Just an idea.
Cheers,
Michael |
George Hutchinson
Inspector
Username: Philip
Post Number: 194
Registered: 1-2005
| | Posted on Wednesday, January 19, 2005 - 10:43 am: |
|
That was one of the first things we did, Michael. I know where you're coming from but it all worked fine under a different clock time.
It looks like things might have been remedied - we will know for sure tonight. I have posted the full info (well, not full, but enough) on a thread elsewhere that deals with Jane's site reconstructions. Thanks for your help (and sorry everyone else about using this strand for such a matter; I did open one specially for it in Pub Talk but no one has posted there!). Spry - if you want to remove my postings about my PC problems from this thread do feel free!
PHILIP
Tour guides do it loudly in front of a crowd!
|
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1653
Registered: 4-2003
| | Posted on Monday, January 24, 2005 - 7:26 pm: |
|
THIS GREAT BOOKLET IS TITLED
THE FUNERALS OF THE VICTIMS OF JACK THE RIPPER
THIS 29 PAGE BOOKLET HAS SOME GREAT INFORMATION AND SOME EVEN GREATER PICTURES.
INTERESTING READ ALSO MAKES A GREAT COFFEE TABLE PIECE
BY TODD VAN BECK
WARNING THIS BOOKLET CONTAINS SOME GRAPHIC PICTURES
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=88744&item=5552077774&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1663
Registered: 4-2003
| | Posted on Saturday, January 29, 2005 - 12:26 pm: |
|
Hundreds of black-and-white photographs with detailed captions assist the reader in analyzing the authenticity of historical documents and letters. FORGING HISTORY ? THE DETECTION OF FAKE LETTERS AND DOCUMENTS by Kenneth Rendell, University of Oklahoma Press, OK, 1994. This book discusses by chapter: General Characteristics of Forged Writing; The Material: Paper, Ink, and Writing Instruments; Comparisons of handwriting and Typewriting; Famous Forgers: Their successes and Downfalls; An Analysis of Major Forgeries; ?Authorized? Forgeries; The Hitler Diaries: Bad Forgeries but a Great Hoax; The Mormon Forger, Con Man, and Murderer; The Jack the Ripper Ripoff; Equipment Used in Questioned Document Examinations; A Selected Bibliography; and Index. This book will be of interest to rare-document dealers and collectors, historians, librarians, and general readers interested in a rational approach to a fascinating, universal form of deception.
8.7? x 11.3? hardback with dust cover in like-new condition. 173 pages
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=29466&item=6508342741&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1664
Registered: 4-2003
| | Posted on Saturday, January 29, 2005 - 12:28 pm: |
|
In the past several months The Bomb Factory has participated in a huge sale from book estates here in the American Southwest – and we were able to purchase HUNDREDS of rare and utterly fantastic works… and we will be listing them here in the coming weeks and months so be sure to bookmark us or you will miss out! This book up for bids is a brand new book in pristine condition from H. Paul Jeffers, “Bloody Business: An Anecdotal History of Scotland Yard” (New York: Barnes & Noble Books, 1999) It is a reprint of a 1992 work. From Jack the Ripper to the Yorkshire Ripper, the annals of British crime are home to some of the most fascinating and sensational cases in history. Weaving together dozens of cases from the history of Scotland Yard, this book is an engrossing account of the world’s most famous and admired police force. You’ll meet real detectives wrestling with the most dramatic crimes in British history – daring robberies, intricate true–life mysteries, and some of the bloodiest murders ever committed – in their quest to bring the culprits to the bar of justice, and frequently to the gallows. See the details below – we purchased this from a book distributor, and offer it here to our Ebay audience. It should not be passed up – so bid now while we have this single copy in our collections!
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=378&item=4522592264&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1665
Registered: 4-2003
| | Posted on Sunday, January 30, 2005 - 11:10 am: |
|
Item Specifics - Non-Fiction Books
Format: Hardcover Publication Year: 1992
Subject: True Crime Special Attributes: 1st Edition
Language: English
THE CRY FROM STREET TO STREET
BY
HILARY BAILEY
EX-LIBRARY, BUT A WONDERFUL READING COPY OF THE STORY OF 'JACK THE RIPPER'S LAST VICTIM, WHO WAS NEVER PROPERLY IDENTIFIED IN THE SUMMER OF 1888.
A HAUNTING PORTRAYAL AND AN UN-PUTDOWNABLE BOOK MARRED BY LIBRARY STAMPS IN THE FRONT
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=2240&item=4523676024&rd=1
|
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1668
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:35 pm: |
|
0'DONNELL, Elliott. GREAT THAMES MYSTERIES. Selwyn and Blount, London, 1929. First edition. Occasional foxing, Otherwise vg in original cloth with gilt lettering. Illustrated with photographs and contemporary graphics.
A compendium of murders, suicides and possible hauntings that took place along the River Thames near London in the late 19th and early 20th centuries. Includes the May 1887 murder and dismemberment of a woman attributed for a time to Jack the Ripper.
An uncommon title. The only other example listed on the net is priced at $200.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=29223&item=6945691865&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1669
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:39 pm: |
|
Jack the Ripper.Police News.Original ? 5 papers.Murder.
These RARE papers are in good condition. Minor damage to edges and folds to centre & length ways but not too bad a condition....The Illustrated Police News law and courts Weekly Record. 5 newspapers of the murders of Jack the Ripper,dated Saturday,September 8,1888 - Saturday,September 22,1888 - Saturday,October 6,1888 - Saturday,October 20,1888 & Saturday,November 17,1888. with loads of details of the murders inside.These papers were re-produced in the 1970's.... but the colouration and edges of these papers seem to suggest they may be original as they are not uniformaly brown but look as though they have aged naturally where they were folded ..But cannot be totally sure.!.but too me they look Original from the time of the murders . Please bid accordingly to what you think... but even IF they were from the 1970's these papers are HIGHLY collectable.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=13995&item=6509440588&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1670
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:41 pm: |
|
FRAMED JACK THE RIPPER POLICE HELMET PLATE & POSTER !!!
For sale,a must for every Ripperologist.A wooden framed reproduction Metropolitan Police helmet plate for the 1880s,'H' Division (Whitechapel) with a reproduction Metropolitan Police 'flier' seeking information about Jack the Ripper.The helmet plate is an authentic reproduction used in a film version of the story.The poster is an authentic reproduction of the one sent out to homes in Whitechapel by the Police at the time of the murders.The whole framed in a Victorian style frame with Police blue background.Overall size 21" long and 13" wide.Very,very nice.Postage will be about £8 as a lot of padding will be needed to protect the glass.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=929&item=3956083513&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1671
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:46 pm: |
|
Here we have a 6x8inch (20x15cm) Black and White print from 1890
Showing Block of Peabody`s Buildings, Spitalfields
In very good condition for age....
Mounted between backing card and good quality mount, ready for framing or hanging....
Taken from a publication of the day and not a modern Reprint over 100 years old
Offered here with low start price and no reserve
UK Postage £1.00......EU £2......Rest of World £3
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=10170&item=3779987649&rd=1&ssPageName=WDVW |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1672
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:47 pm: |
|
Old Billingsgate Market Porters Badge/Enamel C1910. N/R
This is an old enameled tin Billingsgate Market Porters Badge No. 818, one of two I will be listing on Ebay tonight. It is difficult to know the date, without being in the industry, but I would think Circa.1910 or thereabouts. It is 2.5 inches in diameter and in good overall condition, just a few tiny edge nibbles to the enamel, which is only to be expected (see photo’s). NO RESERVE.
Normal Airmail Delivery Worldwide is £1.50p…..1st Class Delivery within the UK is £0.50p. Insurance in transit available at extra cost.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=211&item=6151520153&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1673
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:48 pm: |
|
Here we have a 6x8inch (20x15cm) Black and White print from 1890
Showing Billingsgate Market
In very good condition for age....
Mounted between backing card and good quality mount, ready for framing or hanging....
Taken from a publication of the day and NOT a modern Reprint, over 100 years old
Offered here with low start price and no reserve
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=10170&item=3779988467&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1674
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:49 pm: |
|
London Life BILLINGSGATE FISH MARKET 1920s postcard
Super card , printed in photogravure by anonymous publisher , unused and in MINT CONDITION.
A Genuine vintage item NOT a repro or reprint of any kind.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=127&item=6150560043&rd=1
|
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1675
Registered: 4-2003
| | Posted on Saturday, February 05, 2005 - 1:51 pm: |
|
"The Legend and Bizarre Crimes of SPRING HEELED JACK"
Peter Haining
Frederick Muller Ltd, 1977, Hardback
Illustrated
This is the first book to examine the legend in detail, and considers some of the strange theories that have been advanced about him - including one that he was really a spaceman !
Very small tears to slightly worn dustjacket, otherwise good condition.
RARE !
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=72327&item=4524314546&rd=1&ssPageName=WDVW |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1710
Registered: 4-2003
| | Posted on Thursday, February 17, 2005 - 11:24 am: |
|
Jack the Ripper London Police/Scotland Yard/FBI Files
Jack the Ripper: City of London Police - London Metropolitan Police - Scotland Yard - FBI Documents
96 pages of copies of City of London Police, London Metropolitan Police, Scotland Yard, and FBI documents connected with the Jack the Ripper - Whitechapel Murders archived on CD-ROM.
Jack the Ripper is the name that has been given to an unidentified killer responsible for murders occurring in the impoverished Whitechapel section of London in 1888. The name Jack the Ripper comes from the signature of a letter, dated 25 September, 1888, and received by the Central News Agency on 27 September, 1888.
There were 11 murders of prostitutes in the Whitechapel area from 1888 to 1891, known as the Whitechapel Murders. Five of these are commonly identified as the Jack the Ripper murders. Those of Mary Ann Nichols at Buck's Row, Whitechapel, on Friday 31 August 1888, Annie Chapman at Rear Yard at 29 Hanbury Street, Spitalfields on Saturday 8 September 1888, Elizabeth Stride at the yard at side of 40 Berner Street, St Georges-in-the-East on Sunday 30 September 1888, Catherine Eddowes at Mitre Square, Aldgate, City of London on Sunday 30 September 1888 and Mary Jane Kelly at 13 Miller's Court, 26 Dorset Street Spitalfields on Friday 9 November 1888.
All Jack the Ripper murders took place in a one square mile area of the East End and the City of London surrounding Whitechapel. The hunt for Jack the Ripper caused sensation and panic in London. The notoriety of the murders became international, appearing in newspapers from Europe to the Americas. Even at an early stage, the newspapers were carrying theories as to the identity of the killer, including doctors, slaughterers, sailors, and lunatics of every description.
DISC INCLUDES
BRITISH LAW ENFORCEMENT DOCUMENTS
The British law enforcement documents date from August 1888 to November 1888, and February 1894. Documents includes: Reports on the murders and detailed descriptions of the murder investigations of Mary Ann Nichols, Annie Chapman, Elizabeth Stride, and Catherine Eddowes, the "Dear Boss" letter, the "Saucy Jack" postcard, Witness Statement from George Hutchinson, who is believed to be the person who got the best look at Jack the Ripper, examples of mail received claiming to be from Jack the Ripper.
The Macnaghten memo. This report by Chief Constable Sir Melville Macnaghten has had the greatest influence over common knowledge of the Jack the Ripper murders. This report was not publically available until 1959 and the complete report was not made available for viewing and reproduction until 2002. The report sets the number of Jack the Ripper murders at five. It names Macnaghten's three prime suspects.
FBI FILES
In 1988, one-hundred years after the Jack the Riper/Whitechapel Murders, the FBI applied its modern knowledge to the case. A seven page criminal investigative analysis was produced by the top criminal profiler at the FBI National Center for the Analysis of Violent Crime. This analysis report addresses: Victimology or profile of victims; medical examiner's findings; crime and crime scene analysis; communications allegedly received from Jack the Ripper; offender traits and characteristics; pre- and post-offense behavioral patterns; investigative and/or proactive techniques; and interview/interrogation suggestions.This report not only sheds light on the Jack the Ripper - Whitechapel Murders, it also acts a a primer for analysis of multiple murderers.
Requires Windows or MAC
From publisher on generic CD-ROM
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=378&item=4528967894&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1711
Registered: 4-2003
| | Posted on Thursday, February 17, 2005 - 11:27 am: |
|
First of all, let me say that I am NOT out of the Ripper book business, BUT I am clearing out several pieces of Ripper art and memorabilia.
The next auction for these Ripper pieces is an original miniature diorama showing a cloaked and top-hatted Ripper leaving Mary Jane Kelly's room and walking out toward Dorset Street. Ripper figure is 3/4" tall. OVERALL SIZE IS 3 5/8" LONG BY 2" WIDE AND 2" TALL. The back of one of the alley walls is Kelly's exposed room, with door, bed and table, plus a portion of the window. Back of the opposite wall is blank, as the focus should be Miller's Court, the room and the Ripper. ONE OF A KIND. FIRST TWO PHOTOS SHOW THE DIORAMA WITHOUT THE CLEAR PLASTIC COVER. ANY QUESTIONS?? PLEASE ASK.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=1467&item=5558789509&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1712
Registered: 4-2003
| | Posted on Thursday, February 17, 2005 - 11:28 am: |
|
Next in this group of auctions for these Ripper pieces is an original ceramic piece showing the Ripper and a victim. Even though NOT particularly accurate in many ways, this is a classic Ripper collectible. The ceramic base is labelled JACK THE RIPPER, and the two figures are attached by screws through the base. At the Ripper's feet is the expected black bag, holding a pair of bloody scissors covered with a bloody cloth. It's not really necessary to show that the victim's dress is pulled open from the waist up, and her breasts are exposed, so you get the picture.......RIGHT?? SIZE IS 14" TALL BY 10" WIDE (AT THE BASE) AND 6 1/2" DEEP ( AT THE BASE). WEIGHT IS 8 POUNDS. THERE ARE A FEW TINY NICKS IN THE PAINT THAT WERE PRESENT WHEN I BOUGHT THIS PIECE, BUT NO DAMAGE TO THE PIECE ITSELF. ANY QUESTIONS??? PLEASE ASK
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=1468&item=5558773022&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1713
Registered: 4-2003
| | Posted on Thursday, February 17, 2005 - 11:36 am: |
|
WHO WAS JACK THE RIPPER
1988
Published in 1988 in the UK by Pipeline Publication.
Magazine size is 9" x 12".
Condition of this magazine is good+ with some edge wear,
some wearing to corners, some scuffing along cover edges,
some light creases to covers, some tanning to pages.
27 pages.
Rare magazine the was published in 1988 to tie in with the
much publicized Jack the Ripper mini-series starring Michael Caine.
There are a few shots from the series as well as a rundown
of the victims and the suspects. Text written by Winston Forbes-Jones.
http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&category=378&item=4528169450&rd=1 |
Chris Scott
Assistant Commissioner
Username: Chris
Post Number: 1714
Registered: 4-2003
| | Posted on Thursday, February 17, 2005 - 11:40 am: |
|
PRINCE RIPPER AND THE ROYAL FAMILY--JACK THE RIPPER
Item Specifics - Nonfiction Books
Format: Softcover Category: True Crime
Publication Year: 2005
This sale notice leads to a url as follows:
http://www.rembrandtandcompany.com/Coming%20Soon.htm
"For nearly 117 years, the brutal case of Jack the Ripper has mystified authors,
filmmakers, and even the media. Theories of Jack the Ripper's identity have
produced assertions of the villain ranging from a policeman to an artist and a
midwife to a shochet. But one theory, more than any other, continues to gain in
popularity. Prince Ripper and the Royal Family is an analysis of how the modern
media views the Royal Conspiracy Theory. Even though experts in forensics,
Victorian Studies, and law enforcement have disregarded the Royal Conspiracy Theory,
it continues to resurface in our present day books and movies. Based upon experts
such as John Douglas and seminal literature into society by authors such as Richard
Hofstadter, Ripper and the Royal Family is a search for more than just the identity
of Jack the Ripper. It is a search for why we, as
a society, need this unsolved mystery and why our fascination with the Royal
Conspiracy Theory continues to grow with each new generation."
Shipping in February
|
