IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

New Safari cookies anomaly
Safari V.5.0.4. (6533.20.27) on '08 iMac 20, Model MB324LL/A w/ Snow-L.

Cleaning out cookies (but not 'ALL' == prefer to keep some, but may next have no choice)
IF.. 'Remove All' is fast enough to grab/squash this monster between cycles. ie.
Came across an UN-deletable cookie from, Guess Who ?!? ONE !!!
This one:

Website: ".support.microsoft.com"
Name: fmshb
Path: /
Expires: [blank]
Contents: A (now) 13-digit number, incrementing ~ 1/sec. No other symbols, words.

(Increments vary, not one-digit/sec but various near "1000", sometimes exactly 1000 several times in a row
-- others a few over 1000.)
Google was singularly uninformative re 'fmshb' and pooped out with any additions, like the Beast-website addy of this thing.

Any ideas whence came this spawn-of-The-Beast?
I'd settle for a removal antitoxin, but it's better to know how it was enabled to steal MY precious CPU-cycles.
Problem is ... as it's constantly altering, 'hilite + Remove' won't work, even at Yeti-whacking mouse-finger speeds.

Possible/likely? origin:
This sucker might have come about while I was looking for reasons for a Beast error on a Dell Dim. 8100, and got this message:

Windows Protection Error. You need to restart your computer. Restarts got Safe mode (only).
A previous 98-Lite, working install is on this Dell and error occurred after newly installed 4x256M PC600/800 RDRAM RIMMs, allegedly supposed to be installed "in matched pairs".
The 4 weren't 'paired'. And maybe only need an arbitrary swap, if That is what 98 is bitching about.
Yeah.. RDRAM didn't stay around for long, did it?
Had run memtest for several hours [0 errors] before trying to launch 98SE.

As there are n-causes of this error message, Google's matches sent me to various sites, none of which gave any useful logical triage. Possibly one of these sent the sucker, as I doubt that Beast HQ has time for games.
Natch I was surfing on the Mac, which makes this all seem peculiar. I don't even much care about the Dell's fate / subtly-bad mem, say!
It was pretty useless with 256M before and I would have just given it away if the new (rilly-cheap, used/tested?) memory had worked.
At least w/1GB you can do Something on any Linux distro.

Any hints welcomed..
New Seems to be a MS Support Forum Cookie function or something.
E.g. from here - http://www.csupomona...20permissions.mht

<SCRIPT type=3Dtext/javascript>var enableSiteSurvey =3D true;function =
isDomainTracking(){var entry =3D =
MS.Support.Fms.CookieUtil.getCookie('fmshb');if (entry){try{return =
entry.split(',')[0] =3D=3D '1' ? true : false;}catch (e){return =
false;}}return =


=3D is some sort of encoded (equality?) character like %20 is (/ or space), I think.

Note the "MS.Support.Fms.CookieUtil.getCookie bit.

I'm sure you can just get rid of it. MS will just give you a new one when you go back there. If it keeps reappearing, then I assume that means that something is running to keep going back there to grab a new one.

As to why it's incrementing a counter, I have no idea.

SafariCookies may make the process easier - I haven't used it myself. http://sweetpproduct...cookies/index.htm

HTH a little. Good luck!

Cheers,
Scott.
New Thanks for hints.
I came across that incomprehensible multi-pageful of scripts too.

So [whatever put it on there] appears to be using this Beastware-spawned java aplet (?) as a repository
-- but for What?
Even typing in ".micro....." so that there's only that one entry on page, then 'Erase All' - gets it to disappear
... for half a second, and then It's BAAACK.

Methinks this thing Shouldn't Be allowed-to-stay.. if it ain't MyWare, it's MalWare.
Considered reloading Safari from current Apps copy, but have to ensure that History shall not then become, er, History. Then on to Root Kit Revealer (via whatever incarnation for OS X.)

Oh well, forces me to improvise..

Edit:
Nuking, reloading Safari appears to have erased the sucker.
(Though unclear why a reload *should* tamper with stored cookies..)
guess we don't get to know Everything :-/
Duh. try the obvious next time -- earlier.

Expand Edited by Ashton May 16, 2011, 06:21:36 AM EDT
     Safari cookies anomaly - (Ashton) - (2)
         Seems to be a MS Support Forum Cookie function or something. - (Another Scott) - (1)
             Thanks for hints. - (Ashton)

Hm. It all seems to cancel out. I’m back to not caring.
115 ms