new malware info

On Tue, 13 Jun 2006 14:03:43 -0500, willbill <trek DeleteThis @worldwide.net> wrote:

>new malware info
>
>see:
>
>www.pcmag.com/article2/0,1895,1976159,00.asp
>
>www.informationweek.com/security/showArticle.jhtml?articleID=189400457&subSection=Viruses+and+Patches
>
>www.itwire.com.au/content/view/4612/53/
>
>fwiw, i clearly have something on my
>Win XP SP2 machine.
>
>i noticed it 2 weeks ago (during a 100GB d/l
>day via dial-up modem)
>
>and again this past weekend

Symptoms?

>which got me around (finally) to using
>a h/w router (that i bought 18 months
>ago but never got around to using it)
>
>for the moment, the router has saved
>the day

So the router's blocking the trash chat of the worm/trojan/whatever?

> - - - - - -
>
>i've yet to do an update with microsoft
>for XP SP2. i mean, the whole thing has
>looked beyond daunting to me
>
>any suggestions on how to *best*
>
>(without screwing everything up,
> and with minimizing future update
> download volume and times) will be
> VERY much appreciated!!

Run MSCONFIG and check Services tab with "Hide All Microsoft Services"
checked - also look in Startup tab for suspicious prog names; you should
only find things to do with required progs like for video, chipset, sound,
AV, etc. Generally malware will put itself back in Services or Startup on
the next reboot if you disable/remove it... and often even without a
reboot.

Go to www.sysinternals.com (Mark Russinovich is the guy who exposed the
Sony Rootkit) and get Rootkit Revealer and Process Explorer. Again check
for suspicious stuff... and read the instructions on what might be "normal"
for Rootkit Revealer. Try to get details on every process shown by Process
Explorer, so you're satisified it's benign. You'll probably find some
other interesting software there for poking around in files and system.

I assume you have some kind of Anti-Virus software but it finds nothing?
Try running it in Safe Mode before giving up with it. Also get and run
Ad-Aware, Spybot S&D and Ewido... with their latest definitions. Again,
Safe Mode will have a better chance of removing villains.

If you have to resort to manual removal of anything, you'll have to weigh
the estimated time to complete -- it can be considerable -- against the
"cost" of a clean reinstall. I've never had to do a clean reinstall to rid
(other peoples' ) computers of malware *yet* but some of them have been
very time-consuming... days is not out of the question if you count all the
research and searching.

I'd strongly advise getting the Windows Updates.. and note that you'll very
likely get download failures with a bunch of messages in WindowsUpdate.log
which say "Download failed due to regulation". M$ has no one explanation
or fix for those but eventually, days or even weeks, they seem to go
away.<shrug>

--
Rgds, George Macdonald
 >> Stay informed about: new malware info 

George Macdonald wrote:

> On Tue, 13 Jun 2006 14:03:43 -0500, willbill <trek RemoveThis @worldwide.net> wrote:

>>new malware info
>>
>>see:
>>
>>www.pcmag.com/article2/0,1895,1976159,00.asp
>>
>>www.informationweek.com/security/showArticle.jhtml?articleID=189400457&subSection=Viruses+and+Patches
>>
>>www.itwire.com.au/content/view/4612/53/
>>
>>fwiw, i clearly have something on my
>>Win XP SP2 machine.
>>
>>i noticed it 2 weeks ago (during a 100GB d/l
>>day via dial-up modem)
>>
>>and again this past weekend
>
>
> Symptoms?


2+ weeks ago, my next to last session, of the
100GB day, i'd downloaded ~3GB of a Nero 6 update,
(via a d/l manager) and looked at the I/O stats,
that the XP dialer was showing, and saw that i'd
sent *out* about 1.5GB of data!

i of course cut the connection; easy to do when
one has an external modem. a bit of a pain with
XP (as opposed to 98SE), but no big deal with XP

a similar thing again happened this past weekend

too bad i didn't think to take a long look
at my s/w firewall logs.

the whole thing doesn't make sense.
assuming i'm correct (and yes, i could
be wrong about this) why would anyone
want to sift thru gigs of my data?

i'd think that 99+% of the stuff that's
on most PCs is not worth taking the time
to actually look at

i don't keep sensitive stuff on my PC.
no checking account stuff, no credit
card stuff, etc.

the one minor thing that i did have on it
was the password for my dialup ISP account
(which i changed this past Monday)


>>which got me around (finally) to using
>>a h/w router (that i bought 18 months
>>ago but never got around to using it)
>>
>>for the moment, the router has saved
>>the day


> So the router's blocking the trash chat of the worm/trojan/whatever?


i hope so; meaning that i think that
it is, but i'm not totally sure at
this point

problem is that i've got no real-time
insight into what is actually going on
with the in/out data transfer of the
external modem any more (since the
router deals with it and my PC doesn't
see the external modem any more)

i like what i've learned (so far) about
using a router with a single personal PC
(or 2 PCs when i get my new machine fully
functional)


>> - - - - - -
>>
>>i've yet to do an update with microsoft
>>for XP SP2. i mean, the whole thing has
>>looked beyond daunting to me
>>
>>any suggestions on how to *best*
>>
>>(without screwing everything up,
>> and with minimizing future update
>> download volume and times) will be
>> VERY much appreciated!!
>
>
> Run MSCONFIG and check Services tab with "Hide All Microsoft Services"
> checked


how interesting

that does make it easier to see the 3rd
party s/w that is running on XP

does checking it do anything else?

i mean, XP does the usual thing and states
that i have to reboot for all changes to
take effect

this is one time when i have to think
that nothing will be different when
i reboot


> - also look in Startup tab for suspicious prog names;


nothing. i've looked with my old ZTree
file manager, which i have confidence
shows me *everything*


> you should
> only find things to do with required progs like for video, chipset, sound,
> AV, etc. Generally malware will put itself back in Services or Startup on
> the next reboot if you disable/remove it... and often even without a
> reboot.
>
> Go to www.sysinternals.com (Mark Russinovich is the guy who exposed the
> Sony Rootkit) and get Rootkit Revealer and Process Explorer.


thanks for the ref.


> Again check
> for suspicious stuff... and read the instructions on what might be "normal"
> for Rootkit Revealer. Try to get details on every process shown by Process
> Explorer, so you're satisified it's benign. You'll probably find some
> other interesting software there for poking around in files and system.
>
> I assume you have some kind of Anti-Virus software but it finds nothing?
> Try running it in Safe Mode before giving up with it.

good idea

at the moment, my running s/w, for firewall and
virus, is System Suite 6 Pro by VCOM

now that they've been bought out, i am
distraught in that i had some trust
with VCOM products, and seriously suspect
that i no longer can


> Also get and run
> Ad-Aware, Spybot S&D and Ewido... with their latest definitions.


i don't think so

i bought one of them (not your list)
and it didn't do squat, just slowed my
machine down


> Again,
> Safe Mode will have a better chance of removing villains.



thank you again (and to NNN) for that

i booted XP into safe mode and ran
both the SS6 virus checker and also
the SS6 malware checker, with no finds


>
> If you have to resort to manual removal of anything, you'll have to weigh
> the estimated time to complete -- it can be considerable -- against the
> "cost" of a clean reinstall.


i'm NOT gonna do a reinstall!

i mean, what is the price i pay? that some
spybot pgm is sending my data out

other than that, when i'm offline, there
are no issues


> I've never had to do a clean reinstall to rid
> (other peoples' ) computers of malware *yet* but some of them have been
> very time-consuming... days is not out of the question if you count all the
> research and searching.
>
> I'd strongly advise getting the Windows Updates..


i totally agree

what a PITA this whole Win XP thing is

i never did an update with Win 98SE


> and note that you'll very
> likely get download failures with a bunch of messages in WindowsUpdate.log
> which say "Download failed due to regulation". M$ has no one explanation
> or fix for those but eventually, days or even weeks, they seem to go
> away.<shrug>


aw geez

not what i wanted to hear.

aside from that, thank you very much
for your detailed comments

at the moment, i'm taking a long hard
look at a better, more expensive, router
that offers real-time I/O status of what
is going on with the modem

bill
 >> Stay informed about: new malware info 

On Wed, 14 Jun 2006 13:13:11 -0500, willbill <trek RemoveThis @worldwide.net> wrote:

>George Macdonald wrote:
>
>>
>> Run MSCONFIG and check Services tab with "Hide All Microsoft Services"
>> checked
>
>
>how interesting
>
>that does make it easier to see the 3rd
>party s/w that is running on XP
>
>does checking it do anything else?
>
>i mean, XP does the usual thing and states
>that i have to reboot for all changes to
>take effect
>
>this is one time when i have to think
>that nothing will be different when
>i reboot

Correct. When you click OK on the box, it just *assumes* you've made some
changes, whether you have or not.

>> I assume you have some kind of Anti-Virus software but it finds nothing?
>> Try running it in Safe Mode before giving up with it.
>
>good idea
>
>at the moment, my running s/w, for firewall and
>virus, is System Suite 6 Pro by VCOM
>
>now that they've been bought out, i am
>distraught in that i had some trust
>with VCOM products, and seriously suspect
>that i no longer can

I dunno what to do about AV at the office. I recently explained to a
couple of irate users that our network was "working fine" and that the long
pauses when they right click and/or "Send To" a program, for a file in a
network folder, were due to Symantec Ant-Virus - it "breaks" DDE. Their
"solution" was to turn off the Symantec AV Service. Between that and
Symantec's whole attitude to bugs, fixes and their licensing/pricing I'm
disgusted with them. I've looked around and I still don't know what
alternative there is - seems to be a common problem: finding a good AV
program.

>> Also get and run
>> Ad-Aware, Spybot S&D and Ewido... with their latest definitions.
>
>
>i don't think so
>
>i bought one of them (not your list)
>and it didn't do squat, just slowed my
>machine down

I can assure you that those are all good stuff and have free or "trial"
versions. Each has helped me at one time or another to eliminate
malware... with no intrusive behavior.

--
Rgds, George Macdonald
 >> Stay informed about: new malware info 

George Macdonald wrote:

> On Wed, 14 Jun 2006 13:13:11 -0500, willbill <trek RemoveThis @worldwide.net> wrote:

>>George Macdonald wrote:
>>
>>
>>>Run MSCONFIG and check Services tab with "Hide All Microsoft Services"
>>>checked
>>
>>
>>how interesting
>>
>>that does make it easier to see the 3rd
>>party s/w that is running on XP
>>
>>does checking it do anything else?
>>
>>i mean, XP does the usual thing and states
>>that i have to reboot for all changes to
>>take effect
>>
>>this is one time when i have to think
>>that nothing will be different when
>>i reboot
>
>
> Correct. When you click OK on the box, it just *assumes* you've made some
> changes, whether you have or not.


ok. that's what i suspected.

fwiw, my prior response used GB when i should
have used MB. there's no way i could do
a 100 GB download in 10 hours with dialup (LOL).
i mean, i have a total of about 33GB on this machine


>>>I assume you have some kind of Anti-Virus software but it finds nothing?
>>>Try running it in Safe Mode before giving up with it.
>>
>>good idea



in other words, i tried it
(booted XP into safe mode)
and ran both the malware deep
scan and the virus deep scan,
and found nothing


>>
>>at the moment, my running s/w, for firewall and
>>virus, is System Suite 6 Pro by VCOM
>>
>>now that they've been bought out, i am
>>distraught in that i had some trust
>>with VCOM products, and seriously suspect
>>that i no longer can
>
>
> I dunno what to do about AV at the office. I recently explained to a
> couple of irate users that our network was "working fine" and that the long
> pauses when they right click and/or "Send To" a program, for a file in a
> network folder, were due to Symantec Ant-Virus - it "breaks" DDE. Their
> "solution" was to turn off the Symantec AV Service. Between that and
> Symantec's whole attitude to bugs, fixes and their licensing/pricing I'm
> disgusted with them. I've looked around and I still don't know what
> alternative there is - seems to be a common problem: finding a good AV
> program.


using this ~$85 NAT/firewall router (SMC 7008ABR)
has been interesting. it's clunky to use, but
i suspect that it has helped; which is why i'm
looking into finding a higher end router that
will offer real-time input as to what is going
on with my external modem



>>>Also get and run
>>>Ad-Aware, Spybot S&D and Ewido... with their latest definitions.
>>
>>
>>i don't think so
>>
>>i bought one of them (not your list)
>>and it didn't do squat, just slowed my
>>machine down
>
>
> I can assure you that those are all good stuff and have free or "trial"
> versions. Each has helped me at one time or another to eliminate
> malware... with no intrusive behavior.


thank you again for that

i'll 1st run the 2 programs that you ref'd
(in your last response), and then fight my
way thru doing my 1st update to XP

(1st doing a full clone backup of my 250GB
main IDE disk, to a secondary 250GB IDE disk
(2GB/min on a same cable master/slave hookup))

as you might guess, i do NOT use IE,
Outlook Express, or any of the other
M$ crud that is included with XP

my current browser is Mozilla 1.7.12
(updated a couple of months ago from
1.7.7 without any pain)

you recently mentioned you gave up on
Firefox and went back. current name
is some odd thing like Sea-monkey?
what version are you running?

that's with Win XP?

bill
 >> Stay informed about: new malware info 

George Macdonald wrote:
<big snip>

i see from headers that you are using:
Forte Free Agent 1.93/32.576

why on earth do you do that?

in my experience, Agent is the *best*
newsgroup reader (i'm using (paid for)
2.0/32, which has been great)

bill
 >> Stay informed about: new malware info 

On Wed, 14 Jun 2006 17:46:19 -0500, willbill <trek.RemoveThis@worldwide.net>
wrote:

....snip...
>
>in other words, i tried it
>(booted XP into safe mode)
>and ran both the malware deep
>scan and the virus deep scan,
>and found nothing
>
>
....more snip
>
>bill

While the probability of that is not exactly big, your box might be
rootkitted. Played a Sony CD lately? Try Rootkit Revealer or
something like that.
Also check HKEY_LOCAL_MACHINE -
SOFTWARE-Microsoft-Windows-CurrentVersion-Run for any unusual entries.

NNN
 >> Stay informed about: new malware info 

On Wed, 14 Jun 2006 16:47:33 -0400, George Macdonald
<fammacd=!SPAM^nothanks@tellurian.com> wrote:

>I dunno what to do about AV at the office. I recently explained to a
>couple of irate users that our network was "working fine" and that the long
>pauses when they right click and/or "Send To" a program, for a file in a
>network folder, were due to Symantec Ant-Virus - it "breaks" DDE. Their
>"solution" was to turn off the Symantec AV Service. Between that and
>Symantec's whole attitude to bugs, fixes and their licensing/pricing I'm
>disgusted with them. I've looked around and I still don't know what
>alternative there is - seems to be a common problem: finding a good AV
>program.

I don't suppose educating them, so that you won't even need AV, is an
option, is it?

and I guess neither is putting them all on Linux?

How about CA Antivirus? One of my friends recently started using it
for his office and from what I understand, it's very much cheaper than
SAV. Don't ask me if it's any good, I don't use any AV


--
A Lost Angel, fallen from heaven
Lost in dreams, Lost in aspirations,
Lost to the world, Lost to myself
 >> Stay informed about: new malware info 

On Wed, 14 Jun 2006 17:46:19 -0500, willbill <trek.TakeThisOut@worldwide.net> wrote:

>George Macdonald wrote:

>>>>Also get and run
>>>>Ad-Aware, Spybot S&D and Ewido... with their latest definitions.
>>>
>>>
>>>i don't think so
>>>
>>>i bought one of them (not your list)
>>>and it didn't do squat, just slowed my
>>>machine down
>>
>>
>> I can assure you that those are all good stuff and have free or "trial"
>> versions. Each has helped me at one time or another to eliminate
>> malware... with no intrusive behavior.
>
>
>thank you again for that
>
>i'll 1st run the 2 programs that you ref'd
>(in your last response), and then fight my
>way thru doing my 1st update to XP
>
>(1st doing a full clone backup of my 250GB
>main IDE disk, to a secondary 250GB IDE disk
>(2GB/min on a same cable master/slave hookup))
>
>as you might guess, i do NOT use IE,
>Outlook Express, or any of the other
>M$ crud that is included with XP
>
>my current browser is Mozilla 1.7.12
>(updated a couple of months ago from
>1.7.7 without any pain)

Yeah I used Mozilla 1.7.12 for a while up till the "end".

>you recently mentioned you gave up on
>Firefox and went back. current name
>is some odd thing like Sea-monkey?
>what version are you running?
>
>that's with Win XP?

Yup, Seamonkey 1.0.2 is the current version. I'm still persisting with
Firefox at the office... for comparison.

--
Rgds, George Macdonald
 >> Stay informed about: new malware info 

On Wed, 14 Jun 2006 19:12:39 -0500, willbill <trek.TakeThisOut@worldwide.net> wrote:

>George Macdonald wrote:
><big snip>
>
>i see from headers that you are using:
>Forte Free Agent 1.93/32.576
>
>why on earth do you do that?

It err, works.

>in my experience, Agent is the *best*
>newsgroup reader (i'm using (paid for)
>2.0/32, which has been great)

Yes, I've been meaning to go paid for a while but annoying upgrade
"differences" in the past, inertia and laziness are powerful.

--
Rgds, George Macdonald
 >> Stay informed about: new malware info 

On Thu, 15 Jun 2006 15:35:08 GMT, a?n?g?e?l@lovergirl.lrigrevol.moc.com
(The little lost angel) wrote:

>On Wed, 14 Jun 2006 16:47:33 -0400, George Macdonald
><fammacd=!SPAM^nothanks@tellurian.com> wrote:
>
>>I dunno what to do about AV at the office. I recently explained to a
>>couple of irate users that our network was "working fine" and that the long
>>pauses when they right click and/or "Send To" a program, for a file in a
>>network folder, were due to Symantec Ant-Virus - it "breaks" DDE. Their
>>"solution" was to turn off the Symantec AV Service. Between that and
>>Symantec's whole attitude to bugs, fixes and their licensing/pricing I'm
>>disgusted with them. I've looked around and I still don't know what
>>alternative there is - seems to be a common problem: finding a good AV
>>program.
>
>I don't suppose educating them, so that you won't even need AV, is an
>option, is it?

Impossible - they get a hit... after they've got the thing totally messed I
get to clean up. A few weeks later they get hit again. I don't believe
it's practical to use the Internet any longer without some form of
protection whether it be corporate filtering or AV software.

>and I guess neither is putting them all on Linux?
>
>How about CA Antivirus? One of my friends recently started using it
>for his office and from what I understand, it's very much cheaper than
>SAV. Don't ask me if it's any good, I don't use any AV

I've read several articles and the concensus is pretty consistent - none of
them are "good".

--
Rgds, George Macdonald
 >> Stay informed about: new malware info 

Bitstring <q6p392hc1vvsqqavvajp3qm7k2304o82p6 DeleteThis @4ax.com>, from the
wonderful person George Macdonald <fammacd=!SPAM^nothanks@tellurian.com>
said
>On Thu, 15 Jun 2006 15:35:08 GMT, a?n?g?e?l@lovergirl.lrigrevol.moc.com
>(The little lost angel) wrote:
>
>>On Wed, 14 Jun 2006 16:47:33 -0400, George Macdonald
>><fammacd=!SPAM^nothanks@tellurian.com> wrote:
>>
>>>I dunno what to do about AV at the office. I recently explained to a
>>>couple of irate users that our network was "working fine" and that the long
>>>pauses when they right click and/or "Send To" a program, for a file in a
>>>network folder, were due to Symantec Ant-Virus - it "breaks" DDE. Their
>>>"solution" was to turn off the Symantec AV Service. Between that and
>>>Symantec's whole attitude to bugs, fixes and their licensing/pricing I'm
>>>disgusted with them. I've looked around and I still don't know what
>>>alternative there is - seems to be a common problem: finding a good AV
>>>program.
>>
>>I don't suppose educating them, so that you won't even need AV, is an
>>option, is it?
>
>Impossible - they get a hit... after they've got the thing totally messed I
>get to clean up. A few weeks later they get hit again. I don't believe
>it's practical to use the Internet any longer without some form of
>protection whether it be corporate filtering or AV software.
>
>>and I guess neither is putting them all on Linux?
>>
>>How about CA Antivirus? One of my friends recently started using it
>>for his office and from what I understand, it's very much cheaper than
>>SAV. Don't ask me if it's any good, I don't use any AV
>
>I've read several articles and the concensus is pretty consistent - none of
>them are "good".

AVG free edition is pretty good for the price, although it won't play
nicely with all email programs, and it's strictly for personal use. At
least it is low impact. Trend PcCillin (or whatever it's called now)
also works OK for me, but is more resource hungry. Norton is best
avoided unless you have a spare core or two to run it on. 8>.

--
GSV Three Minds in a Can
Google may be your friend, but groups.google.com posters definitely aren't.
 >> Stay informed about: new malware info 

George Macdonald wrote:

>> i see from headers that you are using:
>> Forte Free Agent 1.93/32.576
>>
>> why on earth do you do that?
>
> It err, works.

To err is human.

*SCNR, hides and runs*
 >> Stay informed about: new malware info 

On Thu, 15 Jun 2006 19:03:12 -0400, George Macdonald
<fammacd=!SPAM^nothanks@tellurian.com> wrote:

>>I don't suppose educating them, so that you won't even need AV, is an
>>option, is it?
>
>Impossible - they get a hit... after they've got the thing totally messed I
>get to clean up. A few weeks later they get hit again. I don't believe
>it's practical to use the Internet any longer without some form of
>protection whether it be corporate filtering or AV software.

Any idea why/where are they getting hits from? I use them online scans
every couple of months to verify my laptop and desktop status and it's
really been donkey years since I last got a hit that wasn't expected
(some mails come with viral attachments so until they get trashed, AV
gets a fit in my attachment folder).

I do just about all the common office tasks, browsing, emails, IM,
documents etc. Even my siblings who are not exactly computer experts
have been able to stay clear for as long.

--
A Lost Angel, fallen from heaven
Lost in dreams, Lost in aspirations,
Lost to the world, Lost to myself
 >> Stay informed about: new malware info