Use IE? Frelling TROJAN VIRUS ALERT!

[StarsGoBlue]

Something really weird happened to me as I was sending a PM here tonight... I got a ZoneAlarm popup alert that asked if I wanted to allow my eBay password to be sent to watchfarscape.com... :eek:

Of course I denied it, and being the maybe-paranoid-but-maybe-better-safe-than-sorry girl I am, I went into my internet tools and cleared all my cookies, my history, my temp internet files, and my autocomplete forms and passwords. I also changed my Paypal password and checked my eBay ID to make sure "I" hadn't started any surprise auctions or placed any bids.

Jul mentioned that she'd found a Trojan virus on her computer, so I checked out Zone Alarm's website and saw this:


Download.Ject Trojan

Overview: Zone Labs has identified a new delivery mechanism for a previously-known malicious Trojan Horse, referred to as Download.Ject, which is spreading rapidly across the Internet. The Download.Ject Trojan has been rated "High Risk." Computer users should apply the recommended actions listed below to protect their systems.

This exploit only works against computer systems using Internet Explorer to browse the Internet. Computer users running other web browsers will not be impacted. At this time, Microsoft has not provided an Internet Explorer patch to prevent compromise.

Date Published: June 25, 2004
Date Last Revised: June 25, 2004

Impact: Download.Ject attempts to:

-Install malicious software on computers
-Capture usernames, passwords, and credit card information
-Send the captured information to a server on the Internet


Description: Download.Ject Download.Ject compromises system integrity through a multi step process:

-A vulnerable IIS web server is compromised and malicious JavaScript code is appended to the web pages. IIS servers vulnerable to MS04-011 are the apparent target.
-Vulnerable Internet Explorer web browsers that view the compromised website will execute the malicious JavaScript code.
-The JavaScript code will install several malicious files on the client system.
-Upon execution, the Trojan horse creates the following files:
[6_character_random_name]32.exe
[8_character_random_name].exe
Surf.dat

The worm also attempts to connect to the malicious server at:

217.107.218.147

So now I've run AdAware and am running Spybot and will finish up with Norton AntiVirus before I go to bed... just thought I'd pass along the heads-up.

Link to read for yourself: http://download.zonelabs.com/bin/free/securityAlert/12.html

[AgentSun]

whoo, using firefox, baby!

[Jul]

The trojan on my computer was JS.Scob.Trojan and according to symantec (i have norton antivirus) it was discovered yesterday and "The Trojan's dropper sets it as the document footer for all pages served by IIS Web sites on the infected computer".

http://securityresponse.symantec.com/avcenter/venc/data/js.scob.trojan.html

working on cleaning out my system now..

[BritAngie]

Has it anything to do with this?

http://ct.com.com/click?q=8c-Ld7aQ6JEHtVTvkGu3L~Yl4wGEBdR

[soyarma]

Just letting folks know that the wfs sever is safe since it runs the Apache webserver and not IIS (MS's webserver). So you don't have to worry bout getting infected here (doing a full scan on the webserver anywho just to be doubly sure).

[Jellyfish]

Thanks soyarma you da man.

[grinner]

is it the same as this (http://www.watchfarscape.com/forums/showthread.php?t=25604) article?

[BaseLine]

I believe so.

[Xevallah]

whoo, using firefox, baby!

Yes, isnt it great? What skin do you use?

[AgentSun]

right now i'm using noia. you?

[scrape_medic]

Does anyone know how you know if you HAVE been infected?

[Jul]

I just ran my routine virus scan and it popped up... i figured something was wrong because my computer had slowed down in booting up...

[Kathleen]

Wow.. I"m fixing to run Spybot 1.3, Adaware and a virus scan on mine. Thanks for the info on this. I run IE 6.01, so this is definitely something I want to keep up with.

[Poseidon]

Something really weird happened to me as I was sending a PM here tonight... I got a ZoneAlarm popup alert that asked if I wanted to allow my eBay password to be sent to watchfarscape.com... :eek:

Of course I denied it, and being the maybe-paranoid-but-maybe-better-safe-than-sorry girl I am, I went into my internet tools and cleared all my cookies, my history, my temp internet files, and my autocomplete forms and passwords. I also changed my Paypal password and checked my eBay ID to make sure "I" hadn't started any surprise auctions or placed any bids.

Jul mentioned that she'd found a Trojan virus on her computer, so I checked out Zone Alarm's website and saw this:



So now I've run AdAware and am running Spybot and will finish up with Norton AntiVirus before I go to bed... just thought I'd pass along the heads-up.

Link to read for yourself: http://download.zonelabs.com/bin/free/securityAlert/12.html

Same thing happened to me a few weeks ago. I recieved the exact same messages as you did. I took care of it right away.

[BrowderChick]

Well i am the really paranoid one here as I have been hacked before so I run everythign all the time anyways. But I did run everything again. LOLOL

Thanks for the heads up :aok:

[Spedoinkel]

More points for Mozilla Firefox.

[AgentSun]

ohh yeah. actually, firefox just messed up because some of the skins are buggy. i ended up uninstalling all of it and reinstalling firefox.

[Jeff O'Connor]

I just got Firefox last night after all the hype about it.

[Xevallah]

right now i'm using noia. you?

Coincidently the same! :P

[Spedoinkel]

I don't use the skins and haven't had any problems except some pages say they nee IE or they won't run for you. fortunatley these are very few and far between.

[Kathleen]

I actually just finished downloading firefox after discussing it with a friend of mine who swears by it!! I have to say that I am liking what I see. I'll have to get used to it, as I've used IE for the last 4 1/2 years, but it's very nice!!!!!

Oh, and I'm using noia eXtreme skin and I got the firesomething extension--- it's hysterical!!! :D

[soyarma]

I use about 215 different computers on a weekly basis so I keep everything I use bone stock default (cept that I make windows xp look like windows 2000) so that everything functions and is laid out the same.

[Xevallah]

I use about 215 different computers on a weekly basis so I keep everything I use bone stock default (cept that I make windows xp look like windows 2000) so that everything functions and is laid out the same.

Suprising. You would think if one is surrounded by a plathora of individualized computers (?) one would want himself to individualize his computer. Ofcourse, I am assuming your some kinda computer repair guy / technician.

[grinner]

Firefox 0.8 vs. Mozilla 1.7

Okay, I have used both... and prefer Mozilla 1.7 over Firefox. Does more. Why do some of you prefer Firefox. It is a very stripped down browser whereas the Mozilla has all that Netscrape had plus a whole lot more.

[Jeff O'Connor]

Upon reading that, grinner, I tried out Mozilla 1.7 and I have to say that so far it seems very nice but the smaller amount of viewing space is rather nerve-wrecking for me at the moment.

[Spedoinkel]

I just got on to Firefox after it was recommended to be when omplained that both Spybot and Adaware weren't getting all the funk out of my system.

[grinner]

Upon reading that, grinner, I tried out Mozilla 1.7 and I have to say that so far it seems very nice but the smaller amount of viewing space is rather nerve-wrecking for me at the moment.
get a bigger monitor.:P:P:P

[bubblez]

Firefox 0.8 vs. Mozilla 1.7



Is there a B-rated Japanese movie in the works here?

...and grinner, is that Eddie you have in your avatar?

[grinner]

yes it is.

[Mike0812]

Is there a B-rated Japanese movie in the works here?


:lol

[Kathleen]

I haven't tried out Mozilla 1.7 .. I went with Firefox because it was recommended by several different friends (including my best friend that swears by it)... I like it mainly because it IS bare-bones when you get it... I've been able to really individualize and tweak it to the way *I* want it to be.. I still have more to do to it, but it's really easy to use if you're a bit more aware of the terminology and lingo. I only had to use one life-line (Phone-a-friend) while getting it set-up. :D

[bubblez]

yes it is.

excellent... rock on!!

[Scaramouche]

I am using Firefox... just getting used to it. Used to use Opera.

[faustus]

wat's the improvement from Opera to Firefox?

[AgentSun]

i just didn't like opera at all. it didn't click to me. i knew how to use netscape so firefox was an obvious transition for me.

as for mozilla vs. firefox, i like firefox because i don't need all of mozilla's utilities. i don't use outlook express so i don't need mail capabilities. and i rarely use IRC to the point where it's on all the time. i would consider switching if there was something i really needed in it, but for it's convenience, i don't need it.

[Spedoinkel]

While we're on the subject of utilites I use Trillian for my instant message needs. It combines Yahoo, MSN, AOL, IRC, and ICQ messangers into one program with all of the functions of the others, and it's skinable. I haven't had problems though some people like Gaim better for all the plug-ins. I haven't actually sat down and worked with it, because you have to add the code to it and compile.

[AgentSun]

gaim is good for our campus computers because they aren't set up to allow administrative things like downloading AIM. but we can download gaim just fine because they aren't set to not allow gaim.

i don't use trillian for the same reason that i don't use mozilla. i don't use MSN, IRC, ICQ, and Yahoo. i only use AIM. but i still have trillian on my computer if i ever feel like it. i hate starting up MSN, but it's easier on trillian.

[BaseLine]

Firefox 0.8 vs. Mozilla 1.7

Okay, I have used both... and prefer Mozilla 1.7 over Firefox. Does more. Why do some of you prefer Firefox. It is a very stripped down browser whereas the Mozilla has all that Netscrape had plus a whole lot more.

I don't use most of the functionalities in Mozilla. I like it that Firefox is a light-weight browser. And if I want extra functionality, I can just install an extension.

[Spedoinkel]

I just use MSN and AIM cus I got people on both. that's about it. One on each i ususally talk to.

Any scapers wanting to message me that's fine.

[AgentSun]

i'm on AIM right now, using trillian. it's pretty. i like everything skinned. ew, that sounds wrong.

[Spedoinkel]

skins are fun. though it takes hours for me to find ones i really like, and I flip through them occasionally. I've got 14 winamp skins.

[BaseLine]

Aikon 3 skin for Trillian is very nice.

[Spedoinkel]

I'm using the Frequency - Pontiac skin.

[divinedaydreams]

Ok you guys have lost this poor computer obivous beginner here. What is Firefox, Trillian, and all that other stuff.

Also I have been getting tons of stuff in my bulk mail box from people I don't know. Even got a few in my regular box. This is with yahoo not my Comcast mailbox. Norton hasn't come up with anything but one of the messages was about an inability to deliever a message from me to someone. Which is stranges since I never sent a message at all during the time it said. I was thinking of taking my computer in to have it cleaned up and out. I just need to find a place here in my area.

Anyone know of a good place in or around Pleasant Hill CA?

[BaseLine]

http://www.trillian.cc/
The award-winning*, multi-network Trillian IM client allows you to seamlessly integrate all of your communications traffic in a single, sleek package. Stay in touch with contacts spanning multiple networks and grab the latest news, stocks, and other information with our versatile array of plugins.

http://www.mozilla.org/products/firefox/
Firefox 0.9 is the award winning preview of Mozilla's next generation browser. Firefox empowers you to browse faster, more safely and efficiently than with any other browser.

http://gaim.sourceforge.net/
Gaim is a multi-protocol instant messaging client for Linux, BSD, MacOS X, and Windows. It is compatible with AIM (Oscar and TOC protocols), ICQ, MSN Messenger, Yahoo, IRC, Jabber, Gadu-Gadu, and Zephyr networks.
Gaim users can log in to multiple accounts on multiple IM networks simultaneously. This means that you can be chatting with friends on AOL Instant Messenger, talking to a friend on Yahoo Messenger, and sitting in an IRC channel all at the same time.

http://www.opera.com/
Opera is a cross-platform internet software suite consisting of a web browser, e-mail/news client, address book, newsfeed reader, IRC chat client and download manager. It is in active development by the Norwegian Opera Software ASA. Although Opera is closed source, its core layout engine ("Presto") is licenced by business partners such as Adobe and Macromedia for previewing webpages in GoLive and Dreamweaver. Opera has gained a leading role in browsers for Smartphones and PDAs with its Small Screen Rendering technology. Opera is also used in iTV platforms, and a special voice controlled modal browser is in co-development with IBM. Uniquely, Opera uses the same core layout engine for displaying content on all platforms.

And about the undelivered mail receipts, I also get them from time to time. It's from someone who has a virus on his/her computer that sends these receipts to people on their address books. The virus also adds itself to the message as an attachment, so if you open the attachment you'll also be infected. If you have Norton Anti-Virus with recent virus definitions it will try to remove the virus or else place it in quarantine.

Pleasant Hill is near San Francisco. Lots of things to do over there.

[Jeff O'Connor]

I can't decide between Mozilla and Firefox right now. One thing's for sure. Ain't goin' near that IE again, I reckon.

[grinner]

wat's the improvement from Opera to Firefox?
Opera is unstable and crashed constantly

[Spedoinkel]

Never open an attactment from someone you don't know. That's how viruses spread. If your email service allows you to open mail without simulitaniously opening the attachment you should be fine.

[Paul Cousins]

Never open an attactment from someone you don't know. That's how viruses spread. If your email service allows you to open mail without simulitaniously opening the attachment you should be fine.

Then doesn't that mean that it is only 10% an IE problem and 90% a human stupidity problem.

And there no patch that is going to fix stupidity.

I am the only one here who actually took the time to learn how to work the Security Settings, Privacy options and the Advanced section in Internet Explorer? :rolleyes:

[grinner]

no, I did. Just don't like Microsquishy

[divinedaydreams]

I haven't gotten the courage to go fiddling that far into how my computer operates. I don't open any attachements in my bulk mail or from anyone I don't know. I just can't figure out how these people I don't know have me in their address books. I don't email a lot of people, hell I don't even do the chat deal. I do yahoo groups and here and that's about it.

(Being to think we need to screen for stupidity before letting people have computers!)

[Paul Cousins]

I haven't gotten the courage to go fiddling that far into how my computer operates. I don't open any attachements in my bulk mail or from anyone I don't know. I just can't figure out how these people I don't know have me in their address books. I don't email a lot of people, hell I don't even do the chat deal. I do yahoo groups and here and that's about it.

(Being to think we need to screen for stupidity before letting people have computers!)

Sound like you haven't deleted the Usenet groups in Outlook Express.

Also, screwing around with the OS itself is a VERY bad idea unless you know what you are doing. But Internet Options in IE has Restore Defaults button in it if you screw-up.

[divinedaydreams]

Sound like you haven't deleted the Usenet groups in Outlook Express.

Also, screwing around with the OS itself is a VERY bad idea unless you know what you are doing. But Internet Options in IE has Restore Defaults button in it if you screw-up.


Oh boy Usenet groups sound bad. Let me guess anyone with the know how can see my public information and email me whenever they want or something.

[Spedoinkel]

Then doesn't that mean that it is only 10% an IE problem and 90% a human stupidity problem.


Yeah, that's about it.

And I also agree about screening stupid people away from computers.

[AgentSun]

if there was a patch for stupidity, i think someone would've found a way to hack it by now. and then microsoft (or microsquishy) would charge everyone 99.99 to upgrade their anti-stupidity settings.

[Jeff O'Connor]

And the stupid would pay it.

[Paul Cousins]

Oh boy Usenet groups sound bad. Let me guess anyone with the know how can see my public information and email me whenever they want or something.

Okay, open Outlook Express, click Tools at the top, then scroll down and click Accounts; that will bring up a sub-window with a list of the usenet groups and YOUR E-MAIL ADDRESS(ES). Becareful NOT to delete your e-mail address(es). Anyway, highlight (click on) each usenet group and press the Remove button on the right of the sub-window.

When you are finished, click Close on the window.

Of course this may not be the problem, you may have spyware on you computer or you may have given your e-mail address to a website that sold it to spams and a web-spider program found it from a website or web-guestbook. This is more than one possiblity.

[divinedaydreams]

Ok cleared those but I think it may be somethings my lovely hubby signed us up for one in particular. I don't get these things in my Outlook or Comcast mailboxes just my Yahoo. He in the past has signed us up for several little we'll mail you a newletter places that will save you money. One I have unsubscribed to four times now and I'm still getting their JUNK!!! It all comes through Yahoo which is why I have it go there. Figure the other two are for stuff I actually pay for and what not. I don't use Yahoo for my Paypal, Ebay or anything else important. So I never get junk in them.

Oh I have Ad ware, Spybot, Sygate and Norton. Thanks to the lovely computer literate of the world who are willing to answer my questions and make me one of the not completely stupid people.

[Paul Cousins]

Ok cleared those but I think it may be somethings my lovely hubby signed us up for one in particular. I don't get these things in my Outlook or Comcast mailboxes just my Yahoo. He in the past has signed us up for several little we'll mail you a newletter places that will save you money. One I have unsubscribed to four times now and I'm still getting their JUNK!!! It all comes through Yahoo which is why I have it go there. Figure the other two are for stuff I actually pay for and what not. I don't use Yahoo for my Paypal, Ebay or anything else important. So I never get junk in them.

Oh I have Ad ware, Spybot, Sygate and Norton. Thanks to the lovely computer literate of the world who are willing to answer my questions and make me one of the not completely stupid people.

That is probably the reason for the spam.

Also get Zone Alarm (Free Version) as a firewall and you should do fine.

[divinedaydreams]

Found two places for Zone Alarm but both go no server on me when trying to download or click on the site. Got a link?

[AgentSun]

no, go directly to the zone alarm site. www.zonelabs.com. always download from the producer's site.

[Spedoinkel]

Downloading from the creator's site will improve the chances of not having a bug tacked onto the program. Though this can happen from the creator's site as well. And when you download stuff make sure you have a virus scan program that is functioning continusly, or scan it before you install.

[blue]

Does any of this apply to Macs?

[soyarma]

Not nearly as much, since they aren't targetted as much by people. You still probably get cookies that track your internet habits and report them somewhere.

[Spedoinkel]

Unfortunatley for you I know next to nothing about Mac operations. I on the other hand am completley comfortable with this, since I hate them.

[Paul Cousins]

Not nearly as much, since they aren't targetted as much by people. You still probably get cookies that track your internet habits and report them somewhere.

That can be prevented.

First clear out the files in your "Temperary Internet Folder" (including cookies) Then go to Privacy, select Advanced, click "Block Cookies", both first party and third party, but also click "Override Automatic Cookie Handling", next go to Security, click Internet and turn off Active X settings, set Java to high or disable and block cookies. Next in Security, click Trust, set it to accept cookies. Next, with Trusted Highlights, click "Site" in Security, (make sure to turn off "Require Server Verification") and type in (or copy & paste) the websites (like www.watchfarscape.com) you want to allow to get cookies from, like the one you need to use this forum. Finally after that, press 'Ok' until you are out of Internet Options.

You will have to login back to this forum afterwards, so make sure you have written down your Forum name and password.