Warning, something on the site lit off my Norton anti-virus.
btest4.scr is a Trojan Dropper virus
Booted in clean now after running all anti-virus and Ad-aware scans, but only logged into TranceAddict before, so beware. Could have come off of my ISP server as well...
[[[[smoke]]]
Jun-18-2004 00:23
smokeape
Lowland Trance Addict
Registered: Jul 2003
Location: Heart of Dixie
Let me add here a good defense against common spyware.
Create a text file and just put "test" in as verbage. Rename the file a.exe and set its properties to Read Only to block overwriting.
Do the same with a text file and rename it bridge.dll ; this will stop frequent spyware attacks.
Put them both in the Windows/System32 folder
[[[smoke]]]
Last edited by smokeape on Jun-18-2004 at 00:43
Jun-18-2004 00:29
Vlad
Supreme tranceaddict
Registered: Apr 2003
Location: San Siro [NYTA #3]
Where do we put the files?
___________________
/SARCASM.
quote:
Originally posted by Coup
Vlad wins.
Flawless victory.
Jun-18-2004 00:39
TeKnoHe@d2025
Derek Howell Addict
Registered: Jan 2001
Location: Pittsburgh, Pennsylvania
quote:
Originally posted by smokeape
Let me add here a good defense against common spyware.
Create a text file and just put "test" in as verbage. Rename the file a.exe and set its properties to Read Only to block overwriting.
Do the same with a text file and rename it bridge.dll ; this will stop frequent spyware attacks.
[[[smoke]]]
Huh? Any particular place you gotta create these files?
Originally posted by TeKnoHe@d2025
Huh? Any particular place you gotta create these files?
Ooops, sorry, good point. Put them in the Windows/System32 folder. I updated my previous post.
[[[smoke]]]
Jun-18-2004 00:42
ASOT100
Supreme tranceaddict
Registered: May 2003
Location:
quote:
Originally posted by smokeape
Let me add here a good defense against common spyware.
Create a text file and just put "test" in as verbage. Rename the file a.exe and set its properties to Read Only to block overwriting.
Do the same with a text file and rename it bridge.dll ; this will stop frequent spyware attacks.
Put them both in the Windows/System32 folder
[[[smoke]]]
wth, how does that work?
Jun-18-2004 00:45
TeKnoHe@d2025
Derek Howell Addict
Registered: Jan 2001
Location: Pittsburgh, Pennsylvania
Yes, please go more in-depth about this. Plus show some proof to back up your information here...
Im guessing, if the files are already there, just delete or overwrite them with the new ones.
___________________
/SARCASM.
quote:
Originally posted by Coup
Vlad wins.
Flawless victory.
Jun-18-2004 00:47
smokeape
Lowland Trance Addict
Registered: Jul 2003
Location: Heart of Dixie
quote:
Originally posted by Vlad
Im guessing, if the files are already there, just delete or overwrite them with the new ones.
Roger, overwrite the existing files. There is no purpose for an a.exe or a bridge.dll file in your System 32 directory. If you reboot and get an error message, then go to Regedit HKLM/SOFTWARE/MICROSOFT/WINDOWS/CURRENT VERSION/RUN and delete any keys which start a Bridge.dll file at startup.
Post your startup files here as well and I will tell you what you don't need to be running.
Ooops, sorry. This is not supposed to be a Geek Forum...
[[[smoke]]]
Caater ft Trinity - Endless Summer
Jun-18-2004 00:55
Boomer187
Spicy Hotdog
Registered: Aug 2001
Location: USA
do you have sql installe don your system?
that seems like the old technique people would use by using either tftp or ftp.exe to send over servu files.
if it is servu it doesn't matter if you create those files...they can rename theirs. would be better to find out hwo they are getting in in the first place.
Jun-18-2004 01:06
smokeape
Lowland Trance Addict
Registered: Jul 2003
Location: Heart of Dixie
quote:
Originally posted by Boomer187
do you have sql installe don your system?
that seems like the old technique people would use by using either tftp or ftp.exe to send over servu files.
if it is servu it doesn't matter if you create those files...they can rename theirs. would be better to find out hwo they are getting in in the first place.
Don't quite understand, but the two files I named are common spyware targets which write themselves into System 32 Files all the damn time. Best defense is just to create them as Read Only innocuous type files so they cannot be overwritten. Blocks the script on the spyware. Doesn't hurt anything to do it, so what the hell. You create an a.exe file which is nonexecutable and a bridge.dll file which is nonexecutable as well.
