viruses, spyware, and other nasties.
 

UPDATED 27 AUG 2005 0617

First, make sure your version of windows is up to date by visiting http://windowsupdate.microsoft.com if you have a legit license. IF YOU DO NOT HAVE ONE, PURCHASE ONE OR BUY A NEW PC WITH WINDOWS PRELOADED.

Second, install Microsoft Anti Spyware. I have had problems with Spybot Search and Destroy a long time ago, so I don't use it. I used Giant Anti Spyware, which was before Microsoft bought out Giant.
URL: http://www.microsoft.com/athome/secu...e/default.mspx

Third, install a virus scanner. There are free ones, so theres no excuse for not having one.

AVG - www.grisoft.com - used in the past, is a very good scanner with free updates.

ClamWin - www.clamwin.com - I recommend this because clamscan is a very good UNIX virus scanner (for mailservers/webhosting), and this is a port to the Windows platform. Free updates.

HouseCall - http://housecall.trendmicro.com - Has anti-virus, security scan and spyware scan, plus it's an online scanner, so you can run a scan whenever you want, and don't have to install any software.

Fourth, do not trust executables (programs, games, etc.) on p2p. A virus spreads by infecting other executables, which could be in that user's shared folders. You download and install the program, you get yourself infected. Also, I have heard rumors that people are making hacked versions of software for p2p that will take over people's computers.

Don't believe me, the software was FlashFXP and I have seen an infected version of Trillian floating around.

What benefit does a person have sharing software with you. He has more to gain by inserting a backdoor/virus/trojan, whatever on your computer. Plus, if it says the program is virus free, the file still might be infected by an unknown backdoor/virus/trojan. People who write such programs regularly change their versions to get around virus scanner detection.

Only trust freeware, shareware, and commercial programs from their respected websites and from authentic third-party websites like www.download.com or www.tucows.com

Fifth, stop using Internet Explorer.
Use Opera www.opera.com, Firefox www.getfirefox.com, or Mozilla www.mozilla.org. - that will stop a lost of the spyware from installing from the Internet, because spyware seems to be easier for people to download on Internet Explorer by ActiveX or "drive-by" downloading.

"Drive-by" downloading is when you are prompted to download and install something before you can "view" some material. This is popular on lyric pages, more "grey" areas on the Internet, and on porn sites. These "viewers" are normally spyware or dialers, which can reconfigure your dialup to dial expensive overseas porn which you find out by a large phone bill.

If you decide to use Internet Explorer (for whatever reason), please install BHODemon - http://www.majorgeeks.com/download3550.html

BHOs are browser help objects, which is an Internet Explorer only feature *cough*mistake*cough* that allows something like Google Toolbar, Yahoo Toolbar, etc. to install in Internet Explorer to help you browse. Spybot Search and Destroy plus Adobe Acrobot Reader are both examples of legit BHOs. Bad BHOs can be keyloggers, password stealers, generate popups, etc. generally nasty stuff. BHODemon takes care of it.


TRY THIS FOR MAXIMUM PROTECTION ONLINE


Download Privoxy Here. Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, modifying web page content, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit individual needs and tastes. Privoxy has application for both stand-alone systems and multi-user networks.


Privoxy is easy to install. Double-click the exe and let the setup run. When you are done, configure your web browser to connect to localhost and port 8118 as your proxy server.

It makes the Internet run so much smoother. The greatest thing about Privoxy is that it knows when websites have IE exploits on them to attempt to mess with your computer, and Privoxy will prevent you from going to that site. However, you can ignore Privoxy and go anyway if you're on Firefox/Mozilla/Opera.


moderator: please make this thread sticky.

Re: viruses, spyware, and other nasties.
 

Look what, spyware scan, found on my computer...

Hey... the spyware scan program showed me the LimeWire as a p2p program who can threats my computer and asked me if I want to remove this threat... I know that LimeWire isn't a virus...:D I only wanted to "share" with you this funny "error"... If you you want to see this with your own eyes just scan your comp. online... (as I did) Sorry if you got me wrong...

im not sure why they're catching it as spyware. does the free version have ads in it? if so, that's most likely why they're flagging it as spyware.


i have a program called radmin 2.2 by famatech which is like pcanywhere, VNC, or any remote control program that is used to access a computer over the Internet. norton antivirus cannot stand it when radmin is installed on people's computers. it automatically says its a virus, however radmin is a commercial program sold by a legitimate company for legitimate purposes.


i believe norton has a comparable product to pc anywhere, therefore thats why they're flagging the thing as a virus. if it was a norton product, i seriously doubt that it'll find its own products as viruses.

the perfect way to stop viruses is to change your whole attitude about the Internet. if you treat every piece of software on p2p as a potential virus, you will notice your infections going down.


i dont run a virus scan and the last virus i had was one that was supposed to download and install while i was browsing the Internet, but I was using Firefox and the virus scanner noticed the virus in Firefox's cache. :)

I've made this thread a sticky as it might be a good help to newbies and more experienced user alike. This means that we want that future posts in this particular thread to be informative for the community only in fighting against viruses, spywares and other nasties ;)

Meanwhile, thread has been cleaned by me, so only on subject posts were kept in the original thread.

Merci

thank you very much.

More Clear...
 

No it doesn't...
I agree about the Norton Antivirus... is true... In the end is all about selling the software by draging down the others... (the "pure" economy)
I'm using FireFox too...

i think some scanners tell on you for having p2p apps installed.. like retina network scanner would find bit torrent on my machine and prompt me about what to do about it.. if it violated my company's acceptable use policy.

Have I been violated ??
 

I've been using LW for a little over 1 year and have had very few problems. Questions, Yes. This is my first post and I hope it is appropriate for this thread.

Two nights ago I was running LW minimized (not downloading anything). Occassionally I would check on the progress of uploads and everything seemed normal. In the mean time I was editing mp3 tags for files I wanted to add to my shared folders.

I normally share 5 folders with different type music. When I checked my shared folders in LW, four of them were missing. I checked options even though I knew uploads had been occurring from these folders all evening. The folders were no longer listed as shared. I immediately closed LW and went to my directory where these folders are kept. They were gone as well as one other folder.

I used windows to search for the folders and some of the known songs within these folders. Nothing! I opened the only folder that was still shown as shared and found 8 songs in a folder that normally has 250 or more.

I used Norton's "recover erased files" function and found most of the music that was missing from the one folder and restored them but there was nothing from the other 3 missing folders.

Norton had all of these songs as deleted but with no date stamp (unknown). Songs that I had manually deleted were also found with the correct date stamp on them.

I ran Norton virus scan, Ad-Aware and Spy-Bot no indication of problems.

I immediately contacted a local guru who has many years experience in computer security. He suggested running scandisk and restoring from a previous day in case some of the system32 files were corrupted and had lost track of the files. I did, to no avail.

The only thing unusual that I can recall is that there was a Bearshare user downloading from one these folders. LW said it was downloading but there was 0% and no time remaining. Not that unusual for a short time but this situation remained for maybe 1/2 hour and then showed download as completed. Still 0%.

The only way I know of to completely erase files from the computer is with programs designed to write zeros over the file names. Maybe I shut LW down before this process had completed zeroing out the files I did find and recover.

I never download zip or exe files with LW. My anti-virus and spyware is always up to date. I'm wondering if this is just a hijacker playing or an attempt to punish LW users.

I will definitely investigate the software identified in this thread that may thwart this kind of effort. I may be paranoid but I have no other explanation for what happened.

Any Ideas?

Thanks Hank

it works
 

banmicrosofttoo,

I wanna say thanks for all the help you have given me after reading your post. I am now running Tor and Privoxy. They are both great and work really well together.

Much appreciated

guff

guff, im glad you're loving privoxy. you will notice spyware infections will go down, plus when you visit a bad site, privoxy will tell you to stop. it'll show you a screen and tell you why you shouldn't view that site. tor just keeps you anonymous.


The Elder, i'm not too sure about your problem. i will look around and search google to find you a response.

banmicrosofttoo

I have noticed a big decrease in spyware infections, zero criticals since installing Privoxy (my average per day was at least 20 through IE) using Adaware. The only thing I have noticed in my Tor window is it telling me i need a socks4a while i am using something like IRC. It doesn't seem to be a problem but I was wondering if i need another program other than mIRC. I'm quite new to this.

Disappearing Files
 

Hi Elder

Its obvious that someting got into your PC, probably a worm of some sort.

You say you have Norton's software, from what you've said I guess that you have System Works but you have not mentioned the version e.g. 2003, 2004 or 2005. (I have NSW 2004).

You have also not mentioned whether you use a firewall, again I have NIS 2005 which contains NAV2005 and NPF2005.

If you provide more info I will try to help.



UK Bob

Thank you for your recommendations banmicrosofttoo!
I just have a problem after I downloaded Clamwin Antivirus. I don't understand why there is an error in virus scanning.
My norton antivirus is going to expire soon so I thought that I can use Clamwin but it so far cannot virus scan. What should I do?
Is this a configuration problem (but I just clicked on automatically detect settings but it still does not work) or because it is conflicting with Nortons?
Just letting you know that I am a complete idiot in computers. :(
Any advice or help is greatly appreciated!

It is most likely an interference with norton so after it expires unistall it then un-install Clamwin Antivirus and then re-install it hoe that works

-cookie ;)

Disappearing files
 

UK Bob Thanks for the response. Sorry I'm so late in my response. My mother fell and broke her hip.

I just downloaded Zone Alarm Personal firewall. I'm currently using Norton System Works 2001. I own 2004 but past experience with it caused me to revert to 2001. It's probably due to my limited memory but Norton took over my machine and was reluctant to give it back. Boot time was terrible and so was internet access. My wife threatened to leave home if I didn't remove it from her XP machine.

Before, when I tried to use LW direct connect LW would tell me I was either behind a firewall or a router. I did not bother to change anything feeling I was being protected but maybe not. I've considered establishing a static IP and forcing a port but did not feel it necessary due to uploads and downloads seeming to work fine.

Hi Elder

First of all, may I say how sorry I am to hear that your mother has been injured, I too have a frail mother and know of the problems than can arise. I wish your mother a speedy recovery.

As for the PC, I think you have made a mistake reverting back to Norton SW 2001, simply because the anti-virus part of it may not be able to handle modern day worms and viruses. A colleague at work told me that when he upgraded from NAV2003 to NAV2004 he found a previously missed virus, and you are still using 2001.

I use LW Pro and I have found that the latest version (4.9.28) has a problem with PeerGuardian 2, it is seen as a firewall. Even when I establish a high-speed internet connection with LW and PG2 running simultaneously LW will disconnect itself while the internet connection is still running.

So I guess, as LW is now more sensitive, you probably have something on your PC that LW is reporting as a firewall, whatever it is you have to find it a switch it off.

To conclude, you need an up to date virus scanner and in the meantime you should do an online virus scan, e.g. Symantec does one.

You need to find out what LW (the sensitive soul that it now is:))is seeing a firewall and switch it off.

Hope this helps




UK Bob

at file
 

got a file that was hidden in a folder name, at, it made a new folder, complete. and i can't delet it, and if i reboot it comes back again with alot of files witch are viruses

K

banmicrosofttoo, you forgot to add Ad-aware, Spybot and SpywareBlaster. Forget Ms Anti-Spyware even they use Gaint, but they recode it to fit their needs.

Ad-aware, Spybot and SpywareBlaster become a maximum defense against Spyware. Ms Anti-Spyware giving a false positive. you will see many many people in tech world tend to suggest Ad-aware and SpywareBlaster

Limewirer

MS Anti-Spyware doesn't give false positives anymore and it is good at finding keyloggers, a particular nasty piece of spyware.

I have been using MS Anti-Spyware for nearly six months now and, to tell you the truth, I would not be without it.

I use the following anti spyware apps:

Ad-Aware SE - Good at finding tracking cookies, deleting MRUs and other nasties

SpyBot - Finds stuff that Ad-Aware may miss, such as Winfixer and other spyware that may be installed with free apps.


MS Anti-Spyware - Found NS Keylogger and other nasties missed by Ad-Aware and SpyBot.




UK Bob

Can't Stop it!!!!!
 

Hey does anyone know how to keep Limewire from starting on it's own. I have gone into the options and unchecked the box that makes it start up when you get on your computer and hit apply and even restarted the computer but...........It keeps starting up on it's own????????

i have just purchased lime wire pro today and everything that i have downloaded so far has had a virus attached to it, alcan some thing or other, i was under the impression that if i purchased pro i wouldn' t have this anymore, and why doesn't limewire scan its files before allowing them to post, as many other p2p's do?

Thur91

You said, talking about viruses:How on earth did you get this impression? And why do you believe LW has some sort of virus scanner in it.

It quite obvious that you think the files you are downloading are vetted and held by the LW org, well newbie Thur91 they are not. The files you download are held on PCs owned and used by hunderds of thousands of individuals just like you and I, not a central server or centrally owned server farm.

Finally, the LW org can neither tell you, me or anyone else what we can hold and share on our PCs, they can advise us to use an AV app but they can't force us to.




UK Bob

Obscene input
 

I have an iMac and have downloaded plenty of Limewire music. Occasionally I get the President Clinton (voice!) about how to get" it 'for nothing. Today in trying to download some Charlotte Church recordings I got it three out of three times. Any chance there could be a blockage installed? Before downloading it shows the normal time, but after downloading, it shows the 27 second recording. It is a real pain as it takes time, and then you find you have this junk. The genre comes out as Top 40.
Whoever it is should be hounded of the airwaves.
Anyway I can block it?

John

AV updates /scans
 

Due to the fact that Norton AV fights with and attempts to shut down most other Anti Virus programs I suspect your suspicion's are correct

Re: Obscene input
 

Yes using the spam filter in LW 4.10 it's actually quite easy. It's called autogenerated spam & that type is mp3 autospam; autogenerated mp3 spam results
It took me just 2 searches to filter out all basic auto-spam such as the ipod advert & the clinton digital voice file. All those files are the same size so easy to recognise. The virii are harder to filter out. That takes many, many more attempts using the spam filter.

More about virii sizes to avoid see WARNING: Viruses on network you should be aware of! (click on link)

Some usefull Info
 

If you are using Windows, and you know the location of the virus/folder that can't be removed.
You can try to start up your PC in safe mode using only Command Promt (If I remember correctly holding down (F8 key) just after pressing the On button, you will be taken to a screen with some choices on it) Do not start Windows at all Then you can go to where the File/Folder is and delete manually (just remember that Command Promt does not have a thrash can, so anything deleted is gone forever)

Since this is a securety related tread, it might be a good idea to tell you what I use to protect myself, and keep at optimum performance. I might be a bit overprotective, but I ran into a really nasty one a while back.

Antivirus:
Panda Internet Security Platinum
I only use the Panda firewall included. Never use more than 1 firewall at a time

Malware protection:
Microsoft Antispyware (Beta 1) Free
SpywareBlaster (from Javacool Software LLC) Free
Ad-Aware SE Pro
CCleaner (CrapCleaner) Free (also does a lot of good optimizing performance)

Optimized performance with:
Wintasks Pro
Registry Mechanic

Extra Protection:
Peerguardian 2


Also I found a very interesting link while browsing the internet, might wanna check it out. Interesting reading (also for the more advanced users of this forum)

http://www.spywarewarrior.com/rogue_anti-spyware.htm

I have been downloading and it almost seems in any program file that i download that has been a zip file when i get it i scan it and there is some virus. usally games i download for my son, the music ones seem to be fine just program ones. any suggestions.

This IP, edited to conform with house rules concerning privacy is hosting several viruses all with different names, most are 197.7kb, just beware.

New problem, sorry to interrupt, hope you can help
 

:confused: I have grifsoft avg on my system which I love. When I download some things off of Frostwire they are in exe form. When they are downloaded, avg always finds a virus. I click 'Heal' and it does so successfully, every time, but for the life of me, I can't get any exe file to open properly and work. Every time there is an error that says the pathway is not valid. What am I doing wrong?:confused: :confused:

limewire fix
 

Forget downloading all the spyware programs, I have a very simple and 100 % effective way to stop Limewire. I have been having the same problem with Limewire starting on its own and not being able to shut it down. And everytime I would uninstall and reinstall it. This would help, but only for a little while, then it would do it all over agian.
Now, Start your computer in safe mode (while computer is booting up, hit F8 repeatedly to get it to enter safe mode) Now mind you this is XP I'm working with, so if you have another operating system, I hope this still applies. When in safe mode, go into My Computer- C drive- documents and settings- all users- start menu- programs- startup.... then in there if there is a file called svchost (it will be an .exe file) delete it. This is what starts Limewire and it gets downloaded to yur computer everytime windows does and automatic update. It is a windows file, but is unnessesary and only causes problems. At least it does for me, and this is the only way I've ever been able to get limewire to back off. Deleting it has never causes my computer any problems, I hope this helps someone out there

After reading the post by juliettebrandice I was stunned because svchost is an intergral part of Windows. Therefore, before anyone follows juliettebrandice's advice they should read the following MS artucle:Which means that your Windows could fail to run or suffer from crashes (blue screen of death) if this file is deleted.

The rest of the article is located here http://support.microsoft.com/?kbid=314056

To push the point further, I found this other article which says:So the morsl of this tale is "Do not delete SVHOST" if you have a virus, get rid of the virus instead.


UK Bob

You may have found that article, and I found this one:

Description:
svchost.exe is a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs. This program is important for the stable and secure running of your computer and should not be terminated.

Note: svchost.exe is a process registered as a backdoor vulnerability which may be installed for malicious purposes by an attacker allowing access to your computer from remote locations, stealing passwords, Internet banking and personal data. If unaccounted for, this process should be removed immediately.

Note: svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

Note: svchost.exe is a process belonging to Microsoft Service Host Process. This program is a non-essential process, but should not be terminated unless suspected to be causing problems.

So the moral to THIS story is, if it is causing problems, delete it. As I said, I have done it, and have been doing it for months everytime it comes back and have had no problems. Everytime you follow someones advice on here about removing this and deleting that you run many risks if you dont know the inner workings of a computer, but the bottom line is, if you want Limewire to stop taking over your computer, delete this file. It is, in MY history and MY history only, the only way I've been able to get it to stop.
What everyone on here does is up to them, and I guess the REAL moral to the story (if we are dealing with morals) is dont use programs to illegally download music and you wont have any problems.

Svchost
 

Juliettebrandice

If your Windows XP can run without "svchost" then OK but from my own experience XP becomes unstable (and will probably crash) if "svchost" is not running.

Now, I do know that "svchost" causes your PC to become vulnerable by accessing the internet and opening ports without your permission, this is what first brought this “MS app” to my attention. However, I found that if I blocked "svchost" from accessing the internet with my firewall my XP remained stable while the expected vulnerability, i.e. opening unprotected ports, no longer happened.

You have said:If you deleted svchost.exe from your hard drive then it could not come back so I guess what you really mean is that you terminate it when it starts to run.

Either way, I think you have taken care of the symptoms without curing the problem, i.e. you still have a virus on your system but now you can’t see what it is doing.

But as you said, it works for you.



UK Bob

"What everyone on here does is up to them, and I guess the REAL moral to the story (if we are dealing with morals) is dont use programs to illegally download music and you wont have any problems."

At first I wondered whether you're just stupid or whether you're actually paid to give such a false advise regarding viruses etc. Thanks for clearing that up. Now I know you're really full of ****. Let me tell you this, even the most stupid subject of a Windows user will someday learn how to use a computer properly, possibly just by getting rid of Windows. By pumping your stupid viruses into P2P networks, you're simply accelerating evolution. Some may die in the process but the species as such will become stronger. Then your times are finally over. Don't expect mercy.

I recommend Avast Antivirus (http://www.avast.com/eng/download-avast-home.html) Don't download it anywhere else. Built in p2p scanner.

You guys keep making a big deal about people downloading software and how it's illegal and those people are stupid and deserve the virus because it's not legal. But you guys are admitting to downloading and sharing music files...THAT'S ALSO ILLEGAL! So do you not also deserve the viruses? You cannot justify people getting malicious software because they're downloading illegal stuff. The fact of the matter is, two wrongs don't make a right.

By the way, it is absolutely possible to attach malware and spyware to mp3s...or even create an executable file and change the extension to mp3. So my advice is to be very cautious even when downloading music. I highly recommend Clam virus scan. Clam seems to scan files even as they are downloading ...I recommend pausing a download after the file begins, then scanning with clam. If a virus is detected, cancel the download. This may not always work, but doesn't hurt to try. And I'd stay away from any videos and software...even if it's open source. Your best bet is to use sourceforge.net or something for software and (unless you're sharing unsigned music) use iTunes for music. I mean songs are only .99¢. You guys can't be that cheap...

Exactly which country are you refering to that downlding & sharing of music files is illegal? Not all countries have the same copyright laws. In fact many are very different. So to make your point & intending it universally is incorrect, unless of course you actually work for MIAA or related sponsored groups.

The spreading of viruses is illegal in most countries around the world. Even in the USA! Yet the sponsored groups of the MIAA, etc. do this. So which is the more severe here? The spreading of viruses or sharing a few music files. Such viruses have affected businesses & cost them large sums in money for loss of revenue, not just the home users. So basically the MIAA & related groups are the "Terrorists" of the internet.

I installed Privoxy. I'm really not very computer savvy. How do I "configure your web browser to connect to localhost and port 8118 as your proxy server."

Actually, Lord of the Rings, you are correct. In many countries sharing music, even software is not illegal due to copywrite regulations; however sharing copywrited material in most large countries is illegal (particularly in the US and the UK). You're also right about the spreading of virus's. That is also illegal in most major countries. So with that in mind, we shouldn't be blaming each other for getting virus's, and we certainly shouldn't be saying people deserve the virus's*—*especially when we don't even know what country they're in or their copywrite laws. This is an open source community, surely we can help each other out without being pricks to one another. ...and Tquin, sorry I don't know much about proxies... If you're on a mac, just change your firewall settings to allow port 8118 and to allow your filesharing program and I think you'll be good to go. That can be found in System Preferences under "sharing." If you're on a PC, I think you go to Control Panel and choose internet preferences. And I'm not 100% certain but I think you can set that up somewhere in there... ??? someone correct me if I'm wrong ??? And I don't know how to do it in linux, since I've never used a proxy. Hope that helps. Oh yeah...I tested clamwin's ability to scan downloads. I does not scan incoming files on Windows. ClamXav (mac) does; however. Good luck y'all!

Please also check this thread: WARNING: Viruses on network you should be aware of! (click on blue link)

A virus?
 

I have "successfulliy" downloaded three or four songs but when I try to play them, I get Bill Clinton's comment from his impeachment. I have run the entire McAfee virus scan, I retored my system to a week ago, and I re-installed Limewire but nothing will remove that message. Any ideas? Thanks, Bob Kelley

Hey Bob, Try these fixes in the Link below.

If the file won't delete from LW's library (right click > delete) or from your saved folder (go to LW's library, click on the file & click Explore) try starting your computer in safe mode, see if it will delete then.
Microsoft Corporation

Otherwise, try one of the tools here (I've used both Unlocker & DelinVfile).
Incomplete Download File won't delete at all.

If your computer seems weird since you downloaded the fake file, make sure to update your AV & scan your computer.

Hope this helps. :D

help
 

DomPlayer
 

Hi1 I'm new to this. Hope you can help me. I've been downloading the ******* series. Was successful the past few weeks. However. I am not able to open [edit]. It says I need to go to DomPlayer.com and download the domplayer. Could you help me figure out how to go around this. From what i've read, domplayer is malware.

Will appreciate a response to this concern.

Thanks!:)
__________________________________________________
Edited to comply with the House Rules.
Warez, copyright violation, or any other illegal activity may NOT be linked or expressed in any form.

I understand that there were only 11 episodes, due to the writers strike, i.e. the series was curtailed.

Do a bit of research to see if I'm right, if so then your E12 is a fake.

Thanks!
 

Thank you for replying to my query. I did check as you suggested and you were right.:xeri_ok1ani:

cr8tiv

Use a Mac......
It don't matter then......
If you download a virus.....
Throw it into trash....Empty Trash.....
Hahahahahahahaha.....

hi im new