Virus question

  • Thread starter Thread starter Bill Case
  • Start date Start date
B

Bill Case

Hi,
I just ran an AVG 6 scan and turned up 6 occurences of these viruses:

Trojan horse downloader istbar.BY
Trojan horse downloader dyfica.AA

These showed up in just the last day, with all MS patches installed, running
ZoneAlarm firewall, frequent Spybot checks, and had AVG resident shield
running.

Anybody know how these things are getting on my computer? Do I have a bad
prgram that's generating them or inviting them in?

O/S: win 2000 sp4 w/ all patches installed.

Thanks
 
Hi,
I just ran an AVG 6 scan and turned up 6 occurences of these viruses:

Trojan horse downloader istbar.BY
Trojan horse downloader dyfica.AA

These showed up in just the last day, with all MS patches installed, running
ZoneAlarm firewall, frequent Spybot checks, and had AVG resident shield
running.

Anybody know how these things are getting on my computer? Do I have a bad
prgram that's generating them or inviting them in?
Click to expand...

Yes. IE/OE
O/S: win 2000 sp4 w/ all patches installed.
Click to expand...

Here's a real patch for 2K sr1:

http://www.litepc.com/ieradicator.html


Art
http://www.epix.net/~artnpeg
 
Hi,
I just ran an AVG 6 scan and turned up 6 occurences of these viruses:

Trojan horse downloader istbar.BY
Trojan horse downloader dyfica.AA

These showed up in just the last day, with all MS patches installed, running
ZoneAlarm firewall, frequent Spybot checks, and had AVG resident shield
running.

Anybody know how these things are getting on my computer? Do I have a bad
prgram that's generating them or inviting them in?

O/S: win 2000 sp4 w/ all patches installed.

Thanks
Click to expand...
Probably Kazaa.

Taff.............



www.sounds-pa.com | www.thecomputerworkshop.com
 
Bill Case said:
Hi,
I just ran an AVG 6 scan and turned up 6 occurences of these viruses:

Trojan horse downloader istbar.BY
Trojan horse downloader dyfica.AA

These showed up in just the last day, with all MS patches installed, running
ZoneAlarm firewall, frequent Spybot checks, and had AVG resident shield
running.

Anybody know how these things are getting on my computer? Do I have a bad
prgram that's generating them or inviting them in?

O/S: win 2000 sp4 w/ all patches installed.
Click to expand...

Where are they being found?
 
Bill said:
Hi,
I just ran an AVG 6 scan and turned up 6 occurences of these viruses:

Trojan horse downloader istbar.BY
Trojan horse downloader dyfica.AA

These showed up in just the last day, with all MS patches installed, running
ZoneAlarm firewall, frequent Spybot checks, and had AVG resident shield
running.

Anybody know how these things are getting on my computer? Do I have a bad
prgram that's generating them or inviting them in?

O/S: win 2000 sp4 w/ all patches installed.

Thanks
Click to expand...

From a descr. of istbar:
"ActiveX drive-by download on affiliate pages, including
misleading download links"

J
 
Someone once told me to create a fake address in my address book. Actualy I
have 2, in the last name, first name format. One is call alert, worm and
has my real email address. And the other is alert, worm and has a fake
email address such as 123stopworms.com. That lets you know if something is
coming from your address book. Because the sender would be alert, worm.

Ceily
 
FromTheRafters said:
Where are they being found?
Click to expand...


E is my boot HD. xxxra1 is disabled directory, left over from a re-install
last week due to getting hit by a virus. Below is the AVG6 log for the virii
it found this morning, win 2k o/s. Any ideas as to what's going on?


E:\Documents and Settings\XXXRA1\Local Settings\TEMP\POWERS~1.EXE Trojan
horse Downloader.Istbar.BY

E:\Documents and Settings\XXXRA1\Local Settings\Temporary Internet
Files\CONTENT.IE5\8XUBKH2F\POWERS~1.EXE Trojan horse Downloader.Istbar.BY

E:\Documents and Settings\XXXRA1\Local Settings\Temporary Internet
Files\CONTENT.IE5\C16VWL6R\OPTIMI~1.EXE repaired

E:\RECYCLER\S-1-5-21-57989841-1935655697-839522115-1000\DE758\POWERS~1.EXE
Trojan horse Downloader.Istbar.BY

E:\RECYCLER\S-1-5-21-57989841-1935655697-839522115-1000\DE760\OPTIMIZE.EXE
repaired
Testing G:\ volume Backup NTFS3 4.9Gig serial 7C87-28E0

Test finished, duration 01:04:30.9 s
41783 objects tested, 5 found infected
 
Bill,
Those Trojans most likely already existed and were not detected
by AVG until it was updated. Both of those are basic generic type
Trojans. The letters after just designates the culprit site ...
--
Go to: http://www.tomcoyote.org/hjt/
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, go to the "Spyware and Hijackware Removal" section.
Press "New Topic", copy and paste hijackthis.log into your new message.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-07-04]
Please post replies to this Newsgroup, email address is invalid
 
Bill Case said:
E is my boot HD. xxxra1 is disabled directory, left over from a re-install
last week due to getting hit by a virus. Below is the AVG6 log for the virii
it found this morning, win 2k o/s. Any ideas as to what's going on?


E:\Documents and Settings\XXXRA1\Local Settings\TEMP\POWERS~1.EXE Trojan
horse Downloader.Istbar.BY

E:\Documents and Settings\XXXRA1\Local Settings\Temporary Internet
Files\CONTENT.IE5\8XUBKH2F\POWERS~1.EXE Trojan horse Downloader.Istbar.BY

E:\Documents and Settings\XXXRA1\Local Settings\Temporary Internet
Files\CONTENT.IE5\C16VWL6R\OPTIMI~1.EXE repaired

E:\RECYCLER\S-1-5-21-57989841-1935655697-839522115-1000\DE758\POWERS~1.EXE
Trojan horse Downloader.Istbar.BY

E:\RECYCLER\S-1-5-21-57989841-1935655697-839522115-1000\DE760\OPTIMIZE.EXE
repaired
Testing G:\ volume Backup NTFS3 4.9Gig serial 7C87-28E0

Test finished, duration 01:04:30.9 s
41783 objects tested, 5 found infected
Click to expand...

Those are temp, temporary internet files, and recycle bin directories.
Your browser settings are probably allowing this to happen. Disable
scripting and ActiveX while browsing - and only enable them for sites
that both need them and that you trust.

....which probably means that you *never* should have ActiveX
enabled. ;o)
 
Back
Top