Party Poker

[Guest]

Hi All,
MS antispyware flags
Local settings/temp/34.tmp

as a back door trojan.
I delete the file ,but it appears to return when I use party poker site.

Does anybody have any experiance of such a problem.

Cheers Keefc

 

[Guest]

Hello Keefc,

Possible Remnant From Spy Sheriff Infection.

http://forums.techguy.org/printthread.php?t=376692

From AndyM
Use SmitRem Trojan.Intell32 is a variant of the Smitfraud infection usually
followed by fake spyware warnings as a desktop wallpaper, Icons in the system
tray that display your infected then PS Guard or Spy Sheriff being installed
without cºnsent

Download SmitRem

http://noahdfear.geekstogo.com/click counter/click.php?id=1

Save it to your desktop,Double click Smitrem.exe to extract it to it's own
folder on the desktºp.

Reboot into safe mode (Reboot and keep tapping F8 then choose safe mode from
the list)

Open the smitRem folder, then double click the RunThis.bat file to start the
tool. Follow the prompts on screen.

Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive,
eg; Local Disk C: or partition where your operating system is instªlled.

You will need to reload your wallpaper after this tool finishes, Smitrem
will reset it because Trojans related to this infection will display a
spyware warning as a desktop wallpaper which cannot be removed, To change
your wallpaper right click desktop and choose properties, Set the Theme to XP
if you are running XP then goto the Desktop tab and choose your wallpaper
from there.

Good luck
Engel

 

[Bill Sanderson]

I strongly recommend that you use a different poker site. This one is
risky, as you've noted.

I've heard no negatives about:

Pacific Poker www.888.com

http://www.pokerroom.com

http://pokerstars.net/

These are not in any particular order, and I have no firsthand knowledge of
any of them. Another list of folks whose opinions I value had a discussion
about whether there are "good" poker sites, prompted by a users bad
experience with party poker--and these were the recommended sites.

 

[plun]

Hi

Bad one:
http://www.siteadvisor.com/sites/888.com

Good one:
http://www.siteadvisor.com/sites/pokerroom.com

http://www.siteadvisor.com/sites/pokerstars.net/

regards
plun

 

[Bill Sanderson]

Thanks Plun. SiteAdvisor is in beta, and can cause messages from Microsoft
Antispyware related to adding sites to the Restricted Sites zone which are
confusing.

But I suspect it is giving better advice than I did in this case--thanks!

--

 

[plun]

Hi Bill

SiteAdvisor just inform a user
Really great addon !

About 888.com, it also includes a staff comment.

"SiteAdvisor_Staff
Rating: Bad download/software or contains spyware/adware
Contains a controversial program made by Cassava."

http://sunbeltblog.blogspot.com/2006/01/on-cassava.html

regards
plun

 

[plun]

Hi again

One more comment, maybe SiteAdvisor advice is wrong ?!

A difficult greyzone again !

About:
http://sunbeltblog.blogspot.com/2006/01/on-cassava.html

"In reclassifying Cassava's gambling applications as "Low risk,"
Sunbelt can continue to offer these detections to users, while still
requiring users to affirmatively elect to remove Cassava's gambling
applications by changing the selected action in CounterSpy's scan
results from "Ignore" to "Quarantine" or "Remove." "


"As a result of our classifications, users who knowingly installed
Cassava's software can continue to use the software without fear that
it will be removed by default by CounterSpy, while users who want to
remove the software can do so."

All details:
http://www.sunbelt-software.com/ihs/alex/cassavaresearchwriteup.pdf

regards
plun


Maybe

 

[Guest]

Thanks for all the suggestion guys.
Some interesting points.

However , further examination of the problem file 34.tmp.
It seems similar to other files created by party poker. Format (number).(tmp)
All the same size. About 2k.
All start with text " BEGIN CERTIFICATE" & end with "END CERTIFICATE"
I don't know much about these things but I suspect that the file is OK. And
the MS antispyware signeture for "Backdoor trojan" is maybe not specific
enough.



Regards keefc

Keefc2

 

[Bill Sanderson]

I'm just putting this thread together with another one related to a
completely different issue--a piece of software put out by an Australian
brokerage house.

I think you are right--this particular detection may well be a false
positive.

--

 

[Guest]

This alert is a false positive. There is nothing wrong with the Party Poker
site(at least with respect to infecting anyone's machine with this virus).
The methodology used by the antispyware software for detecting this virus is
rather lazy. Because a file called 34.tmp has been found in the temp
directory does not mean you have a virus. Many legitimate programs create
temporary files, and the naming is irrelevant. 34.tmp is hardly a unique
name by which to identify for certain that a virus is present.

I have updated my setting to "always ignore" this threat.

See also this thread on twoplustwo:
http://forumserver.twoplustwo.com/showflat.php?Cat=0&Number=4581290&page=1&fpart=all&vc=1