IE7 virus.

[Skybuck Flying]

Files from some kind of IE7 virus... <- was just installed for christ sakes.

Exe file was deleted it looked suspicious too.

http://members.home.nl/hbthouppermans/IE7Virus/

 

[Malke]

Files from some kind of IE7 virus... <- was just installed for christ
sakes.

Exe file was deleted it looked suspicious too.

http://members.home.nl/hbthouppermans/IE7Virus/

Did you have a question? Or were you offering the infected files for anyone
who clicks on the above link? If the former, I'm sorry but I don't see it.
I'd like to help so please do post back with clarification. If the latter,
this isn't the right place.

Malke

 

[Skybuck Flying]

The files are provided for further examination.

I was just playing stratego on gravonclient 119.

Then I noticed my computer became active.

Maybe gravonclient 119 installs it...

Could be a trojan.

Or maybe my computer just infected.

Or maybe there is a hole in windows.

To me it seems pretty serious because it goes quiet easy.

Google gravonclient 119 maybe it's infected.

Bye,
Skybuck.

 

[Skybuck Flying]

Another possible explanation could be a serious security hole in ipv6 stack.

Bye,
Skybuck.

 

[Malke]

Another possible explanation could be a serious security hole in ipv6
stack.

Bye,
Skybuck.

Or that you're a troll. *plonk*

Malke

 

[David H. Lipman]

From: "Skybuck Flying" <[email protected]>

| Another possible explanation could be a serious security hole in ipv6 stack.

| Bye,
| Skybuck.



No, that's FUD.

There are many ways you got infected. The vast majority of infections are due to
vulnerability exploitation.
The other most common way is via Social Engineeering.

The DLL is malware. A Browser Helper Object (BHO)
http://www.virustotal.com/analisis/a6b675dafa1ea885f6a0b3c6cfe4c0aa

Now pull the bloody files off that server so you don't get anyone inected !

 

[Skybuck Flying]

The virus returned.

The folder has been uploaded with two other suspicious files !

Thanks and Bye,
Skybuck.

 

[Skybuck Flying]

The virus also created many jobs in the schedular... that's how it restarted
itself at certain times.

I deleted those jobs...

And I am gonna deactive the schedular service just in case

Bye,
Skybuck.

 

[David H. Lipman]

From: "Skybuck Flying" <[email protected]>

| The virus also created many jobs in the schedular... that's how it restarted
| itself at certain times.

| I deleted those jobs...

| And I am gonna deactive the schedular service just in case

| Bye,
| Skybuck.


OK -- All malware !

NOW DELETE THEM!