Code PBLibs in PB

El_Choni · Post by **El_Choni** » Sat Dec 27, 2003 11:27 pm

I ran my AV with the exe, no virus. Ran it in the whole hd, the same. Anyway, I had a look at that virus, and it seems that the request for plugin install you talk about must come from a web page. Can't come from the exe, which you hadn't even downloaded yet.

You're sure you were not visiting some hot sites just before trying the link I put? XD

Post by **Polo** » Sun Dec 28, 2003 12:03 am

i can't download it : file not found ...

Manne · Post by **Manne** » Sun Dec 28, 2003 12:08 am

I don't talk about your file El_Choni, sorry for misunderstanding.
Before the download starts the site request to install a browserplugin.
This plugin maybe contains malicious code.
I am using Kaspersky Antivirus and had no bad alert in the past for almost two years of using it.
I don't know what the plugin is for, maybe it is a kind of ad or spyware.

You're sure you were not visiting some hot sites just before trying the link I put? XD

For sure. My system is protected with an excellent firewall (look'n'stop), one of the best av (kav) and last but not least adwatch by ad-aware.

Manne

Proteus · Post by **Proteus** » Sun Dec 28, 2003 12:14 am

Maybe you want to do a AV scan, Manne. Trojandownloader tries to download trojans. It may already be on your system.

BTW, Trojandownloader travels by e-mail, as an attachment to a mail that is made to look like it's from kaspersky.com

Manne · Post by **Manne** » Sun Dec 28, 2003 12:30 am

@Proteus

Thanks, but the last complete scan is about 1 hour ago.
My System seems to be clean.
I've received no mail containing an attachment for about 3 days and i don't use outlook as client.
I've checked the site again right now and got the same result.
The (maybe) infected file is a dll called "MaConnect.dll" and is a part of this browserplugin.
If you select no to abort the installation of this plugin you get an downloadrequest for a dialer named "od-stnd269.exe".
Don't use NAV or F-Prot for testing. This software is obvious and didn't detect many known viruses.

Manne

Post by **Berikco** » Sun Dec 28, 2003 9:53 am

I downloaded it yesterday, no request for installing a plugin.
Sophos AV did not found a virus in the installer.

Post by **Polo** » Sun Dec 28, 2003 12:03 pm

Can someone post it in another place, as I say, I can't download the file...

Proteus · Post by **Proteus** » Sun Dec 28, 2003 12:28 pm

The file is there. Right-click on the link and click "Save target as".

Post by **Polo** » Sun Dec 28, 2003 12:55 pm

it's not here for me ...

Proteus · Post by **Proteus** » Sun Dec 28, 2003 1:43 pm

Odd... Are you using some sort of site blocker?

Post by **freak** » Sun Dec 28, 2003 2:48 pm

Might be because there is a space in the filename, some browsers
have a problem with that.

Timo

El_Choni · Post by **El_Choni** » Sun Dec 28, 2003 3:08 pm

Hi,

I still don't understand what can be happening. The URL I gave is not a web site, it's only a folder with the executable and an update file, no html. I don't understand why or how you get a plugin install request. The domain is terra (Telefonica), it's unlikely that they make you download a virus. Maybe I'll put an underscore instead of a space to see if that fixes something:

EDIT: my mistake, mistyped the URL, sorry.

http://www.terra.es/personal5/temporald ... taller.exe

But I strongly recommend you to wait for the final version anyway.

einander · Post by **einander** » Sun Dec 28, 2003 4:06 pm

El_Choni:
http://www.terra.es/personal5/temoprald ... taller.exe

No luck.
That is the message that Terra shows:

ERROR
Ha sido imposible encontrar la pÃ¡gina solicitada. IntÃ©ntalo mÃ¡s tarde.

Post by **Polo** » Sun Dec 28, 2003 4:35 pm

still don't work ...

Elchroni => Can you send it by email to me, and I will post it on my website ?

My email is webmaster@gtnsoft.com

Thanks

El_Choni · Post by **El_Choni** » Sun Dec 28, 2003 6:23 pm

@Polo: thank you, but I think it's better to make it available when it's finished. It is a beta now, there's no help file included yet and several bugs must be fixed. But I'll send it to you as soon as it is finished. Anyway, the link above should work now (I had mistyped the URL, sorry).