DanThMan 0 Report post Posted November 20, 2004 Yesterday I've cleaned out eight JS.Classloader, eight byte...something andeight wintrj! All located in the cache of Sun's Java installation!!!How the h**l did they end up there?Today when I was coming here, the page froze with lots of CPU-load.Kerio pops up with a bla.exe that wants to connect to the world, Yeah right :PI can't find much about bla.exe, I'll guess it's a new one, but it's the firsttime I've got a virus just by opening a webpage.Two full scans in two days at 4 hours each. How fun is that?I'm still not shure about bla.exe. There may still be something left in the systemand I wonder if anyone recognize this one. Is there a removal tool somewhere?Virusmakers should be thrown to some really hungry lions! Share this post Link to post Share on other sites
Hercco 0 Report post Posted November 20, 2004 I did a search at Symantec Security Response and all it gave was this page http://forums.xisto.com/no_longer_exists/ It apparently uses a file called bla.exe to spread. But it is a ratahr old (as virii goes) so your scanner should be able to recognise it. Share this post Link to post Share on other sites
DanThMan 0 Report post Posted November 20, 2004 I did a search at Symantec Security Response and all it gave was this page http://forums.xisto.com/no_longer_exists/ It apparently uses a file called bla.exe to spread. But it is a ratahr old (as virii goes) so your scanner should be able to recognise it. <{POST_SNAPBACK}> Nope, that's not it. Probably a newer version with slightly different behavior!Anyway the importance of having a firewall that checks both in and outgoing traffic is rather obvious when these things happen! I've got Avast and Kerio together with a router. Together they do a tremendous job so there's hardly any reason to panic. But it's really annoying to discover that someone raped your registry! It does take some time to find and erase those filthy activities Thanx Herrco for the effort cheers Share this post Link to post Share on other sites
