Yahoo Groups archive

MOTM

Index last updated: 2026-04-28 23:35 UTC

Message

Re: OT: important PC spying / hacking

2004-04-26 by J. Larry Hendry

Thanks Michael and all who responded.   I did indeed get this and ad-aware
yesterday once I discovered my problem.
Larry H


----- Original Message -----
From: Metzger, Michael A <MAMETZGER@...>
To: MOTM List <motm@yahoogroups.com>; synth DIY
<synth-diy@...>
Sent: Monday, April 26, 2004 10:33 AM
Subject: RE: [motm] OT: important PC spying / hacking


The best application we've found for malware like that is Spybot Search &
Destroy. It seems to catch some files that Ad-Aware misses. Note that these
apps are designed to identify and clean data miners, pop ups, etc - not
viruses.
http://www.safer-networking.org/index.php?page=download
After installing it make sure to download the updates. Then run it and you
should be clean. It's still free but I see that they are now asking for
donations. It's a great tool.

Mike

-----Original Message-----
From: J. Larry Hendry [mailto:jlarryh@...]
Sent: Monday, April 26, 2004 11:12 AM
To: MOTM List; synth DIY
Subject: [motm] OT: important PC spying / hacking


I hate "virus warning" e-mails, because so many of them in the last have
been a hoax.  However, I recently discovered something on my PC that I
wanted to share with my "friends" here on this list.  I am on a dial up
connection, so data traffic is fairly obvious.  I started noticing a large
amount of data transfer to and from my PC when there should have been none.

So, I started looking for suspicious executable files and found the
offender.  It started in my C:\windows directory as a file called
"system.exe".  The file was dated 4/1/04 (April fools day).  Here is some
info on this nasty piece of spyware that was copying files from my machine.

http://www.sophos.com/virusinfo/analyses/trojtofgerb.html

Larry Hendry







Yahoo! Groups Links








Yahoo! Groups Links

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.