ALERT - Trojan Threat

[Sowelu]

Hey All!

I am 99.9% certain that Celia Fenn's site has a Trojan virus infection, as much as I hate to be the bearer of such news. The Trojan name is Downloader-BEW.

This is the url: www.starchildascension.org/ that I highly suggest one does NOT click unless/until this is cleared up.

It's likely that she has no idea, btw, and since I'm not on her mailing list, I don't have an email address to write to her about it.

It's my suspicion that this trojan attached itself to the Active X function on her site.



I was completely clean as per McAfee Virus Scan, AdAware and SpyBot Search & Destroy, when I started my computing day today (around 5PM Eastern). I began my usual internet rounds and when I went to Celia Fenn's url above, Active X took quite some time to load, and as it did, my VirusScan software popped up an alert that it caught and quaranteened the mentioned Trojan.

Just to be safe, I closed the window, disabled my internet connectivity entirely, and began scanning all my files again, using those three products mentioned above. Sure enough, the Trojan had proliferated ALL OVER MY COMPUTER, regardless of the fact that the VirusScan said it had caught it.

I ran all three products 4 more times each to be sure, and it took all but the last run to entirely remove the Trojan from my system. It had infiltrated my Registry and my system restore files, as well as myriad other download executables and temporary files, including my cache and history files.

PLEASE take note of this, remember that Celia likely has NO IDEA this is happening on her site, and if you can write to her to alert her I'd be grateful.

I won't be going to her site for articles as a result, so if something new comes along from her, perhaps we'll see it elsewhere on the 'net.

Thanks,
Sowelu

[LilliHart]

Sowelu, How can you tell if this has happened to your computer? What are the signs and symptoms?

[Nicole]

If you have virus software it should have caught it. But you can always google the name that Sowelu posted (I may do it later if I have time) and then run a tool (found in the search) to figure out if you have it and fix it.

[Sowelu]

What Nicole said.

I have a virus protection software that detected it and seemed to prevent it from doing any harm... but it proliferated all over my hard drive files and registry nonetheless. And got into the restore files, which is the worst part, I think...

One thing I DID notice, Lili, is that my computer was MUCH slower than it normally is while this thing was proliferating itself all over my files, and it seemed to interrupt or redirect certain site accesses on the 'net.

Without being certain, my sense is that it left my virus protection quite busy and vulnerable to other annoying buggers having their way more easily or something. I found a browser hack file also got in while I was dealing with this Downloader-BEW. It made certain sites I always go to, show up as "unable to load page". It basically scripted a DNS change every time I wanted to go to certain sites. So if I wanted to go to 255.255.255.0 I'd end up at 71.222.22.4 every single time, which was not a site at all. (Hope that made sense)

Also, one of the problems with a trojan like this one....

Let's just say that a month from now I have a situation where I want to restore my operating system back to a previous date. Well... if I restore, that trojan is sitting there in those files -- because virus protection has not and cannot access the restore files to do a sweep and eliminate the bad files or tags. The restore files are off limits to the virus scanning software, typically because those files are not supposed to be touched by ANYTHING (clever trojan, eh?) -- and so I end up "restoring" a mess, in true "trojan horse" style.

I'd do what Nicole suggests to see if it's on your computer at all. And if you use McAfee Virus protection I can tell you that they have the definition file and you would have been alerted. But if you use some other virus protection product... I have no idea if they're up to date with this trojan or not.

Just to be clear, though... while I received the trojan's schematic plan by it tagging and infiltrating certain files on my hard drive, no actual damage was done because my virus protection prevented that from happening. But if I were to do the restore, as mentioned, somewhere down the line, I could have this entire problem back again, and who knows if the virus protection then would address it the same way, considering it would be "native" to my system files at that point.

So I cleared all my restore files once this Downloader-BEW was removed entirely, and have only a restore possibility from that day forward.

Hope this all made some sense!

[MarliesC]

Thanks Sowelu for the warning. I haven't noticed any problem with my computer so far, then again since I switched to using Firefox which does not use Active X, Internet surfing has been easier, except for the sites that demand that I use IE. For those sites Firefox has an add-on that lets you switch to IE mode.

Hugs,
Marlies

[Nicole]

Truthfully, while this registered itself as a trojan, it has the signature of spyware. I'm sure that Celia Fenn wouldn't put this on her site on purpose so someone probably was able to up load it without her knowledge.

Here are some links:

forums.majorgeeks.com/showthread.php?p=1051795 - mentions shutting down McAfee

vil.nai.com/vil/content/v_143361.htm - good info on what it actually does (confirms it's malware, a form of spyware, and that it is pinging other websites thus slowing you down)

By the way, you cn download some free spyware removal tools that are good. I recommend Spybot and something else in conjunction with it. I think the name of what I used to use was Ad Aware. They should both be free.

If you need free antivirus, go to www.grisoft.com and get the free AVG version. It's great.