BENGANG!!! nape aku takleh bukak address nih???

bzzts

http://securityresponse.symantec ... llw.gaobot.gen.html

http://securityresponse.symantec ... t.removal.tool.html

http://securityresponse.symantec.com/avcenter/tools.list.html


yg tu contoh aje, boleh kata semua address symantec nyer download pages utk worm remover aku takleh bukak. :kant:

lagi, mcafee punya page for "subcscription confirmation" pon takleh bukak.

agak2 korang kenapa? dan cemana nak settle? :stp:



thanks.... ;)

Sarah_Radzi

check file

%windows%/system32/drivers/etc/hosts ..

ade tak website yang takleh bukak tu dalam tu ?

aku bukak ok je otomen..ko pakai ie kan..

cuba tuko browser..tengok test..aku pakai netscape

Infophilia

Lately this question has been coming up more often..

Are you able to view the website giving the IP address of it in the address bar ?

check the properties in IE
open IE. go to tools --> internet options --> security --> restricted sites and see if that particular website is listed

OR there maybe 3rd party software products like Nanny software and many settings possibilities that contribute to this. Some thoughts are ....

Change security settings - There are restricted site settings and trusted site settings
change privacy settings - Many other processes and possibilities such as KIOSK mode or Permissions and so on.

IE 6 - help - type in the search area the word restrict .... much insight there.




[ Last edited by Infophilia on 10-6-2004 at 10:26 AM ]

bzzts

Originally posted by Sarah_Radzi at 10-6-2004 02:28 AM:
check file

%windows%/system32/drivers/etc/hosts ..

ade tak website yang takleh bukak tu dalam tu ?

thanks sarah,
memang ada termasuk live updater norton.
patutla takleh update norton antivirus.

so, whaty should i do next? delete the host file? delete the list? atau edit I.P. ??? :stp:

Sarah_Radzi

delete semua entry yang pelik .. (delete line .. )

semua yang Norton, mc afee dll ..

bzzts

[quote]Originally posted by 蝯z坞悬

Sarah_Radzi

then check thoroughly for trojan/spyware/virus dll ..

rasanya komputer u ade backdoor ataupun virus tu ..

Sarah_Radzi

errr
kalau masih sempat ..

paste sini line yang didelete

bzzts

Originally posted by Infophilia at 10-6-2004 10:24 AM:
Lately this question has been coming up more often..

Are you able to view the website giving the IP address of it in the address bar ?

check the properties in IE
open IE. go to tools --> ...

those setting are empty. no restricted address at all...
i'm aware of nanny programs but it should not prevent access to antivirus website!
especially to update my antivirus of course! ;)

bzzts

Originally posted by Sarah_Radzi at 10-6-2004 10:54 AM:
errr
kalau masih sempat ..

paste sini line yang didelete

semua lom delete... ni dia list....

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

127.0.0.1        www.symantec.com
127.0.0.1        securityresponse.symantec.com
127.0.0.1        symantec.com
127.0.0.1        www.sophos.com
127.0.0.1        sophos.com
127.0.0.1        www.mcafee.com
127.0.0.1        mcafee.com
127.0.0.1        liveupdate.symantecliveupdate.com
127.0.0.1        www.viruslist.com
127.0.0.1        viruslist.com
127.0.0.1        viruslist.com
127.0.0.1        f-secure.com
127.0.0.1        www.f-secure.com
127.0.0.1        kaspersky.com
127.0.0.1        www.avp.com
127.0.0.1        www.kaspersky.com
127.0.0.1        avp.com
127.0.0.1        www.networkassociates.com
127.0.0.1        networkassociates.com
127.0.0.1        www.ca.com
127.0.0.1        ca.com
127.0.0.1        mast.mcafee.com
127.0.0.1        my-etrust.com
127.0.0.1        www.my-etrust.com
127.0.0.1        download.mcafee.com
127.0.0.1        dispatch.mcafee.com
127.0.0.1        secure.nai.com
127.0.0.1        nai.com
127.0.0.1        www.nai.com
127.0.0.1        update.symantec.com
127.0.0.1        updates.symantec.com
127.0.0.1        us.mcafee.com
127.0.0.1        liveupdate.symantec.com
127.0.0.1        customer.symantec.com
127.0.0.1        rads.mcafee.com
127.0.0.1        trendmicro.com
127.0.0.1        www.trendmicro.comText

Sarah_Radzi

ok bleh delete dah semua tu

check ni

http://securityresponse.symantec ... ackdoor.nibu.e.html

[ Last edited by Sarah_Radzi on 10-6-2004 at 05:00 AM ]

bzzts

i open hosts file tu pakai notepad, boleh ke delete address tu aje? atau delete semua (the whole hosts files) tu?

atau i should change my I.P address atau edit I.P address yg dalam hosts files tu? :stp:

Sarah_Radzi

When Backdoor.Nibu.E is executed, it does the following:

   1. Copies itself as these files:
          * %System%\netda.exe
          * %Startup%\netdb.exe
          * %System%\netdc.exe

            Notes:
          * %System% is a variable. The Trojan locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
          * %Startup% is a variable. The Trojan locates the Windows startup folder and copies itself to that location. For example, this is C:\Windows\Start Menu\Programs\Startup (Windows 95/98/Me) or C:\Documents and Settings\<current user>\Start Menu\Programs\Startup (Windows NT/2000/XP).
   2. Creates the following files:
          * %Windir%\prntk.log
          * %Windir%\prntc.log
          * %Windir%\TEMP\feff35a0.htm
          * %Windir%\TEMP\fa4537ef.tmp

            Note: %Windir% is a variable. The Trojan locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and create files in that location.
   3. Adds the value:

      "load32"="%System%\netda.exe..."

      to the registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      so that the Trojan runs when you start Windows.

   4. Creates and loads a .dll file to capture keystrokes. Known variants have used %Windir%\prntsvr.dll as the file name, which is detected as Keylogger.Trojan.

   5. May create the registry keys:
          * HKEY_LOCAL_MACHINE\SOFTWARE\SARS
          * HKEY_USERS\.DEFAULT\SOFTWARE\SARS

   6. Modifies the value data of:

      Shell

      in the registry key:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

      from:

      "explorer.exe"

      to:

      "explorer.exe %System%\netdc.exe"

      so that the worm runs when you start Windows NT/2000/XP.

   7. Modifies %Windir%\system.ini file by changing the value:

      Shell="Explorer.exe"

      to:

      Shell="explorer.exe %System%\netdc.exe"

      so that the worm runs when you start Windows 95/98/Me.

   8. Looks for windows that contains any of the following strings in the title bar:
          * gold
          * Storm
          * e-metal
          * WebMoney
          * http: //westsideuu.org/images/logger.php
          * WM Keeper
          * Keeper
          * Fethard
          * fethard
          * bull
          * Bull
          * mull
          * PayPal
          * Bank
          * bank
          * cash
          * ebay
          * ePass
          * iKobo
          * Fidelity
          * EcoCard
          * Ameritrade
          * Wasington
          * capital
          * Wells Fargo
          * E*TRADE
          * Keyword 1
          * Keyword 2
          * Keyword 3
          * Keyword 4
          * Keyword 5

            Note: Typically, such windows would be Web browser windows displaying logon screens for financial services or email accounts.

[size=+1]   9. Captures the window title and keystrokes that are typed into windows with the above strings, and then stores them in a log file. This file is named %Windir%\prntk.log. Other stolen information that may also be stored in this file include the IP address of the infected machine, system information such as the operating system and Internet Explorer version. It may try to steal FAR Manager and FTP Commander passwords, and protected storage data.

  10. Launches a thread that monitors the Clipboard, saving any data that is found to a log file. This file is named %Windir%\prntc.log.

  11. Periodically checks the size of the files it uses for logging stolen information. When the files reach a certain size, the stolen information will be copied into an email-formatted file using the Trojan's own built-in SMTP engine. The Trojan retrieves details of the registered owner from the registry and uses these details in the file.

      The email-formatted file has the following characteristics:

      From: <registered owner> <[email protected]>
      To: you

  12. Writes a HTML file containing stolen data to %Windir%\TEMP\feff35a0.htm.

  13. Writes a raw MIME message containing stolen data to %Windir%\TEMP\fa4537ef.tmp.

  14. Listens on TCP ports 1001 and 10000 for remote instructions.

  15. Disables access to certain antivirus Web sites by adding the following lines to %System%\drivers\etc\hosts :

...

[ Last edited by Sarah_Radzi on 10-6-2004 at 05:16 AM ]

bzzts

Originally posted by Sarah_Radzi at 10-6-2004 10:59 AM:
ok bleh delete dah semua tu

check ni

http://securityresponse.symantec ... ackdoor.nibu.e.html

okey, i dah delete and manage to register mcafee AV. (dah 3 minggu takleh register, -PAGE CANNOT BE DISPLAY-)

tapi address kat atas yg u bagi tu, still cannot open lah...

whyy??? :hmm:

Sarah_Radzi

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

   1. Disable System Restore (Windows Me/XP).
   2. Update the virus definitions.
   3. Reverse the changes made to the registry.
   4. Reverse the changes made to %Windir%\system.ini (Windows 95/98/Me).
   5. Restart the computer in Safe mode or VGA mode.
   6. Run a full system scan and delete all the files detected as Backdoor.Nibu.E.
   7. Remove the DNS entries added to Windows hosts file.

For details on each of these steps, read the following instructions.

1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:

    * "How to disable or enable Windows Me System Restore"
    * "How to turn off or turn on Windows XP System Restore"

Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, re-enable System Restore by following the instructions in the aforementioned documents.

For additional information, and an alternative to disabling Windows Me System Restore, see the Microsoft Knowledge Base article, "Antivirus Tools Cannot Clean Infected Files in the _Restore Folder," Article ID: Q263455.

2. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:

    * Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
    * Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

      The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.


3. To reverse the changes made to the registry
WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

   1. Click Start, and then click Run. (The Run dialog box appears.)
   2. Type regedit

      Then click OK. (The Registry Editor opens.)

   3. Navigate to the key:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

   4. In the right pane, delete the value:

      "load32"="%System%\netda.exe..."

   5. Navigate to the key:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

   6. In the right pane, modify the value:

      "Shell" = "explorer.exe %System%\netdc.exe"

      to:

      "Shell" = "explorer.exe"

   7. Exit the Registry Editor.

   8. Restart the computer in Normal mode. For instructions, read the section on returning to Normal mode in the document, "How to start the computer in Safe Mode."


4. Edit the System.ini file
If you are running Windows 95/98/Me, follow these steps:

   1. The function you perform depends on your operating system:
          * Windows 95/98: Go to step B.
          * Windows Me: If you are running Windows Me, the Windows Me file-protection process may have made a backup copy of the System.ini file that you need to edit. If this backup copy exists, it will be in the C:\Windows\Recent folder. Symantec recommends that you delete this file before continuing with the steps in this section. To do this:
               1. Start Windows Explorer.
               2. Browse to and select the C:\Windows\Recent folder.
               3. In the right pane, select the Win.ini file and delete it. The System.ini file will be regenerated when you save your changes to it in step F.

   2. Click Start, and then click Run.
   3. Type the following, and then click OK.

      edit c:\windows\system.ini

      (The MS-DOS Editor opens.)

      NOTE: If Windows is installed in a different location, make the appropriate path substitution.

   4. In the [boot] section of the file, look for a line similar to:

      shell = explorer.exe %System%\netdc.exe

   5. If this line exists, delete everything to the right of Explorer.exe.

      When you are done, it should look like:

      shell = Explorer.exe

   6. Click File, and then click Save.
   7. Click File, and then click Exit.


5. To restart the computer in Safe mode or VGA mode

Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode.

    * For Windows 95, 98, Me, 2000, or XP users, restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."
    * For Windows NT 4 users, restart the computer in VGA mode.


6. To scan for and delete the infected files

   1. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
          * For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
          * For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."
   2. Run a full system scan.
   3. If any files are detected as infected with Backdoor.Nibu.E, click Delete.


7. To delete the added lines from the Windows Hosts file

Note: The location of the Hosts file may vary and some computers may not have this file. For example, if the file exists in Windows 98, it will usually be in C:\Windows; and it is located in the C:\WINNT\system32\drivers\etc folder in Windows 2000. There may also be multiple copies of this file in different locations.
Follow the instructions for your operating system:

    * Windows 95/98/Me/NT/2000
         1. Click Start, point to Find or Search, and then click Files or Folders.
         2. Make sure that "Look in" is set to (C and that "Include subfolders" is checked.
         3. In the "Named" or "Search for..." box, type:

            hosts

         4. Click Find Now or Search Now.
         5. For each Hosts file that you find, right-click the file, and then click "Open With."
         6. Deselect the "Always use this program to open this program" check box.
         7. Scroll through the list of programs and double-click Notepad.
         8. When the file opens, delete all the entries in the Hosts file, except for the following line:

            127.0.0.1     localhost

         9. Close Notepad and save your changes when prompted.

    * Windows XP
         1. Click Start, and then click Search.
         2. Click All files and folders.
         3. In the "All or part of the file name" box, type:

            hosts

         4. Verify that "Look in" is set to "Local Hard Drives" or to (C.
         5. Click "More advanced options."
         6. Check "Search system folders."
         7. Check "Search subfolders."
         8. Click Search.
         9. Click Find Now or Search Now
        10. For each Hosts file that you find, right-click the file, and then click "Open With."
        11. Deselect the "Always use this program to open this program" check box.
        12. Scroll through the list of programs and double-click Notepad.
        13. When the file opens, delete all the entries in the Hosts file except for the following line:

            127.0.0.1     localhost

        14. Close Notepad and save your changes when prompted.

[ Last edited by Sarah_Radzi on 10-6-2004 at 05:17 AM ]

Sarah_Radzi

Originally posted by bzzts at Thu 10-Jun-2004 05:04:

okey, i dah delete and manage to register mcafee AV. (dah 3 minggu takleh register, -PAGE CANNOT BE DISPLAY-)

tapi address kat atas yg u bagi tu, still cannot open lah...

whyy??? :hmm:

i rasa dia gi letak balik ler hosts tu semua ..

takpe .. i dah copy paste apa yang ditulis kat website tu .. (tak semua)

bzzts

Originally posted by Sarah_Radzi at 10-6-2004 11:04 AM:
When Backdoor.Nibu.E is executed, it does the following:

   1. Copies itself as these files:
          * %System%\netda.exe
          * %Startup%\netdb.exe
          * %System%\netdc.exe

  The email-formatted file has the following characteristics:

      From: <registered owner> <[email protected]>
      To: you

  12. Writes a HTML file containing stolen data to %Windir%\TEMP\feff35a0.htm.

  13. Writes a raw MIME message containing stolen data to %Windir%\TEMP\fa4537ef.tmp.

  14. Listens on TCP ports 1001 and 10000 for remote instructions.

  15. Disables access to certain antivirus Web sites by adding the following lines to %System%\drivers\etc\hosts :
  ...

no wonder i dpt banyak unknown email yg mintak "klik this hyperlink to view this files"...bla-bla bla... is that it?

okay, roughly i understand ur explanation, Thanks!
tapi cemana nak buat yg last sekali tu?

No.15... is it like... kalo nak bukak www.symantec.com so, kena add %System%\drivers\etc\hosts :

so jadi : www.symantec.com%System%\drivers\etc\hosts : <----camni ke?

Sarah_Radzi

daakk !!

tu apa yang virus buat .. heheh
u jangan plak buat ..


u cari memana public proxy ...
pastu set kat live update proxy tu buat sementara

then

download ..

lepas download buang proxy

scan computer ikut second posting copy paste i

bzzts

Originally posted by Sarah_Radzi at 10-6-2004 11:15 AM:
daakk !!

tu apa yang virus buat .. heheh
u jangan plak buat ..

u cari memana public proxy ...
pastu set kat live update proxy tu buat sementara

then

download ..

lepas downl ...

TENGKIU SARAH!!! :clap: :clap:

i think i takes few minutes to access after i deleted hosts files. skrg dah okey. boleh open dah n even update my McAfee AV. :bgrin:

i think u remember few thead from me regarding Norton cannot update, right? this is the problem lah...

hehe... thanks again...
pasni kena scan balik semua... fuh... :kant:  :lol