Can someone external reset my Autorun on a WinXP machine?

Can someone external reset my Autorun on a WinXP machine?
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Computer Software Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Can someone external reset my Autorun on a WinXP machine? Edw. Peach 01-12-2006
Posted by Edw. Peach on January 12, 2006, 11:39 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I've been having some strange computer occurances, all starting two
weeks ago when my AV detected some malware on my computer,
JAVA_BYTEVER.A. These are the files that my software detected:

JAVA_BYTEVER.A = BlackBox.class
JAVA_BYTEVER.A = Bug.class
JAVA_BYTEVER.A = Dummy.class

th.jar-fb0a0d9-42a11ab0.zip

The files were removed and I haven't had any further problems until
today. I tried to download some digital photos to my HD and the
AUTORUN was not working. When I plug a card into my card reader, the
autorun pops up and wants to know what I want to do normally. I just
used it a few days ago and it was working fine. Then I noticed that
all Autorun stopped working, including my two CD bays. I finally got
it back up and running by using TWEAKUI. The Autorun had been turned
off. (I didn't turn it off.) Also, when I accessed my Control Panel,
I got an error message about encountering some problem opening IE. I
wasn't opening IE. When I did, my browser homepage had been hijacked
with this:

http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome.

MSN is not my homepage.

I did update my Windows (XP) the other day, but that's all the contact
I have had with MS recently. There have been some recent updates in
the past few days.

I scanned for viruses and also ran Ad-Aware. Nothing.

What could possibly turn off my autorun feature? Is this something I
should be concerned about?

Posted by D Nguyen on January 13, 2006, 3:24 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Awww.
Looks like you'll have to format your computer and re-install.

The URL + JV Class look nasty!!! I think you got the M$.JVM virus. Might
aswell change to a MAC with OSx running. I've heard people said MAC is
more stable and user friendly =D


Edw. Peach wrote:
> I've been having some strange computer occurances, all starting two
> weeks ago when my AV detected some malware on my computer,
> JAVA_BYTEVER.A. These are the files that my software detected:
>
> JAVA_BYTEVER.A = BlackBox.class
> JAVA_BYTEVER.A = Bug.class
> JAVA_BYTEVER.A = Dummy.class
>
> th.jar-fb0a0d9-42a11ab0.zip
>
> The files were removed and I haven't had any further problems until
> today. I tried to download some digital photos to my HD and the
> AUTORUN was not working. When I plug a card into my card reader, the
> autorun pops up and wants to know what I want to do normally. I just
> used it a few days ago and it was working fine. Then I noticed that
> all Autorun stopped working, including my two CD bays. I finally got
> it back up and running by using TWEAKUI. The Autorun had been turned
> off. (I didn't turn it off.) Also, when I accessed my Control Panel,
> I got an error message about encountering some problem opening IE. I
> wasn't opening IE. When I did, my browser homepage had been hijacked
> with this:
>
> http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome.
>
> MSN is not my homepage.
>
> I did update my Windows (XP) the other day, but that's all the contact
> I have had with MS recently. There have been some recent updates in
> the past few days.
>
> I scanned for viruses and also ran Ad-Aware. Nothing.
>
> What could possibly turn off my autorun feature? Is this something I
> should be concerned about?

Posted by optikl on January 13, 2006, 7:58 am
If you were  Registered and logged in, you could reply and use other advanced thread options
D Nguyen wrote:
I've heard people said MAC is
> more stable and user friendly =D
>
Gee, you think? :). Not even close.....

Posted by Edw. Peach on January 13, 2006, 9:01 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I've been trying to understand how my computer can be infected even
after I scanned it regularly since those infected files were covered.
I use Trend Micro PC-illian and I'm getting all the latest downloads
all the time. Other than the incident yesterday where my IE browser
was directed to the MSN homepage, and my autorun stopping, I'm really
not having any other problems.

After I removed those infected files, I ran the AV scan again, turning
off my system restore. Why isn't my AV software finding more
suspicious code or files?

Reformatting is a real Pain-i-t-A$$. With all that must be known by
now (it's been around for a while and is listed 3rd on a list of
active malware at the Trend Micro site) about this malware
(JAVABYTEVER.A) surely my AV software 'knows' what to look for?

Posted by Bit Twister on January 13, 2006, 10:41 am
If you were  Registered and logged in, you could reply and use other advanced thread options
On Fri, 13 Jan 2006 09:01:58 -0500, Edw Peach wrote:
> I've been trying to understand how my computer can be infected even
> after I scanned it regularly since those infected files were covered.

What is regularly. One new malware created per hour, on average.
Do you think the AV vendor can find the new malware, create test for
it, add to database, and get it to your system before you get infected
or before your next scan. :(

> I use Trend Micro PC-illian and I'm getting all the latest downloads
> all the time. Other than the incident yesterday where my IE browser
> was directed to the MSN homepage, and my autorun stopping, I'm really
> not having any other problems.

Good malware design would aim to NOT cause you problems.
Kind of like cancer. Is in not there if it is not causeing you a
problem today.


> After I removed those infected files, I ran the AV scan again, turning
> off my system restore. Why isn't my AV software finding more
> suspicious code or files?

Your AV software can only find known malware.
How does it know about new malware.
People find it and send it to the vendor to log. Vendor runs honeypots
hoping to get infections they can add to their signature database.

Where are you in this process, Oh, 15 to 48 hours without protection,
at best.

In the past, the malware would be flooding the net and would showup pretty
quickly by just looking at traffic. Now the criminals are getting into
it and their malware is sneaker and more low key doing it's best to
stay under the radar.


> Reformatting is a real Pain-i-t-A$$. With all that must be known by
> now (it's been around for a while and is listed 3rd on a list of
> active malware at the Trend Micro site) about this malware
> (JAVABYTEVER.A) surely my AV software 'knows' what to look for?

Then there is the new malware which is disabling the AV and firewall
software.

How would you know if your AV software was replaced with software
which provided you with the same screens as the real AV software.

You CAN NOT beleive anything your system software indicates after the system
has been cracked/infected.


Similar ThreadsPosted
External Drive Encryption April 5, 2007, 9:29 am
win2k machine hacked with Serv-U FTP etc May 29, 2006, 11:37 pm
"process deneid" running on win2k machine June 16, 2005, 6:16 pm
Evidence of file copy to external device on Windows 2000 / FAT 32 April 19, 2006, 4:05 am
ANN: New Book: Machine learning and data mining for computer security February 11, 2006, 5:27 pm
security hole in winXP July 9, 2006, 8:48 pm
Which of these netstat connections should be banned on WinXP? March 23, 2006, 2:57 am
Is the WinXP NTFS encryption secure? November 14, 2008, 8:04 am
How to truly check for malware a WinXP System Disk connected through USB to another computer November 4, 2008, 9:38 am

The site map in XML format XML site map

Contact Us | Privacy Policy