Web Trac

hk.www404.cn:53/ads.js

Posted on May 10, 2008 under Security, Uncategorized | 19 Comments

This JS/Downloader.Agent virus is keep changing it’s location.

Now source code of every web page show these lines at the top of page.

<script src=”xx http://hk.www404.cn:53/ads.js xx ” language=”javascript”></script> [ xx added intently don't visit this linke.]

If your network is also facing the same problem then then best suggestion that change your ISP. In fact this the only solution of this problem.

If you can’t change your ISP then at least do not use Internet Explorer. If you are using Internet Explorer 6 or older version then chances of getting infected is high.

I always use FireFox, Because it is faster and secure. You can download it from following link:

UPDATE:
Latest injected code is:
iframe src=’http://net.jopppqq.com/ad/vip.htm’ width=100 height=1, so now the virus is hosted on jopppqq.com.

g.asdafdgfgf.com is now u.asdafdgfgf.com

Posted on Apr 09, 2008 under Computer, Security | No Comment

Every thing was ok in last month, but since last few days JS/Downloader.Agent virus is back again. Seems our network have still some infected computer or they are infected again.
This time this virus has changed it’s location from g.asdafdgfgf to u.asdafdgfgf.com.

While our cable operator is trying to find the machine which is infected with the virus I’m trying a trick which is working for me. Well it’s simple: just turned of Javascript option. It’s working for me. I’m using FireFox browser Avast antivirus (4.8 Home edition).

Here is how you can disable JavaScript in FireFox:
Tools =>option and then click on “Content” tab. Now uncheck Enable JavaScript.

Disable JavaScript in IE 7.x, 6.x, and 5.x

1. Open Internet Explorer.
2. Select Internet Options from the Tools menu.
3. In Internet Options dialog box select the Security tab.
4. Click Custom level button at bottom right. The Security settings dialog box will pop up.
5. Under Scripting category check Active Scripting, Allow paste options via script and Scripting of Java applets
6. Check radio boxes.
7. Click OK twice to close out.

Update: Removing JS/Downloader.Agent virus

Posted on Feb 02, 2008 under Security | 7 Comments

This is just an update of my last post Removing JS/Downloader.Agent virus. I’m still not able to get rid of the problem but seems found the root of the problem.

The tool that I suggested in last post is just a temporary solution. Actual problem is that my computer is not infected, it is other infected computer(s) in our Cable networks LAN . AVG antivirus is just stopping the virus to infect my computer.

When I posted my problem on few other tech forums they said that either my computer is infected or I am regularly visiting some site which are infected or AVG is just identifying a normal file as a virus. Someone suggested me that I should use other anitivirus. So I downloaded Avast home edition which is a free to use antivirus software.

Avast also detecting the same virus just with different name, it also showing location from where it trying to download. Well it is http://g.asdafdgfgf.com/ads.js [don't visit this site].

When I did a search about this link, I found very helpful and informative thread at DevNetwork Forum..

There several peoples are complaining about the same problem. Going through each post, what I understood that:

At first it downloads a copy of ads.js file from http://g.asdafdgfgf.com/ [don't visit this site] in an unprotected computer. Then it downloads and execute ADS.EXE file.

ADS.EXE has been seen to perform the following behavior(s):

• Executes a Process
• Creates a TCP port which listens and is available for communication initiated by other computers
• The Process is packed and/or encrypted using a software packing process

ADS.EXE has been the subject of the following behavior(s):

• Created as a new Background Service on the machine
• Created as a process on disk
• Executed as a Process
• Added as a Registry auto start to load Program on Boot up

More information on this file can be found at : SpywareData.com and Prevx.com.

Since the problem is not in my computer and it is in someone else computer in our Cable networks LAN so only cable operator can help me in this matter.

Removing the infected computer(s) from LAN is the only solution of this problem. In the forum someone suggested a tool for cable operator that help in finding the infected computer. This tool can be downloaded from http://www.arechisoft.com/. A cable operator of Andheri/Mumbai, have explained how they were successfully get rid of this problem. Here is it if you wants to read: http://forums.devnetwork.net/viewtopic.php?p=438910#p438910

Since only the cable operator can help me in this matter, I’m trying to contact them, let’s see how long does it take.

Tags: Downloader.Agent, LAN, virus

Removing JS/Downloader.Agent virus

Posted on Jan 26, 2008 under Computer, Download, Security | 4 Comments

Don’t know how but my computer infected by a virus called JS/Downloader.Agent. When ever I was starting Internet explored, I was getting the warning message from AVG Antivirus. I deleted it several times but it was coming back in every 2/3 min. The virus was coming with .js or .htm extension and was storing in some sub folder of ‘temporary internet files’ folder.

Whole day I tried to find a way to remove the virus, deleted a all the files/cookies of temporary internet file. Scanned whole computer 3/4 times with AVG Antivirus and few other anti virus softwares and spyware removal tools and other tools found from Google. None of them worked.

Finally I found a tool named “SmitFraudFix” from here. I downloaded this tool and followed the instruction. After that I’ve not got any warning in last two days. Seems this tool is really capable to remove this JS/Downloader.Agent virus.

Please note that I am not asking you to use this tool, this is my personal experience, there may be exist a better tool to remove this JS/Downloader.Agent virus. But this what I found useful and shearing it here with you. If you can suggest me a better then this one then I will be very thank full to you.

Tags: Antivirus, JS/Downloader.Agent, virus

GoDaddy February 2008 .info domain renewal coupon

Posted on Jan 22, 2008 under Coupon | No Comment

Here is the another coupon code for info domain renewals. Using this coupon code you will be able to renew your .INFO domains just for only $6.99 for the first year and SAVE 30%

Coupon Code: gdp0130c

Expire on: February 11, 2008

Tags: godaddy

Airtel Mobile Office: Problem with Samsung SGH-E250

Posted on Jan 14, 2008 under Bluetooth, Mobile | No Comment

I am using BSNL’s Internet service since a long period. Their service is not very satisfactory. Most of time they are down. One of my friend suggested me to use Airtel Mobile Office. He said it will cost around Rs. 500.00 ($13.00) per month and I can use any bluetooth supported Mobil set. My Mobile phone (Samsung SGH-E250) have this option and price was also reasonable, so I decided to give it a test drive.

After subscribing for Airtel Mobile Office, my account was activated within 48 hours, but the problem was that I was able to browse internet on mobile but not on my PC. I called Airtel customer services but didn’t any solution. I Googled it but couldn’t find any solution of this problem.

Here is what my friend suggested which worked.
1. Go to Start -> Control panel -> Phone and Modem ->
2. Select the 'Bluetooth DUN Modem' (or what ever is name of your bluetooth modem) and click properties.
3. On Advanced Tab Enter in Extra setting box. : AT+CGDCONT=1,"IP","airtelgprs.com"<CR>
Hope this will help you.

Tags: Airtel Live, AirtelLive, Bluetooth, Samsung, SGH-E250