VIRUS Objectbar theme!
Wednesday, January 22, 2003 by NetHaVoC | Discussion: WinCustomize Talk
ust to let people know I have found a virus in one of the Objectbar skins! here is the text from the find!
File C:\WINDOWS\system.ini did not contain suspicious records.
Virus "schoolbus.2.00.Server" detected in c:\Program Files\Object Desktop\ObjectBar\Mac OSX 10.2.4\Extras\vlt_setup20.exe
just wanted to keep everyone safe!
Just to add if you want to know the ports it goes after!
Schoolbus 1.6 & 2.0 port 43210
Schoolbus 1.6 & 2.0 port 54321
File C:\WINDOWS\system.ini did not contain suspicious records.
Virus "schoolbus.2.00.Server" detected in c:\Program Files\Object Desktop\ObjectBar\Mac OSX 10.2.4\Extras\vlt_setup20.exe
just wanted to keep everyone safe!
Just to add if you want to know the ports it goes after!
Schoolbus 1.6 & 2.0 port 43210
Schoolbus 1.6 & 2.0 port 54321
jebland
Reply #2 Wednesday, January 22, 2003 5:54 PM
Reply #2 Wednesday, January 22, 2003 5:54 PM
Well, great. I downloaded this last Thursday when a guy on the board was asking for help on it. I couldn't figure out the solution to his problem, and I deleted the skin. Today I ran a virus checker and didn't find anything. I deleted all unrecognized cookies, ran regclean and am hoping there's no virus on my computer. I am also behind a firewall at work, maybe that will help. I don't think I will ever use the "doubleclick" to install again. I usually look at every zip before extracting, but it never occured to me that I could get a virus here.
Jafo
Reply #3 Wednesday, January 22, 2003 6:42 PM
Reply #3 Wednesday, January 22, 2003 6:42 PM
NetHaVoK....what AV proggy were you using?
Norton 2003 says it's clean.
InDefense says it's clean.
Trend Micro [online checker] says it's clean....
Norton 2003 says it's clean.
InDefense says it's clean.
Trend Micro [online checker] says it's clean....
mageguru
Reply #4 Wednesday, January 22, 2003 11:59 PM
Reply #4 Wednesday, January 22, 2003 11:59 PM
Personally I am offended...
I know there are some out there that want to make be look bad... that would love to kill any work I do.
I am not so lowly end user... I happen to work in IT, and I know my boxes are vril clean...
Hell the box that I used to make this theme was a fresh install. And the File in question I got directly from Emaculation.com and was d/l'd to this box. I also don't even check mail on this box.
Anyway... I and others have checked and there was no virus...
I also would like to know what AV program NetHaVoK used... If its that good i'll switch to it.
And how come when I am logged wincustomise and go to My Skins it says Alexandrie's Library, who is
Alexandrie?
I know there are some out there that want to make be look bad... that would love to kill any work I do.
I am not so lowly end user... I happen to work in IT, and I know my boxes are vril clean...
Hell the box that I used to make this theme was a fresh install. And the File in question I got directly from Emaculation.com and was d/l'd to this box. I also don't even check mail on this box.
Anyway... I and others have checked and there was no virus...
I also would like to know what AV program NetHaVoK used... If its that good i'll switch to it.
And how come when I am logged wincustomise and go to My Skins it says Alexandrie's Library, who is
Alexandrie?
mageguru
Reply #5 Thursday, January 23, 2003 12:18 AM
Reply #5 Thursday, January 23, 2003 12:18 AM
BTW wasn't my file even verified by wincustomize upon upload, or before being removed... to validate
the legitimacy of the accusation?
Also where does it state that you cannot include executables? I read the guidelines page I don't see anything there about it. see: http://skins.wincustomize.com/tools/guidelines.asp
and http://skins.wincustomize.com/tools/about.asp#rule
(which doesn't seem to work, so I have no idea what it says.)
Looks like some sort of unwritten rule to me. If I am wrong hey, point me to the right place. And if exe's are not allowed, how did it pass your submission processes, and allowed to be posted???
the legitimacy of the accusation?
Also where does it state that you cannot include executables? I read the guidelines page I don't see anything there about it. see: http://skins.wincustomize.com/tools/guidelines.asp
and http://skins.wincustomize.com/tools/about.asp#rule
(which doesn't seem to work, so I have no idea what it says.)
Looks like some sort of unwritten rule to me. If I am wrong hey, point me to the right place. And if exe's are not allowed, how did it pass your submission processes, and allowed to be posted???
Weaksid
Reply #6 Thursday, January 23, 2003 1:09 AM
Reply #6 Thursday, January 23, 2003 1:09 AM
I would like to know which program he is using also. I didn't DL your skin.. Mainly because I don't like anything that deals with Mac.. I had bad things with them when I repaired them. 
But that was mean what happened. It's been happening lately. People blaming the site and people of the site for something they probably did. By what I've seen and heared here, this is one of the most tight sites I've been on. The security, the checking before uploads, etc.
O', I have a idea for a next ObjectDock though since it's part of the title. Or I might do a Objectbar.. My first attempt at that.. Woohoo..
. A Virus Bar. Ever watch the Movie?
But that was mean what happened. It's been happening lately. People blaming the site and people of the site for something they probably did. By what I've seen and heared here, this is one of the most tight sites I've been on. The security, the checking before uploads, etc.
O', I have a idea for a next ObjectDock though since it's part of the title. Or I might do a Objectbar.. My first attempt at that.. Woohoo..
. A Virus Bar. Ever watch the Movie?
IPlural
Reply #7 Thursday, January 23, 2003 1:17 AM
Reply #7 Thursday, January 23, 2003 1:17 AM
I installed and loaded it, it never once attempted to access any ports, period. If it had my firewall would have let me know and shut it down automatically then appended it to the log file and also slide the side bar out notifying me again that there was program/file named " fill in blank " that attempted to access the network. All of which has not happened.
anyway....
oh and NAV, McAfee, FProt and Inoculate respectively, do not find one thing wrong with it either....
by the way, nice theme !!
anyway....
oh and NAV, McAfee, FProt and Inoculate respectively, do not find one thing wrong with it either....
by the way, nice theme !!
Koasati
Reply #8 Thursday, January 23, 2003 9:03 AM
Reply #8 Thursday, January 23, 2003 9:03 AM
Curious as to what the included exe is.............why was it in the skin file?
jebland
Reply #9 Thursday, January 23, 2003 10:05 AM
Reply #9 Thursday, January 23, 2003 10:05 AM
Guys, thanks for the info. Especially IPlural (I was worrying about "Phone Home") I ran McAfee virus checker, and it didn't find anything either. Guess I got alarmed for nothing, but viruses are scary! I have been computing for many years and have never gotten a virus, but I am usually careful.
pjpowell
Reply #10 Thursday, January 23, 2003 11:07 AM
Reply #10 Thursday, January 23, 2003 11:07 AM
Koasati: The executable seems to be a program to emulate the Mac vol control. It may have been better to have provided it as a link rather than the actual executable. If executables should nto be included in executable files it needs to be written somewhere clearly (ie on the upload page).
paxx
Reply #11 Thursday, January 23, 2003 11:14 AM
Reply #11 Thursday, January 23, 2003 11:14 AM
MageGuru,
I too use Norton and didnt find any virus in your file. But Norton has been known to be wrong. We'd better be safe than sorry.
But as I said, wether the file does or not contain a virus is not relevant at this point since, as a general rule, we don't accept executables in the files of our library. It is not written in the guidelines because when we, admins of Wincustomize, wrote the guidelines, we never thought about it, we never thought people would start uploading EXE's in their zips. But recently, some people have indeed started doing so, which forced us to take a decision. That is the reason we don't have a screensaver section, that is the reason we reject logons that include a logonui.exe in it, etc.
Is your executable so essential to your theme? Is it not possible to just remove the execuble from it?
Usually, people understand when we tell them that we can't take the chance of allowing executables. Because it is such a popular site, because litteraly millions of people download files from it, it has indeed become a target for viruses. You must understand that.
As to why Alexandrie's skins are showing up in your My Skins page instead of yours, that's a mystery. I'll alert T-Man or Alexandrie (yes, she is an admin/programmer for this site) on the question.
I too use Norton and didnt find any virus in your file. But Norton has been known to be wrong. We'd better be safe than sorry.
But as I said, wether the file does or not contain a virus is not relevant at this point since, as a general rule, we don't accept executables in the files of our library. It is not written in the guidelines because when we, admins of Wincustomize, wrote the guidelines, we never thought about it, we never thought people would start uploading EXE's in their zips. But recently, some people have indeed started doing so, which forced us to take a decision. That is the reason we don't have a screensaver section, that is the reason we reject logons that include a logonui.exe in it, etc.
Is your executable so essential to your theme? Is it not possible to just remove the execuble from it?
Usually, people understand when we tell them that we can't take the chance of allowing executables. Because it is such a popular site, because litteraly millions of people download files from it, it has indeed become a target for viruses. You must understand that.
As to why Alexandrie's skins are showing up in your My Skins page instead of yours, that's a mystery. I'll alert T-Man or Alexandrie (yes, she is an admin/programmer for this site) on the question.
mageguru
Reply #12 Thursday, January 23, 2003 4:16 PM
Reply #12 Thursday, January 23, 2003 4:16 PM
well "vlt_setup20.exe" is a volume controller that runs in the system tray that emulates the OS X volume control, it is not a requirement, but was included as a bonus.
There is actually another exe included also, "reschanger.exe" which is a requirement, cause the allows the the display icon on my OB to change display resolutions.
And in my next version there will be a 3rd exe included, so that the winamp icon I am adding can give commands to winamp via its menu (its a cmd line application).
Personally, sure I would like to actually use Desktop X plugins to do this, since OB supports them. But no one has written any plugins to do this... and the Desktop X plugin scripting language is just insane, and I am not a programmer. So I am pretty much in a catch 22.
There is actually another exe included also, "reschanger.exe" which is a requirement, cause the allows the the display icon on my OB to change display resolutions.
And in my next version there will be a 3rd exe included, so that the winamp icon I am adding can give commands to winamp via its menu (its a cmd line application).
Personally, sure I would like to actually use Desktop X plugins to do this, since OB supports them. But no one has written any plugins to do this... and the Desktop X plugin scripting language is just insane, and I am not a programmer. So I am pretty much in a catch 22.
mageguru
Reply #13 Thursday, January 23, 2003 4:47 PM
Reply #13 Thursday, January 23, 2003 4:47 PM
Ok, I did a bit of research on schoolbus....
From Norton...
Backdoor.SchoolBus.A
Detected as: Backdoor.SchoolBus.A
Aliases: None
Characteristics: Wild
No additional information.
This threat is detected by the latest Virus Definitions.
So Norton would indeed detect this!
Some more info...
Name: School Bus
Aliases: Backdoor.SchoolBus.A,
Ports: 54321 (port can not be changed)
Files: Schoolbus.zip - 440,982 bytes Schoolbus160.zip - 519,976 bytes Schoolbus2.zip - 715,835 bytes Server.zip - 209,778 bytes Client.exe - 452,096 bytes Client.exe - 609,792 bytes Client.exe - 785,504 bytes Setup.exe - 407,040 bytes Setup.exe - 414,720 bytes Server.exe - 328,110 bytes Grcfram.exe -
Created: April 1999
Requires: N/A
Actions: Remote Access
Versions: 0.9, 0.96, 1.50, 1.60, 2.0,
Registers: HLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Versions 1.50 and 1.60 does not register.
Notes: Works on Windows 95 and 98.
Country: N/A
Program: N/A
So Schoolbus is a Trojan not a Virus... so its not going to "infect" any files...
And as you can see it would need to be any of the files shown in the description.
So in the end, it's NOT my theme, that is the guilty party... and leaves us with 3 conclusions...
A) NetHaVoC has no idea what he is talking about.
NetHaVoC is an innocent bystandard of a really crappy anti-virus program.
C) This is a personal attack, ment to undermine my work.
From Norton...
Backdoor.SchoolBus.A
Detected as: Backdoor.SchoolBus.A
Aliases: None
Characteristics: Wild
No additional information.
This threat is detected by the latest Virus Definitions.
So Norton would indeed detect this!
Some more info...
Name: School Bus
Aliases: Backdoor.SchoolBus.A,
Ports: 54321 (port can not be changed)
Files: Schoolbus.zip - 440,982 bytes Schoolbus160.zip - 519,976 bytes Schoolbus2.zip - 715,835 bytes Server.zip - 209,778 bytes Client.exe - 452,096 bytes Client.exe - 609,792 bytes Client.exe - 785,504 bytes Setup.exe - 407,040 bytes Setup.exe - 414,720 bytes Server.exe - 328,110 bytes Grcfram.exe -
Created: April 1999
Requires: N/A
Actions: Remote Access
Versions: 0.9, 0.96, 1.50, 1.60, 2.0,
Registers: HLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Versions 1.50 and 1.60 does not register.
Notes: Works on Windows 95 and 98.
Country: N/A
Program: N/A
So Schoolbus is a Trojan not a Virus... so its not going to "infect" any files...
And as you can see it would need to be any of the files shown in the description.
So in the end, it's NOT my theme, that is the guilty party... and leaves us with 3 conclusions...
A) NetHaVoC has no idea what he is talking about.
NetHaVoC is an innocent bystandard of a really crappy anti-virus program.C) This is a personal attack, ment to undermine my work.
citats
Reply #14 Thursday, January 23, 2003 7:05 PM
Reply #14 Thursday, January 23, 2003 7:05 PM
on one hand this is the 2nd "vapourviri" one might start to think that Wincustomize does not keep their site clean and safe of malicious files. Certain Lowlifes are trying to give Wincusto a bad name. mageguru consider adding links in your description. Of where ppl can download the .exe's should save headaches all around.
IPlural
Reply #15 Thursday, January 23, 2003 7:29 PM
Reply #15 Thursday, January 23, 2003 7:29 PM
magaguru 
that was why I made the point about NIS Norton Internet Security... It would attempt to access any network your system happened to be connected to triggering specific ports : HTML=port 80 for instance, and if it rode on 80 you wouldn't know the difference. But with Firewall software installed that has to alow each application outside access, you are prompted to either let it always access the network, this one time, or block it always, ect...
School-Bus has been around for a bit...
Also, anyone who is not running a Firewall application and is connecting to internet needs to.... period...
Even dialup, but DSL / Cable without question...
Unless you have a Firebox II or some other filtering hardware firewall. But even then it is best to have that second line of defense.
If someone gets into your system with a trojan and you are on a local network also, even a VPN, once they are in your system, they are seen as being you by the intra ( local ) network, which means they have any access rights that you have to start with. They also have a base of operation to hack deeper into the network...
anyway... just spinning my wheels here, didn't know if anyone would be interested in knowing this if they did not already...
that was why I made the point about NIS Norton Internet Security... It would attempt to access any network your system happened to be connected to triggering specific ports : HTML=port 80 for instance, and if it rode on 80 you wouldn't know the difference. But with Firewall software installed that has to alow each application outside access, you are prompted to either let it always access the network, this one time, or block it always, ect...School-Bus has been around for a bit...
Also, anyone who is not running a Firewall application and is connecting to internet needs to.... period...
Even dialup, but DSL / Cable without question...
Unless you have a Firebox II or some other filtering hardware firewall. But even then it is best to have that second line of defense.
If someone gets into your system with a trojan and you are on a local network also, even a VPN, once they are in your system, they are seen as being you by the intra ( local ) network, which means they have any access rights that you have to start with. They also have a base of operation to hack deeper into the network...
anyway... just spinning my wheels here, didn't know if anyone would be interested in knowing this if they did not already...
IPlural
Reply #16 Thursday, January 23, 2003 7:32 PM
Reply #16 Thursday, January 23, 2003 7:32 PM
oh and anything they do through your system will in fact be recorded as you doing it, say if the Dataset for you company Database gets trashed by them through a connection to the server that you have logged into, it will trace back to the person logged in because the server only see's that person and not the one running the backdoor.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Wednesday, January 22, 2003 10:47 AM
Norton didn't see any virus in the vlt_setup20.exe, but Norton has been known to be wrong from time to time. Besides, our policy is that no executables should be included with any skin or theme.