Friends,

Somehow, on my work laptop, an insidious piece of garbage has attached itself, and Ad-aware and Spybot can't seem to get rid of it (it helps only temporarily). The worst part is, it ONLY comes up when I try to access this site!

Allow me to explain...

About a week ago, when I was taking a mental break from work, I decided to check on LCT. Imagine my surprise when I got a message saying 'ACCESS DENIED' and the message was generated by a SURFCONTROL. Well I was a bit surprised, because there is such a thing as SURF CONTROL (no space) and it is used by companies to bar employees from visiting porn/gambling sites and may be used to big brother people's use of the internet on company time. The thing is, the company I work for does not use SURF CONTROL. Just to make sure, I called IT and they said, that's right, we don't use it, it is not a corporate mandated piece of software. Well, then, what is this SURFCONTROL popping up I asked. I was directed to run Ad Aware and Spybot. It helped for one session, but the next session I was in the same boat. IT is now stumped. It makes me a bit nervous as to what this piece of garbage is, because I am currently on an ecommerce project where I have to be surfing the client's websites (and they are a few of them) very heavily in order to work on my documentation. I made this point very clear to IT, because I wanted to be absolutely sure I was not going to be stopped by doing my work because "something" thought I was surfing around an ecommerce site.

It beats me (and IT) why this is showing up only while trying to access LCT and only on my laptop!!

Anybody have run into the same thing, or any other suggestions since it clearly is a pesky one?

Ana Luisa,

I read about this new bug today in the Tech Section of the paper. Can cause that you reformat the hard drive. It's more sophistcated than the average spyware can take care of. Check out Symantec.com and see what they have to say

I can't find anything about this bug anywhere on Symantec. Maybe somebody did sneak on SurfControl when you weren't paying attention??

Masaki

I looked at all my nerd sites and I checked the newsgroups, I found nothing about a SurfControl virus or spyware.
Did you try running msconfig to see if this program is in your start up?

I am assuming you already have a pop up stopper, like the Google pop up stopper, installed.

Again I assure everyone this site has no spyware, add-ware, pop-ups, Bots, or any other new technology. Ngaire never intended it that way. I did try to do a pop-up for cruise specials but she was against it.

I myself can't log on at work and I'm told that it is due to the address having "Cruise" in it. That particular word is blocked by my IT.

This site is written in PHP&Pearl utilizing CGI scrips. Some people are blocking scripts on their computer which is good sometimes but in this case hinders things. Judy still can't log on from her computer but I have no problem on mine using her name and pass.
SURFCONTROL
is a filtering program I assume you checked to see if it is installed on your laptop. Not buy Ad Aware but through the control panel.

This reminds me of a problem I ran into Asia. The cruise line issued me a laptop. On the last day this the screen would go white with a message that the ever friendly administrator had detected spyware. There was no way to get out of the message except to log off and the next screen asked for your credit card for downloading software to help you get out of the problem. Yeah right. That laptop had no firewall that I could see. Then I ran into the same problem in Singapore at the airport. I had to jump around from computer to computer.

This sounds a little like the same thing. Scary.

Well,

Here is an update to my saga. I am currently working out of my regular office and not at the client site and guess what...NO IMPEDIMENT TO LCT WHATSOEVER. I didn't even have to run any of my kill spyware programs

IT is still stumped tho, as am I. I suspect there may be some selective blocking from the client, based on how I am connecting via their system. The strange part is, sometimes when I run all my kill spyware programs, I can hit the site, but then when I try to link into a topic or use the back arrow in the general navigation bar, then I start getting the SURFCONTROL notices until finally I can't even access the site.

Thanks all for some good insights, and until then, I remain yours sincerely,

Ana Luisa, The Gatowoman

If you get something like this from me, delete it without opening it.

-----Original Message-----
From: RSchue [mailto:RSchue8444@aol.com]
Sent: Monday, July 19, 2004 11:39 AM
To: Bj
Subject: Re:


>foto3 and MP3

=================================================
Because, see below: Jeers! Ray

TrendLabs declared a Medium Risk Virus Alert on July 19, 2004 at 12:30PM GMT –07:00 Daylight Savings Time to control the spread of WORM_BAGLE.AH. TrendLabs has received several infection reports indicating that this worm is spreading in the United States.

This worm utilizes SMTP (Simple Mail Transfer Protocol) to propagate. The email it sends out has varying email subjects, message body details and attachment file names.

The email it sends out has the following details:

From: <spoofed>

Subject: Re:

Message body: (any of the following)
• Animals
• foto3
• fotogalary
• fotoinfo
• Lovely animals
• Predators
• Screen
• The snake

Attachment: (any of the following)
• Cat
• Cool_MP3
• Dog
• Doll
• Fish
• Garry
• MP3
• Music_MP3
• New_MP3_Player

The attachment can have any of the following extension names:
• .com
• .cpl
• .exe
• .scr
• .zip

This worm also drops a copy of itself in folders with the text string, "shar", in its folder name. It uses a list of attractive file names for its dropped copies, leading other users to download a copy of this worm. It runs on Windows 95, 98, ME, NT, 2000, and XP.

TrendLabs will be releasing the following EPS deliverables:

TMCM Outbreak Prevention Policy 121
Official Pattern Release 943
Damage Cleanup Template 377

For more information on WORM_BAGLE.AH, you can visit our Web site at:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BAGLE.AH

You can modify subscription settings for Trend Micro newsletters at:
http://www.trendmicro.com/subscriptions/default.asp
----------------------------------------------o0o----
CRITICAL PRODUCT UPDATE!
New Pattern File Numbering Format upgrade for Trend Micro products is REQUIRED by July 2004. Click www.trendmicro.com/npf for details!
______________________________________________________________________
This message was sent by Trend Micro's Newsletters Editor using Responsys Interact (TM).

To unsubscribe from Trend Micro's Newsletters Editor:
http://trendnewsletter.rsc03.net/servlet/optout?mgLDWUUDUEklJoNLBXXXFHhsDJhtE0

To update your subscription preference, or to change your email address:

http://trendnewsletter.rsc03.net/se...sEklJoNLBXXXFHhsDJhtEhE3vyf_87.3de.26_7a


To view our permission marketing policy:
http://www.rsvp0.net

Trend Micro, Inc., 10101 N. De Anza Blvd., Suite 200, Cupertino, CA 95014

1 other thing that has not been mentioned is to turn off your restore function prior to virus, ad, spyware scanning. If these things are imbedded in your restore files they will just keep reappearing. This of course only applies to Windows Me-XP machines. Service Pack 2 will be out shortly and it has its own built-in pop-up blocker and a lot of security enhancements that seems to thwart a lot of these malware from getting on your system.

Some of the machines I have fixed have only been fixed when the restore is turned off so please if you are having a problem that keeps coming back, consider doing this.

jeff

Thanks!!