A number of listnook users have reported finding the cycbot.b virus on their Windows systems.

Some security tips to prevent getting infected in the first place: [Turning on DEP](http://windows.microsoft.com/en-US/windows7/Change-Data-Execution-Prevention-settings) pre-emptively mitigates a large majority of these exploits. Go ahead and do it now, since it's off by default in the name of compatibility (you can whitelist any old games or programs that you need to). Contrary to some beliefs, this won't slow down your PC. The root cause of the majority of drive-by exploits is insecure software on your PC which should be patched. Make sure anything that interacts with your browser - Flash, Java, PDF Readers, Shockwave, etc are all up to date. Adobe products in particular have a terrible security history and don't always auto update very well. You can use [Secunia PSI](http://secunia.com/vulnerability_scanning/personal/) to scan your hard drives for vulnerable software and get links to fixed versions or use Mozilla's [plugin checker](http://www.mozilla.com/en-US/plugincheck/) to scan common browser plugins. Uninstall old versions of Java, unless you're running terribly written java code, you only need the latest version on your PC. This prevents malicious code requesting to use an old, vulnerable Java install. Open up your browsers plugins and extensions menu. Disable all that c*** that you've rarely / never used or have no idea how it got there. Most plugins have poor auto updating and poor security. Do you really need to read PDFs inside your browser window, or is clicking "Open" after downloading an option?

From: [Microsoft's Malware Protection Center](http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor:Win32/Cycbot.B&ThreatID=-2147328481) *Backdoor:Win32/Cycbot.B is a backdoor trojan that allows attackers unauthorized access and control of an affected computer. After a computer is infected, the trojan connects to a specific IRC server and joins a specific channel to receive commands from attackers. Commands can instruct the trojan to spread to other computers by scanning for network shares with weak passwords, exploiting Windows vulnerabilities, or possibly spreading through backdoor ports opened by other families of malicious software. The trojan may also allow attackers to perform other backdoor functions, such as launching denial of service (DoS) attacks and retrieving system information from infected computers.* *The following system changes may indicate the presence of this malware:* **The presence of the following files:** * c:\documents and settings\administrator\application data\microsoft\stor.cfg * c:\documents and settings\administrator\application data\microsoft\svchost.exe * c:\documents and settings\administrator\application data\microsoft\windows\shell.exe * c:\documents and settings\administrator\local settings\temp\dwm.exe **The presence of the following registry modifications:** * Adds: "svchost" value to -> "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" with -> "c:\documents and settings\administrator\application data\microsoft\svchost.exe" So, your best bet is to check your directories for the objects listed. Next step, open up your task manager, CTRL+ALT+DEL, and locate the **svchost.exe** file that has been run under your username, rather than System. Just open up the task manager and click the 'User Name' tab to sort by username. Look for whatever username you are logged into, probably Owner or something along those lines, and shut down the svchost.exe program. Next, delete the file from the directory and remove the registry key. NOTE: You shouldn't be doing this if you're not very familiar with computers. If this doesn't solve it, try using a Malware scanner that is available on a boot CD, like [BitDefender](http://www.techmixer.com/bitdefender-rescue-cd-with-auto-update-virus-definition-features/) or [F-Secure](http://www.techmixer.com/free-f-secure-rescue-bootable-cd-to-clean-virus-and-malware/). Good luck!

I actually put up a [self-post](http://www.listnook.com/r/listnook.com/comments/e75ek/listnook_you_are_running_an_ad_that_is_driving_my/) about this earlier. In the ad space was nothing but the "listnook this ad" link. Whenever I would click over to another in-listnook page, and that non-ad would pop up, I would get a notification from my anti-virus saying it had blocked "HEUR:Trojan.Script.Iframer" Hope that helps.

Is that linked to the "additional plugins needed to display content on this page" notification Firefox gave me ~30 mins ago when visited the home page last? I just ignored it, 'cause all my listnook content seemed to be coming through fine, but it did seem suspect at the time.

[deleted]

[deleted]

According to the link in the title, the affected directory isn't for Windows 7, so, not even sure if it affects Windows 7. Probably doesn't affect Vista either. Would have eased a lot of people's tensions. Second, unless your using IE6, it's very unlikely a program "just installed" itself while you were casually browsing. Most likely, a popup or bar showed up asking you to install additional software. If you didn't, then no worries, if you did, then lesson learned. If you need software, find out what it is, flash, java, acrobat, or whatever, and go to the website to get the latest update. Better than that, set the software up to auto-update itself, then you know the popups are a scam. Third, if you are using Vista or 7, leave UAC on and a little box will pop up in the middle of your screen asking if you want to install software. There is no point in time you should need to install software when casually surfing the web, if you do need to install software, then see my second point above. And finally, quoted directly off the Microsoft webpage, > Limit user privileges on the computer. Don't surf the web with administrator privileges. In XP, if you need to install software, do it all at once while logged into an administrator account, then log back into your other account. In 7/Vista, the UAC thing will pop up asking you to put in your admin password before you install any software, which makes it very easy to install software under an administrative account while using your computer with limited privileges in day to day use. P.S. A hardware and software firewall are a good idea as well, Windows has a built in software firewall, so just get a basic router with a hardware firewall and you're set. Note that at no point did I suggest installing antivirus bloatware on your computer. If it worked, then nobody would have gotten a virus today. I haven't used it in 13 years and I didn't get a virus today. Just something to think about.

Don't know if this will help, but I opened [this sidebar game](http://www.listnookmedia.com/ads/listnook-fun-8) earlier and instead of loading the game it loaded an ad with a java applet under it, and that's when my AV caught the virus (Win32:Cycbot-P, originated from the Java VM process).

Just got a warning from my anti-virus... on this very page. Scan type: Auto-Protect Scan Event: Risk Found! Security risk detected: Backdoor.Cycbot!gen2 File: C:\Documents and Settings\********\Local Settings\Temp\dwm.exe Location: C:\Documents and Settings\********\Local Settings\Temp Computer: PROGRAMASSIST User: SYSTEM Action taken: Pending Side Effects Analysis : Access denied Date found: Wednesday, November 17, 2010 12:27:52 PM [...and this was the ad.](http://imgur.com/O5VyF.jpg)--Fuckin' General Mills coupon.

I'm not having an̸̺̭̲̙̗̺͙̂͟͠y̵̗̦̱̰͕̮̍̎ͪ͘͝ ̡̍̊҉̦̟͖̘͔̪̙p͇̙ͧ̚roͤbl̮̫̥̅̈́̎̎̐ͩ́̍e̜̖̞̳ͮ̿͡m͔̼̯̺͔̼̥ͮ̑͋̽̔͂̽͑͟s̢̛͔͈̲͖̱͕ͪ͋ ̡̺̟͓ͭ̈͒̀ͨ́̄h͙̜̺̘̤͓͔ͩͩ̄̐̽ͅe̴̼̜̭̘̫̼̣͍ͮͧͯř̰̥̼͚͙͐̀ͤ̈́̾̌ͮͯẻ̢̦̤̺̤͔ͥͥͨ̚͜ͅ.̖̙͈̭͊̍̾͒̉̒̍͗ͫ

[deleted]

> TrollBot v3.4 > keywords detected: virus, windows > searching troll database > initiating response > > ''use a mac they dont get viruses lol'' > > deploying flame shields > Done

Quick Suggestions: Everyday Antivirus: * [Microsoft Security Essentials](http://www.microsoft.com/security_essentials/) Supplementary Scans: [Dr. Web CureIt!](http://www.freedrweb.com/cureit/) Doesn't Require an install, and catches a lot of sneaky viruses missed by other reputable vendors. [SuperAntiSpyware](http://www.superantispyware.com) Similar to above, in that is has caught a lot of things others have missed, but does require an install.

I definitely got a virus today... The first one I can ever remember. Some of the symptoms: * Digsby and dropbox stopped working (because I think a malicious proxy server was installed) * Some of the links I click redirect me to spammy sites like Tazinga.com * Things seem to be running slow Anyone else have these symptoms? Anyone have good instructions on removal? Unfortunately, I'm running Windows Server so Microsoft Security Essentials doesn't work for me.

[deleted]

A [free online virus scan for Windows](http://onecare.live.com/site/en-us/default.htm) for those searching

I removed this from a coworkers pc a couple weeks ago. Windows Security Essentials detected it but could not remove it successfully for some reason (kept coming back and getting detected again). Had to do it manually, which was surprisingly easy. If you do get it and remove it make sure to check your internet proxy settings. The virus changed the system proxy settings and Firefox's proxy settings to use a proxy on localhost. If you end up removing the virus this may not be reset correctly and you'll be left wondering why your browser doesn't work.

I love Microsoft Security Essentials. I give MS a lot of shit, but that is one awesome product they put out. My virus update went through at 3:30am just like it does every day and I'm already covered. Thanks, MS!

**DON'T PANIC EVERYONE I GOT THIS** Hold on I'm going to make a GUI in VB.NET to track the offender's IP address brb

Thanks for the proactive response.

Is this where I'm supposed to start a Linux flamewar?

I've had good luck with [Avira AntiVir](http://www.free-av.com/). It's free (with nag screen). I used to use AVG, Avira seems to use fewer resources and supposedly has a higher detection rate

You guys suck and I'm installing adblock forever!

I noticed Firefox complained about a missing plugin on the listnook frontpage about 4 hours earlier. When I clicked "Install missing plugin" there was nothing suggested. I heard my hard drive churn a bit while opening listnook frontpage and noticed Java was now running when it hadn't been before.

http://www.malwarebytes.org/ Pretty much effective against everything

[Microsoft Security Essentials](http://www.microsoft.com/security_essentials/) is a great, free AV for Windows machines.

I work in IT for the state department, and this hit us before. We discovered it's related to Java, and if AV doesn't catch it, I found out that if you boot your machine into safe mode, browse to your documents and settings folder, look under hidden folder, local settings, application data, and then just search for any folders that have a combination of numbers and letters and delete that and then empty recycle bin. So far with this method we haven't had any reoccurnces. Hope that helps for anyone with it.

Have you tried turning it off and on again?

I got infected with this yesterday. Win XP (SP3) here's how I cleaned it off my machine: Reboot into Safe Mode with Command Prompt navigate to c:\documents and settings\username\application data\Microsoft -Delete stor.cfg -Delete svhost.exe Navigate to c:\documents and settings\username\application data\Microsoft\Windows -Delete shell.exe Navigate to c:\documents and settings\username\local settings\temp -Delete dwm.exe Open Regedit Navigate to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Delete the RUN key that points to: "c:\documents and settings\username\application data\microsoft\svchost.exe" I also searched the entire registry for any entries for "dwm.exe". Found 2 and removed both entries. Reboot. OPen your browser. Go into Tools ->Options -> Proxy Settings and uncheck "Use proxy...." Hope this helps.

* Mac users being smug: 3 * Windows users pre-complaining about Mac users being smug: 5 * Idiots: 8

[avast!](http://www.avast.com/index) has always treated me well. **Pros:** * Eyes don't bleed. * Quiet/Unintrusive * High Quality software all around.

What's the name of the advertisement vendor who did this to us? Is it Doubleclick? Also, 17 days ago I submitted, [TIL that perfectly legitimate and reputable websites can inadvertently give you malware through their banner ads, even if you don't click on or interact with the ads.](http://www.listnook.com/r/todayilearned/comments/dz0k2/til_that_perfectly_legitimate_and_reputable/)

[removed]

So wait don't you actually need Java installed to get the exploit? I'm slightly confused. (I would love some explantion and info on it) I was surfing Listnook all day yesterday @ home on my Windows machine and everything seems to be fine. Like many I pride myself on not being infected by any malicious software....in years. I always felt bad for using AdBlockPlus on listnook but maybe it was my saving grace? I haven't seen any of the symptoms people are describing my internet was working fine as of this morning. I'm currently at work right now but when I get home I think I'm actually going to install MSE and do a full scan to make sure :/

[deleted]

Hide yo Windows, hide yo files

Dammit guys, you ruined my squeaky-clean record :( http://imgur.com/6kjGh.png (time is EST)

Amazing seeing this here. And here I was about to yell at my son for playing on game sites with this computer. cycbot.b may be the initial payload, but I was hit with three others. The b**** set proxys on ie and chrome so when I killed the process handling the proxy calls I had to figure out why those were not working. The proxy seemed to redirect soap logins for turbine as well, so if you have a turbine account and tried logging in you may want to change your password. They also loaded up two modem apps that will not detect as viruses.

Found 3 possible viruses (25899 files scanned). /home/primary/.cache/google-chrome/Cache/f_0000ed PUA.Script.Packed-2 /home/primary/.icedteaplugin/cache/http/tannity.com/fagopl/d066d3a4bde/aaea265a905.jar.gz Trojan.Downloader.Java-18 /home/primary/.icedteaplugin/cache/http/tannity.com/fagopl/d066d3a4bde/aaea265a905.jar Trojan.Downloader.Java-18 So, looks like it managed to download itself even on Ubuntu 9.10 machine, see no evidence of running however. Eh, back to browsing dodgy sites.

SHUT DOWN EVERYTHING!

We've got some bad acid going around. Everybody sit tight, and if you see someone tripping badly, bring them to the hospital tent.

SOAFB, I got it around 3;30pm est, after I made an Ask listnook!! Malwarebytes tracked down three instances of it and removed, seemed to just shut down my internet connection. Listnook you dirty little w****, where were you?

Eset NOD32 blocked it for me. The virus made 4 attempts to infiltrate. Im not sure if this is the same one but here is part of the log file: 11/16/2010 4:53:14 PM HTTP filter file http ://casuism.com/fagopl/42ead8c863c/a65f0f28588.jar a variant of Java/Rowindal.C trojan connection terminated - quarantined \Threat was detected upon access to web by the application: C:\Program Files (x86)\Java\jre6\bin\java.exe.

I wanted to be a nice guy so I had disabled adblocker on listnook. Yeah... sorry but it's back on.

Wonder how long it will take till all the computers infected downvote this post.

An add (I think) said I was missing the java plugin. That's when I got the virus, because I fell for it thinking it was a Java Update. The virus was half caught by by MS security Essentials but left traces that Malwarebytes cleaned up. Then I was still not able to get back online because the worm changed my Auto Detect internet settings to proxy.

Avast popped up a couple hours ago blocking something from the JVM when I clicked a listnook post. I noticed the JVM was in my notifications for some reason even though I had no other sites open. Thankfully, Avast kept blocking it every 5 seconds as it kept trying to hit me. I closed my browser (Chrome), and the JVM closed. Nothing since then. Oh, and those who are saying MSE - I have MSE open, too, and it sat there like a lame duck. But thats why I have Avast and MSE running - sometimes one catches stuff the other one misses. My system - Windows 7 64-bit and I was running Chrome 7.0.517.44. It was at 3:30PM (EST), and my definitions for Avast was last updated at around noon today. This is now the fifth time in the past 2 weeks that my JVM has been hit. I haven't had any sort of hits or attacks from websites that don't require me to manually run/install anything for years up until recently with the JVM. I seriously hope Java and the use of the JVM goes the way of ActiveX and the dodo. Its shit like this, Oracle!

OKAY I DID THE DELETE STAR DOT STAR THING WUT NOW?

I work in the IT industry and this virus is spreading like wild fire, it's very common.

I don't think it's Listnook related. My Dad, and a coworker, both who I know do not browse Listnook were both infected with the virus. I was able to successfully remove it using Combofix, which is a free download. available @ http://www.bleepingcomputer.com/download/anti-virus/combofix

My father signed up for Listnook today (I was delighted) and he called me saying he found a suspicious .EXE on his desktop after browsing around the site for a bit. Unfortunate that this should happen today. I told him to run Malwarebytes.

I just noticed my computer running pretty slow, as if something was sapping resources. I check my free space and watch it getting used up before my eyes. Obviously safe mode is in order. Turns out in the C:\windows\temp folder I am the brand new owner of a bunch of randomly named files all over 1.5GB. I haven't had any virus' in over 7 years. This just started today so I'm guessing that this isn't a coincidence. Since this was a trojan I jumped on my phone and changed any pw's I used today. Face-book just alerted me that someone else has tried to access my account... The few Google searches I've turned up for this have basically said to reformat which seems highly extreme. Anyone else having these issues or a sane way to go about tracking this down, I've run a spybot as well as drweb and neither have come up with any red flags?

I'm so glad I run linux on my computer.

Where do I go to virus scan my linux? Edit: Listnook's internet sarcasm detector seems to be broken...

Will a quick scan in MSE do the trick, or should I go for the full scan?

If you are going to run windows *(trying really hard to avoid a OS argument)* then you might want to look into a sandbox. I have a couple friends who use sandboxie but I have never tried it *(no need, lol)* Here is the link... http://www.sandboxie.com/

[deleted]