http://forum.lowyat.net/ Tue, 21 Jul 2026 01:13:08 +0800 FeedCreator 1.7.2 http://forum.lowyat.net/topic/538990 This time infected by TR/Agent.baf.1 <!--emo&:furious:--><img src='http://static.lowyat.net/style_emoticons/default/vmad.gif' border='0' style='vertical-align:middle' alt='vmad.gif' /><!--endemo--> <br /><br />Came back home, fire up IE. Can&#39;t connect to any sites.... so reset Sygate Personal Firewall&#39;s access for IE. Fire up IE again, and pop came a message that IE want to connect to...<br /><br /><!--c1--><div class='codetop'>CODE</div><div class='codemain'><!--ec1-->www.joy4host.com<!--c2--></div><!--ec2--><br />.... <!--emo&:hmm:--><img src='http://static.lowyat.net/style_emoticons/default/hmm.gif' border='0' style='vertical-align:middle' alt='hmm.gif' /><!--endemo--> <br /><br />Google the bloody address and voila, malware&#39;s home address.....<br /><br />Following the malware&#39;s technical data from <a href='http://www.avira.com/en/threats/section/fulldetails/id_vir/2709/tr_agent.baf.1.html' target='_blank'>http://www.avira.com/en/threats/section/fu...gent.baf.1.html</a><br />I managed to find and terminate the virus, and restored the registry manually... and not forgetting to clear the temp folder. Haih...<br /><br />And I have Spybot&#39;s TeaTimer that monitors modifications to the registry, and it didn&#39;t managed to catch this one.<br /><br />McAfee VirusScan Enterprise also didn&#39;t detect this as malware... time to look for other and better antivirus software...<br /><br />Protection software:<br />McAfee VirusScan Enterprise<br />Sygate Personal Firewall<br />Ad-Aware<br />Spybot - S&amp;D<br /><br />I have no absolute idea where this come from, maybe from pop-up advertisements, i don&#39;t know for sure.<br />One more experience gained and more thoughts to beef up the security, again.<br /><br />Safe surfing. XJC Security &amp; Privacy Fri, 19 Oct 2007 21:51:31 +0800 http://forum.lowyat.net/topic/508823 XJC Technical Support Wed, 22 Aug 2007 18:25:58 +0800