Computing.Net > Forums > Security and Virus > trojan horse

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

trojan horse

Reply to Message Icon

Name: JoAnn Dyer
Date: September 5, 2003 at 19:47:18 Pacific
OS: dsl
CPU/Ram: ?
Comment:

verifierbug.class what is it. I have it quarantined is it dangerous?



Sponsored Link
Ads by Google

Response Number 1
Name: jpers
Date: September 5, 2003 at 20:10:51 Pacific
Reply:

Not sure. It's a Java Virual Machine class which are mostly used to quietly extract user info. Might be part of Kazaa - is or was Kazaa ever run on this machine? Could be spyware other than kazaa but my quick search showed mostly Kazaa as the perp for this one.

Install/run Ad-Aware 6, build 181 + updates + set to deep-everything and se what it finds.

- Jonathan


0

Response Number 2
Name: Stephen Blay
Date: September 5, 2003 at 20:44:30 Pacific
Reply:

My Norton AV with current defns (9/4/03)picked it up on my machine this evening.
Kazaa never used on this machine to the best of my knowledge.
Quarantined and sent to Symantec, but reply of no real use!
filename: VerifierBug.class
machine: BUSINESS-XXUOSP
result: This file is infected with Trojan.ByteVerify
Funny thing, I did google searches and found AdAware was posting info about it, and that was a program I installed within the last week or two to catch spyware! Plus, I update theri definitions and run the scan a few times a week - hmmm!
Anyone know if this trojan could have been reporting back important info from me (I use a Dlink 4-port router on a cable modem)?
The file was found in (I beleive):
(why doesn't Norton AV retain "Original Location??
- something with i beleive local settings, cookies and IE5 in the path name. Anyone know how I can get Norton to tell me where it found it?
More of a concern, if defns and updates were all current, how did it get in?


0

Response Number 3
Name: Stephen Blay
Date: September 5, 2003 at 22:00:36 Pacific
Reply:

There's info coming up in german/french forums if you google search. Also in Lavasoft (AdAware)
From ? (German):
http://translate.google.com/translate?hl=en&sl=de&u=http://spotlight.de/zforen/sec/m/sec-1062704484-9189.html&prev=/search%3Fq%3Dverifierbug.class%26hl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8
From (CCM, French):
http://translate.google.com/translate?hl=en&sl=fr&u=http://www.commentcamarche.net/forum/affich-343334&prev=/search%3Fq%3Dverifierbug.class%26hl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8
* C:\Documents and Settings\[mon nom]\Local Settings\Temporary Internet Files\Content.IE5\UPT6JUTK\archive[1].jar Infection: Famous Exploit.Java.Bytverify.
Also, see the Java Sub forums:
http://forum.java.sun.com/thread.jsp?forum=17&thread=439931&tstart=0&trange=15
There's also another thread one step away at computing.net!
Somethings bubbling...!
Funny, Symantec names it specifically as Trojan.ByteVerify, but you can't find that name on their site (encyclopedia), or the definitions virus list.


0

Response Number 4
Name: voegelid
Date: September 6, 2003 at 11:49:35 Pacific
Reply:

I picked up verifierbug(1) while surfing the net. McAfee grabbed it and I quaranteed it. It can't be cleaned it says, but you can delete it (went to my temp file) and then has to be replaced with backup. I don't know how to replace the file that was infected. Any help is appreciated.


0

Response Number 5
Name: ellisgolf
Date: September 7, 2003 at 12:13:43 Pacific
Reply:

I also got it surfing the net....but my Norton 2003 with definitions updated to 9/4/2003 couldn't do anything about it. It only detected it, but didn't quarantine or anything else. What should I do? Are there any removal instructions yet?


0

Related Posts

See More



Response Number 6
Name: Togg
Date: September 7, 2003 at 14:34:17 Pacific
Reply:

This has come up at another forum and I found a very technical paper about it on Google (but no real answers as to how dangerous it is or how to get rid of it)

http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?s=3f770f3267c35a32c84fbfd647765eea;act=ST;f=6;t=5647


0

Response Number 7
Name: Errol
Date: September 7, 2003 at 17:06:46 Pacific
Reply:

PANDA is the only place with any real info on it but feel it is inactive.. I told them to search google and Yahoo.. People are talking about it...

I have written NAV.. I am very concerned that it has come down to my hard drives 3 times in 24 hours and norton can't catch it until a scan is done..Scarey


0

Response Number 8
Name: Errol
Date: September 7, 2003 at 17:07:40 Pacific
Reply:

http://www.pandasoftware.com/virus_info/encyclopedia/overview.aspx?idvirus=39922

Sorry here is that panda link


0

Response Number 9
Name: RANDALL
Date: September 8, 2003 at 17:49:06 Pacific
Reply:

I also have the verifier.class and yes NAV doesnt cut it. wHat I did find was moosoft.com trojan cleaner. and TDS-3 cleaners. Now Iv'e done the scans and Moosoft didnt detect the trojan...Strange. TDS-3 did and all the other joke viruses etc. I havent subscribed to TDS-3 as of yet as I always prefer to trial before purchasing anything! good luck but try moosofts 30 day trial and see what happens! cheers!


0

Response Number 10
Name: Russell Waller
Date: September 9, 2003 at 14:34:27 Pacific
Reply:

I picked up this Trojan while on the net over the weekend. Funny thing was I think it occured while I was away but still connected. My norton firewall detected two "high risk" attacks against my PC. I presumed that the firewall had done it's job. However Sunday mu IE6 was playing up everytime I tried to get into google or other home pages. They would load but shortly after they would close with a request to send a report to Microsoft via the net. When this happened i figured somthing was up and I updated my virus definitions with Norton. I then launched a complete scan of my system. No surprises when I discovered I was infected with not one but two Trojan horses. One was _BlackBox[1].clas and Verifierbug.clas. I did a search for the Blackbox on google but came up empty handed. My rearch on the Verifierbug ended me up here. Norton (as per others in this forum) could not delete or repair the file and thus they were quarantined. Norton found the Trojan in the following path:

C:\Documents and Settings\Useer\Local Settings\Temporary Internet Files\Content.IE5\GJNJM05L\counter[1].jar

The other Trojan I mentioned was also located in IE5

I have submitted this to Symnatec. It appears a previous person has sent the verifier with little help from them, so no doubt I can expect the same on the Blackbox Trojan. Sorry cant be much more help except that i can report my IE seems to be fine since the quarantine. I am just afraid to place this pc back on my local network at home for fear of it spreading to those machines!


0

Response Number 11
Name: Johnny999
Date: September 9, 2003 at 14:51:38 Pacific
Reply:

After the first complete scan of my harddisk since three weeks, Norton AV 2002 identified today the following 21 threats on my comp:

1. BB.class (1 x) => "Trojan Horse"

2. jarutil.zip (3 x) => "Backdoor.Trojan"

3. javautil.zip (3 x) => "Download.Trojan"

4. verifierbug.class (7 x) => "Trojan Horse or Hacktool"

5. verifierbug.class(...someletters&numbers) (7 x) => "Trojan Horse"

Norton AV only showed a path for the last 7 files.

Now, since apparently a number of people are getting these scanresults from Norton at the moment, two things might be the case:

1. These are real trojans/threats
2. Norton added new virus definitions, which lead to false positive (i.e. infected) reports.

But how to decide what is true? I tried to find something on the net about these files, but came up with almost nothing. There was nothing on the Symantec website.

I will probably remove them anyway and reinstall java, then scan again.

Anybody else any bright ideas?

Thanx,
John


0

Response Number 12
Name: John999
Date: September 10, 2003 at 00:38:38 Pacific
Reply:

Hey, if you're intersted: take a look at this forum, there is more of an explanation about verifierbug.class, incl. an official response from Symantec:

http://www.dslreports.com/forum/remark,7864810~root=security,1~mode=flat.

greetings,
John


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: trojan horse

trojan horse optix www.computing.net/answers/security/trojan-horse-optix/583.html

NetBus Trojan Horse www.computing.net/answers/security/netbus-trojan-horse/13653.html

Trojan horse BHO.BHJ removal www.computing.net/answers/security/trojan-horse-bhobhj-removal/21691.html