Uechi-Ryu.com

Maybe even a little FYI!

While tooling around in Windows 2000 Internet files folders, and inspecting the contents if them, I came upon an application called "Direct_Connect.exe" and dated only several days earlier.

This application was most likely "picked-up" while surfing the internet. Right-clicking on the filename, I discovered that whatever this exe is, it had given itself complete administrative priveledges to my machine.

No matter what I tried to do to delete it, it wouldn't go away.

...Until I dropped-down into a dos box and did the delete thing on it.

Don't know what it is, what it does, nor where it came from, but an unknown application like that raises suspicion.



------------------
Allen, Home: http://www.ury2k.com/ mirror: http://home.ici.net/~uechi/

Were you able to view the file's contents?

I did a search, but didn't find it in my system. Perhaps the file is used by Microsoft to automatically update their Win2000 program.

------------------
GEM

It is not deposited by the operating system plus was discovered in a private area I designated as the ONLY place that URLS and their graphics may lite when I visit them.

I watch this area very closely for rogue things, and I think I found one.

NO application should ever contain information which controls access and permissions unless it was written specifically for that purpose, George.

Being where it was, it had to come in with the laundry, not unlike the wooden horse which entered Troy to begin its destruction.

These days, it pays to be careful, because it is well-known that there are now applications which can take charge of your computer and monitor your every move.

------------------
Allen, Home: http://www.ury2k.com/ mirror: http://home.ici.net/~uechi/

Can anyone give us tips on how to detect such 'trojan horses'?

A file name or extension in a directory where it doesn't belong? Are there programs that can help prevent this?

Did the file come in with a program you installed or in an e-mail?

------------------
GEM

It deposied itself while visiting a URL.

------------------
Allen, Home: http://www.ury2k.com/ mirror: http://home.ici.net/~uechi/