Attempted Intrusion "HTTP Macromedia Long Filename BO" from your

I have gotten something (Virus?) on my computer that is making Symantec
Norton Internet Security 2007 give me this "Attempted Intrusion "HTTP
Macromedia Long Filename BO" from your machine against www.msnusers.com was
detected and blocked. Intruder: JMACK*****(****)." several times an
hour(about every five minutes). JMACK***** is my desktop that I use.
I have ran Full Scans in normal and safe mode and it picks up nothing.
I also use Webroot Spy Sweeper (which is how I think I might have let this
program in because I OK’d a IE Browser Helper to be installed). I went back
to Webroot Spy Sweeper and it showed one helper that I was not sure of so I
unchecked it (no change to my problem so whatever is there is still there).
I have installed AVG 7.5 (7.5.446 and 268.18.24/741) and AVG Anti-Root Kit
(1.1.0.42) (Free versions) and ran scans (with Norton Internet Security 2007
off) and did not pick up anything.
How do I find this and how do I get rid of it?
Can I use Windows restore and go back to a restore point prior to the
problem and will that get rid of it?
Thank you
John


--
John McK

From: "John McK" <JohnMcK@discussions.microsoft.com>

| I have gotten something (Virus?) on my computer that is making Symantec
| Norton Internet Security 2007 give me this "Attempted Intrusion "HTTP
| Macromedia Long Filename BO" from your machine against www.msnusers.com was
| detected and blocked. Intruder: JMACK*****(****)." several times an
| hour(about every five minutes). JMACK***** is my desktop that I use.
| I have ran Full Scans in normal and safe mode and it picks up nothing.
| I also use Webroot Spy Sweeper (which is how I think I might have let this
| program in because I OK’d a IE Browser Helper to be installed). I went back
| to Webroot Spy Sweeper and it showed one helper that I was not sure of so I
| unchecked it (no change to my problem so whatever is there is still there).
| I have installed AVG 7.5 (7.5.446 and 268.18.24/741) and AVG Anti-Root Kit
| (1.1.0.42) (Free versions) and ran scans (with Norton Internet Security 2007
| off) and did not pick up anything.
| How do I find this and how do I get rid of it?
| Can I use Windows restore and go back to a restore point prior to the
| problem and will that get rid of it?
| Thank you
| John
|

A restoration of a previous Restore Point is the WRONG approach for an Internet exploit that
has not been accomplished.

http://www.symantec.com/avcenter/att...gs/s20582.html

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Lindy25]

I have been having the exact same problem for a couple days, did you figure out how to fix it John? I have already been to the link provided in the reply and I do not understand what the link is for, can anyone help please?
Thankyou

From: "Lindy25" <Lindy25.2ohdjg@DoNotSpam.com>

| I have been having the exact same problem for a couple days, did you
| figure out how to fix it John? I have already been to the link provided
| in the reply and I do not understand what the link is for, can anyone
| help please?
| Thankyou--

Are you using Macromedia ColdFusion ?

If no, the exploit can not be accomplished.

If yes, you should update the software.

In any case, it looks like a FireWall report and the Norton/Symantec FireWall did its job in
blocking this possible exploit.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Lindy25]

Thank you so much for replying =) I don't think i use Coldfusion (i'm not sure what it is.. is it possible it is something on my computer?) I usually wouldn't look twice at an alert that says something was blocked if nothing was happening, however what concerns me is that the alert is coming up every couple minutes and after it comes up the sound on my computer stops working and videos do not work. When I restart the computer the sound and video works again until the alerts start again. Norton says this:
Intrusion: HTTP Macromedia Long Filename BO
Intruder: localhost (2442)
an intruder with the IP address 127.0.0.1 sent information characteristic of the HTTP Macromedia Long Filename BO attack

doesn't 127.0.0.1 mean my own computer? could it be reading something my computer is doing as an attack? The alerts don't seem to correspond with anything I am doing, they occur every couple minutes.
I did a system restore before I saw this post, which obviously did not do anything lol. I also did a live update and virus scan.

thank you so much for your time! I'm sorry If I seem real dense, I hope I am not wasting your time, I have been trying to fix this for a couple days with no luck, then again I don't know too much about this subject.
Thank you Dave!
Lindy

From: "Lindy25" <Lindy25.2ohu7e@DoNotSpam.com>

| Thank you so much for replying =) I don't think i use Coldfusion (i'm
| not sure what it is.. is it possible it is something on my computer?) I
| usually wouldn't look twice at an alert that says something was blocked
| if nothing was happening, however what concerns me is that the alert is
| coming up every couple minutes and after it comes up the sound on my
| computer stops working and videos do not work. When I restart the
| computer the sound and video works again until the alerts start again.
| Norton says this:
| Intrusion: HTTP Macromedia Long Filename BO
| Intruder: localhost (2442)
| an intruder with the IP address 127.0.0.1 sent informationcharacteristic of the HTTP
| Macromedia Long Filename BO attack
|
| doesn't 127.0.0.1 mean my own computer? could it be reading somethingmy computer is doing
| as an attack? The alerts don't seem to correspondwith anything I am doing, they occur
| every couple minutes. I did a system restore before I saw this post, which obviously did
| notdo anything lol. I also did a live update and virus scan.
|
| thank you so much for your time! I'm sorry If I seem real dense, I hopeI am not wasting
| your time, I have been trying to fix this for a coupledays with no luck, then again I
| don't know too much about thissubject. Thank you Dave!
| Lindy--

If it was coming from your PC it wouldn't be an "intrusion" as it is already there. It
would have already intruded the system prior to the attempted exploit.

ccProxy or some othre part of Norton/Symantec or FireWall noted this and is being over
exhuberant.

ColdFusion is adobe/Macromedia software used to create complex web pages. If you don't know
what it is, you don't have it, and there is NO worry.

You can however make sure all vulnerabilities are mitigated.

Use the Secunia Software Inspector to find and eliminate vulnerabilities.
http://secunia.com/software_inspector

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Brotherleelove]

I'm getting the same annoying popup! Mine is generated by my Norton AntiVirus 2007 software as well. It says: "A recent attempt to attack your computer was blocked." Damn! It just happened again! Has anyone come up with a fix? I called Macromedia and they confirm that if I don't have any coldfusion products (I don't) that their patches won't work. Symantec techies in India say they can fix it for $60! Anyone have any bright ideas? I should also mention one thing that might be important: I only get the Symantec popup message when I'm logged into MSN. If I'm just using Internet Explorer it doesn't pop up.

From: "Brotherleelove" <Brotherleelove.2ojgjg@DoNotSpam.com>

| I'm getting the same annoying popup! Mine is generated by my Norton
| AntiVirus 2007 software as well. It says: "A recent attempt to attack
| your computer was blocked." Damn! It just happened again! Has anyone
| come up with a fix? I called Macromedia and they confirm that if I
| don't have any coldfusion products (I don't) that their patches won't
| work. Symantec techies in India say they can fix it for $60! Anyone
| have any bright ideas? I should also mention one thing that might be
| important: I only get the Symantec popup message when I'm logged into
| MSN. If I'm just using Internet Explorer it doesn't pop up.
|


* There is NO fix for a FireWall doing its job! *

All you can do is make the software no create a Pop-Up so often.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Brotherleelove]

After many phone calls and internet chats with Symantec I think I've finally found the correct "fix" after several failed attempts.

Open your Norton AntiVirus Program.
Click on the 'Norton AntiVirus' tab.
Click 'Settings'
Click 'Internet Worm Protections'
Click 'Configure' [You'll go to a page titled "Virus and Spyware Protection Options"]
Click 'Configure' again.
Scroll down through all the "Signature Exclusions" until you see one beginning with 'HTTP Macromedia' even if the complete file name isn't the same as "HTTP Macromedia Long Filename BO".

Uncheck this file. This stopped the popup on my computer. If it doesn't work for you just go back and check it again to restore your settings. Look for any other Macromedia file names and try unchecking them instead. I got lucky on the first try, I hope you do too.

Regards-Lee Marks