VIRUS Objectbar theme!

Thanks, the file has been removed.

Norton didn't see any virus in the vlt_setup20.exe, but Norton has been known to be wrong from time to time. Besides, our policy is that no executables should be included with any skin or theme.

Well, great. I downloaded this last Thursday when a guy on the board was asking for help on it. I couldn't figure out the solution to his problem, and I deleted the skin. Today I ran a virus checker and didn't find anything. I deleted all unrecognized cookies, ran regclean and am hoping there's no virus on my computer. I am also behind a firewall at work, maybe that will help. I don't think I will ever use the "doubleclick" to install again. I usually look at every zip before extracting, but it never occured to me that I could get a virus here.

NetHaVoK....what AV proggy were you using?
Norton 2003 says it's clean.
InDefense says it's clean.
Trend Micro [online checker] says it's clean....

Personally I am offended...

I know there are some out there that want to make be look bad... that would love to kill any work I do.

I am not so lowly end user... I happen to work in IT, and I know my boxes are vril clean...
Hell the box that I used to make this theme was a fresh install. And the File in question I got directly from Emaculation.com and was d/l'd to this box. I also don't even check mail on this box.

Anyway... I and others have checked and there was no virus...
I also would like to know what AV program NetHaVoK used... If its that good i'll switch to it.

And how come when I am logged wincustomise and go to My Skins it says Alexandrie's Library, who is
Alexandrie?

BTW wasn't my file even verified by wincustomize upon upload, or before being removed... to validate
the legitimacy of the accusation?

Also where does it state that you cannot include executables? I read the guidelines page I don't see anything there about it. see: http://skins.wincustomize.com/tools/guidelines.asp
and http://skins.wincustomize.com/tools/about.asp#rule
(which doesn't seem to work, so I have no idea what it says.)

Looks like some sort of unwritten rule to me. If I am wrong hey, point me to the right place. And if exe's are not allowed, how did it pass your submission processes, and allowed to be posted???

I would like to know which program he is using also. I didn't DL your skin.. Mainly because I don't like anything that deals with Mac.. I had bad things with them when I repaired them.

But that was mean what happened. It's been happening lately. People blaming the site and people of the site for something they probably did. By what I've seen and heared here, this is one of the most tight sites I've been on. The security, the checking before uploads, etc.

O', I have a idea for a next ObjectDock though since it's part of the title. Or I might do a Objectbar.. My first attempt at that.. Woohoo.. . A Virus Bar. Ever watch the Movie?

I installed and loaded it, it never once attempted to access any ports, period. If it had my firewall would have let me know and shut it down automatically then appended it to the log file and also slide the side bar out notifying me again that there was program/file named " fill in blank " that attempted to access the network. All of which has not happened.

anyway....

oh and NAV, McAfee, FProt and Inoculate respectively, do not find one thing wrong with it either....

by the way, nice theme !!

Curious as to what the included exe is.............why was it in the skin file?

Guys, thanks for the info. Especially IPlural (I was worrying about "Phone Home") I ran McAfee virus checker, and it didn't find anything either. Guess I got alarmed for nothing, but viruses are scary! I have been computing for many years and have never gotten a virus, but I am usually careful.

Koasati: The executable seems to be a program to emulate the Mac vol control. It may have been better to have provided it as a link rather than the actual executable. If executables should nto be included in executable files it needs to be written somewhere clearly (ie on the upload page).

MageGuru,

I too use Norton and didnt find any virus in your file. But Norton has been known to be wrong. We'd better be safe than sorry.
But as I said, wether the file does or not contain a virus is not relevant at this point since, as a general rule, we don't accept executables in the files of our library. It is not written in the guidelines because when we, admins of Wincustomize, wrote the guidelines, we never thought about it, we never thought people would start uploading EXE's in their zips. But recently, some people have indeed started doing so, which forced us to take a decision. That is the reason we don't have a screensaver section, that is the reason we reject logons that include a logonui.exe in it, etc.

Is your executable so essential to your theme? Is it not possible to just remove the execuble from it?
Usually, people understand when we tell them that we can't take the chance of allowing executables. Because it is such a popular site, because litteraly millions of people download files from it, it has indeed become a target for viruses. You must understand that.

As to why Alexandrie's skins are showing up in your My Skins page instead of yours, that's a mystery. I'll alert T-Man or Alexandrie (yes, she is an admin/programmer for this site) on the question.

well "vlt_setup20.exe" is a volume controller that runs in the system tray that emulates the OS X volume control, it is not a requirement, but was included as a bonus.

There is actually another exe included also, "reschanger.exe" which is a requirement, cause the allows the the display icon on my OB to change display resolutions.

And in my next version there will be a 3rd exe included, so that the winamp icon I am adding can give commands to winamp via its menu (its a cmd line application).

Personally, sure I would like to actually use Desktop X plugins to do this, since OB supports them. But no one has written any plugins to do this... and the Desktop X plugin scripting language is just insane, and I am not a programmer. So I am pretty much in a catch 22.

Ok, I did a bit of research on schoolbus....

From Norton...
Backdoor.SchoolBus.A
Detected as: Backdoor.SchoolBus.A
Aliases: None
Characteristics: Wild

No additional information.

This threat is detected by the latest Virus Definitions.

So Norton would indeed detect this!

Some more info...

Name: School Bus
Aliases: Backdoor.SchoolBus.A,
Ports: 54321 (port can not be changed)
Files: Schoolbus.zip - 440,982 bytes Schoolbus160.zip - 519,976 bytes Schoolbus2.zip - 715,835 bytes Server.zip - 209,778 bytes Client.exe - 452,096 bytes Client.exe - 609,792 bytes Client.exe - 785,504 bytes Setup.exe - 407,040 bytes Setup.exe - 414,720 bytes Server.exe - 328,110 bytes Grcfram.exe -
Created: April 1999
Requires: N/A
Actions: Remote Access
Versions: 0.9, 0.96, 1.50, 1.60, 2.0,
Registers: HLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Versions 1.50 and 1.60 does not register.
Notes: Works on Windows 95 and 98.
Country: N/A
Program: N/A

So Schoolbus is a Trojan not a Virus... so its not going to "infect" any files...

And as you can see it would need to be any of the files shown in the description.

So in the end, it's NOT my theme, that is the guilty party... and leaves us with 3 conclusions...

A) NetHaVoC has no idea what he is talking about.
NetHaVoC is an innocent bystandard of a really crappy anti-virus program.
C) This is a personal attack, ment to undermine my work.

on one hand this is the 2nd "vapourviri" one might start to think that Wincustomize does not keep their site clean and safe of malicious files. Certain Lowlifes are trying to give Wincusto a bad name. mageguru consider adding links in your description. Of where ppl can download the .exe's should save headaches all around.

magaguru that was why I made the point about NIS Norton Internet Security... It would attempt to access any network your system happened to be connected to triggering specific ports : HTML=port 80 for instance, and if it rode on 80 you wouldn't know the difference. But with Firewall software installed that has to alow each application outside access, you are prompted to either let it always access the network, this one time, or block it always, ect...

School-Bus has been around for a bit...

Also, anyone who is not running a Firewall application and is connecting to internet needs to.... period...

Even dialup, but DSL / Cable without question...

Unless you have a Firebox II or some other filtering hardware firewall. But even then it is best to have that second line of defense.

If someone gets into your system with a trojan and you are on a local network also, even a VPN, once they are in your system, they are seen as being you by the intra ( local ) network, which means they have any access rights that you have to start with. They also have a base of operation to hack deeper into the network...

anyway... just spinning my wheels here, didn't know if anyone would be interested in knowing this if they did not already...

oh and anything they do through your system will in fact be recorded as you doing it, say if the Dataset for you company Database gets trashed by them through a connection to the server that you have logged into, it will trace back to the person logged in because the server only see's that person and not the one running the backdoor.