Well its that time to ask (politely) for help again.

I've gotten tired of P2P sharing, too many wankers and too much pure crap.

I'm looking into IRC and Usenet, partly for a better net experience but also because I hear you can download good anime videos from there.

I have used IRC before, for chatting, I have cable, but any transfer I tried was really slow, how would you geta fast enough transfer to get a 50 meg file off of IRC?

Somewhat the same thing for usenet, but more fun. I really know very little about usenet, and I need to know basic things that most FAQs assume I know. I have downloaded the Binary News Reader (http://www.binnetwork.net/~bnr/bnr.html) and I know it can do what I need. I need to know what my news server is (I use ATT @home, does that make it attbi.com?) and how to connect to it. Really any info on usenet, how it runs, and how to use a usenet binary file downloader would be helpful.

Unless, of course, you don't feel like helping at the moment.

/me runs of to DL the mIRC client AGAIN....

[This message has been edited by Dr Spock (edited 08-09-2002).]

[This message has been edited by Dr Spock (edited 08-09-2002).]

Okay, so usenet lets people post small files in peices. So, they are encoded, and its becoming more common for them to be in yEnc. So, you download peices, according to the file names. Heres an example:

Cinema 3d XL incl. BodyPaint 3D v7.20 with good serials[13/13] - yEnc "Cinema4d XLplus.part18.rar" (1/1)

So, The post is Cinema 3D XL with Bodypaint 3d and serials. The second thing, which is [13/13] is the file number by the number of files he posted, so this would be the last file. Then it will say yEnc if it is yEnc encoded. Make sure your news client can decode yEnc encoding. Then the actual file name, and then the peice number over the total number of peices, being (1/1) because it is the last file in the set, so it is really small, meaning it didnt need to be broken into any peices. Now, depending on your client, hopefully for each file it will only display one post. In actuallity, there is a post for each part of the file. You just highlight all the posts with the thing you want in the title, and download it. The program should auto decode it and download it and all. It will usually be a bunch of rar files.

Now, for a couple more things before you start downloading. PAR files are parity files for incomplete posts, they are posted after the person posts all the posts, and some news servers didnt get all the files, so there are missing peices. There are tons of par tools out on the net, just look for them.

You can request files by making a post that say REQ: Whatever You Want. Newsgroup posters are great people, and will usually try to fill your requests. Be careful when you are downloading things though, because some posters request things in return for them posting something, so a post like this:

REQ : DriveImage 2002 ISO Full Version - Here is NeroMix 1.212- "NeroMIX.r04"yEnc (1/9)

Is actually NeroMix, the poster wants DriveImage 2002. People tend to fill the requests faster/more likely if you post something else.

Some things are posted over several days, and will be displayed like "day 1 of 3" or something similiar.

Okay, so those are the basics. Newsgroup downloads go fast as hell because your ISP is providing the news server to you. I downloaded GTA3 the day it was released, both CD's, in about 30 minutes.

If you have any questions, just post them in this thread.

And as for the news server, i believe it is netnews.attbi.com

I dont think they require you to log in either.

=]

The bottleneck isn't on your side, it's the side of the person giving out the videos. You could have 12 bundled T3's but if the person on the other end is running off of a 56K line, then you aren't gonna get a terribly fast download...

Well, I'm officially a Usenet newbie, thx.

8)

At any rate, two last questions. What is a .CSV file and what does it do? Apparently it can be used as a log file?

second, I see may files listed as 16/16 or 32/32 but few or none in between. Would this be a bug or is the last file being posted 10 times in a row?

[This message has been edited by Dr Spock (edited 08-11-2002).]

Comma Seperated Values.

Well, I was stupid....

I let an application execute and now I have a file called iusmpij.exe (probably randomized) which attaemps to run on startup. It tried to access the net, which was blocked by my firewall, but I am unsure how its running at startup if it isnt to be found in the msconfig program. I could simply delete it, but i'm worried it would be recompiled and then I might not know what it was called.

Housecall (www.housecall.antivirus.com) tells me I have no viruses, so either its new or just some porn program.

To add to that it causes a runtime error whenever it tried to run, so I know its trying to at startup.

Anyone know how it would run without registering with add/remove programs and msconfig? Is there a registry key I need to root out?

Keep reading theres more. This file is associated with C:/windows/litmus/hi.exe which I disabled from the msconfig start menu last night.

Any suggestions or just delete the two files and be done with it?

Well I moved all three files to the recycle bin from which thet shoulndt be able to excecute, and lo and behold, all three were recompiled. The random name was re-randomized, and its all back where it was.

To summarize, I have 3 suspicious files
1)MovieTemp.exe (in C:/)
2)Hi.exe (In c:/windows/litmus/)
3)*random name*.exe (in c:/windows/system)

All three can be recomplied upon startup and all three register nothing apparent on google. You're welcome to try searching again if you like.

[This message has been edited by Dr Spock (edited 08-11-2002).]

Anyone? A few more tests today. It doesnt spread by network shares, becuase it isnt on my server yet, but I dont have netBIOS or a shared C drive. However it doesnt seem to be volatile like that. Im sure it's adware of some kind.

Note: Ad-Aware latest version: (5.83) doesnt detect this. Nothing on google...

Got it. Theres a mysterious explorer.exe file on the C root directory and it has no microsoft version listed under properties, wheras the real one in windows/sytem has an extra "version" tab in its properties.

Ok thx to syphon I have the registry key and the main file, I think.

I'm not gonna reboot till I know what to do with these damned exe's tho. One of them (hi.exe) showes in the msconfig dialog, and may well regenerate the whole thing if I leave it. And I still cant delete them anyway yet...

So I still have

MovieTemp.exe in c:\
1MovieTemp.exe in c:\
Hi.exe in c:\windows\system\litmus\
Explorer.exe in c:\

It seems the trademark of this thing is the windows AVI icon, which it uses for all of its exe files.

[This message has been edited by Dr Spock (edited 08-12-2002).]

Crashed, rebooted, files recompiled, registry key back.

So the main exe and the registry key arent enough. Ill have got boot to safe mode and kill the exe's too.

The Trojan's dead. Working on reporting it now.

congrats for your finished lesson.