dcom
Microsoft DCOM 1.3
Distributed COM support for Microsoft Windows 98 more>> Provides Distributed COM support for Microsoft? Windows? 98. The DCOM wire protocol transparently provides support for reliable, secure, and efficient communication between Component Object Model (COM) components such as ActiveX? controls, scripts, and Java applets residing on different machines in a LAN, a WAN, or on the Internet. With DCOM, your application can be distributed across locations that make the most sense to you and to the application.<<less
DCOM for Windows 98 1.3
COM98 extends support for DCOM (Distributed Component Object Model) for Windows 98. With DCOM, your application can be distributed across locations that make the most sense to you and to the applicati more>>
ActiveX Data Objects (ADO) 1.5/2.0/2.1 SP2 and Visual Basic Sample: Using ADO with an MTS Component via DCOM (Adomts ) 1
ActiveX Data Objects (ADO) 1.5/2.0/2.1 SP2 and Visual Basic Sample: Using ADO with an MTS Component via DCOM (Adomts )is launched to bring users an effective sample which demonstrates how to use a lightweight Standard .exe client to connect to an MTS-hosted DLL more>> <<less
STUD 0.80
STUD is a impressive and unique software which was developed to keep track of the collectible Star Trek Universe cards distributed by Atlas Editions/Newfield Publications. more>>
STUD 0.80 is a impressive and unique software which was developed to keep track of the collectible Star Trek Universe cards distributed by Atlas Editions/Newfield Publications.
Enhancements: Version 0.80 may include unspecified updates, enhancements, or bug fixes.
Requirements: Windows 95/98/Me/NT/2000/XP, 4MB Free Disk Space, DCOM, MDAC2.6
W32.Welchia.Worm Removal Tool 1.06
W32.Welchia.Worm Removal Tool - FREE - more>>
- The DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. The worm specifically targets Windows XP machines using this exploit.
- The WebDav vulnerability (described in Microsoft Security Bulletin MS03-007) using TCP port 80. The worm specifically targets machines running Microsoft IIS 5.0 using this exploit. IIS 5.0 will most likely be found on Windows 2000 systems.
W32.Welchia.Worm does the following:
- Attempts to download the DCOM RPC patch from Microsofts Windows Update Web site, install it, and then reboot the computer.
- Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.
- Attempts to remove W32.Blaster.Worm.
The W32.Welchia.Worm Removal Tool does the following:
- Terminates the W32.Welchia.Worm viral processes.
- Deletes the W32.Welchia.Worm files.
- Deletes the registry values that W32.Welchia.Worm added.
- Deletes the services created by W32.Welchia.Worm.
Note: You must have administrative rights to run this tool on Windows NT 4.0, Windows 2000, or Windows XP.
If you are running Windows Me or XP, then disable System Restore. Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details.
Caution: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
- Double-click the FixWelch.exe file to start the removal tool.
- Click Start to begin the process, and then allow the tool to run.
- Restart the computer.
- Run the removal tool again to ensure that the system is clean.
- If you are running Windows Me/XP, then re-enable System Restore.
Note: The removal procedure may not be successful if Windows Me/XP System Restore is not disabled as previously directed, because Windows prevents System Restore from being modified by outside programs.
When the tool has finished running, you will see a message indicating whether W32.Welchia.Worm infected the computer.
Nachi.B Remover 3.5.1.11
A tool designed to clean the Nachi.B virus from your computer more>> A tool designed to clean the Nachi.B virus from your computer
Nachi.B is a worm that uninstalls the worms Mydoom.A and Mydoom.B, by ending their processes and deleting the files associated to them.
Nachi.B exploits the vulnerabilities RPC DCOM, WebDAV and Workstation Service.
Nachi.B spreads by attacking remote computers in which it attempts to exploit the vulnerabilities mentioned above in order to download and run a copy of itself to the compromised computer, using its own web server.
The Nachi.B Remover will allow you to easily get rid of the virus infection from your PC.
Gaobot.S Remover 3.5.1.10
Clean the Gaobot.S virus from your computer with this tool more>> Clean the Gaobot.S virus from your computer with this tool
Gaobot.S is a worm with backdoor characteristics that exploits the RPC DCOM and WebDAV vulnerabilities to spread to as many computers as possible.
Gaobot.S also spreads by attempting to copy itself to network shared resources. It gains access to these shared resources by using passwords that are typical or easy to guess.
Once it is run, Gaobot.S connects to a specified IRC server through the port 6667 and waits for control commands. As a backdoor, it allows to obtain information on the affected computer, run files, launch distributed denial of service (DDoS) attacks, upload files by FTP, etc.
Gaobot.S ends processes belonging to antivirus programs, firewalls and system monitoring tools. This leaves the affected computer vulnerable to the attack of other viruses or worms. It also ends the processes of Nachi.A, Autorooter.A, Sobig.F and several variants of Blaster.
The Gaobot.S Remover will enable you to easily get rid of the virus infection from your PC.
Diagnostic Tool for the Microsoft VM 1.0a
Scan one or more computers to detect the presence of MSJVM and MSJVM-related software more>> Scan one or more computers to detect the presence of MSJVM and MSJVM-related software
The Diagnostic Tool for the Microsoft VM was designed to scan one or more computers to detect the presence of MSJVM and MSJVM-related software.
In order to scan remote machines, you must be an administrator on the remote machines. URL scans will always be conducted from the local host. Internet Explorers connection settings are used. File scans will only include local drives. Removable disks, network drives, RAM disks and CD-ROM drives will not be scanned.
IMPORTANT: You must uninstall any previous version of the Diagnostic Tool before installing a newer version.
System requirements:
- 486DX2/66 (Pentium 75MHz recommended)
- 32 MB RAM
- 10 MB Free HD space for the tool + additional hard drive space for the scan results
- IE 5.01+
- WMI 1.5, DCOM, and File and Printer Sharing for Microsoft Networks must be installed and enabled to remotely scan machines
- ADSI 2.5 is required to select machines using the Computer Selection dialog in the wizard.
Enhancements:
- This version of the Diagnostic Tool for the Microsoft VM includes several targeted changes from the 1.0 version. These include:
- The XML data files produced by the tool are now saved to a data directory for further processing.
- Localized machine names, file names, and file content is now supported.
- Thread priority can be specified from the command line.
- Drives are now valid input for the directoryfile command line option.
PLCSIM OPC Server Free 1.2
PLCSIM OPC Server Free provides you with a brilliant self-containing OPC DA Server (supports OPC DA2, DA3 standards), written to easily connect SIEMENS S7-PLCSIM software PLC to any SCADA or HMI, acting as OPC client. more>>
PLCSIM OPC Server Free 1.2 provides you with a brilliant self-containing OPC DA Server (supports OPC DA2, DA3 standards), written to easily connect SIEMENS S7-PLCSIM software PLC to any SCADA or HMI, acting as OPC client. Supports multiple PLC instances with S7-PLCSIM V5.4. OPC server's namespace configuration in a single XML-file. Customizable OPC server update rate for best perfomance on different PCs.
Major Features:
- Out-of-process support - PLCSIM OPC Server is an executable, being able to launch on a remote machine via DCOM ethernet/internet communications
- Multiple PLC instances support with S7-PLCSIM V5.4 SP3
- Supported S7 standard datatypes: BOOL, BYTE, WORD, INT, DWORD, DINT, REAL,
- DATE_AND_TIME
- Supported S7 array datatypes: RAW (byte array)
- Supported PLC area: Flags (bit memory), Data Blocks, Outputs
- Unlimited number of PLC items
- Simple OPC server's namespace configuration in a single XML-file
- Customizable OPC server update rate for best perfomance on different PCs
- Successfully tested for Windows XP, Windows Vista
Enhancements:
- Core info mapped to OPC server namespace under "!ServerInfo" folder
W32/Gaobot.BKE Remover 3.5.1.11
This utility helps you get rid of the Gaobot virus more>> This utility helps you get rid of the Gaobot virus
Gaobot.BKE is a worm with backdoor characteristics that belongs to the Gaobot worm family.
This family has the following common characteristics:
- It attempts to exploit the LSASS, RPC DCOM and WebDAV vulnerabilities to spread to as many computers as possible. These vulnerabilities only affect the operating systems mentioned above.
- It spreads by attempting to copy itself to network shared resources it accesses.
- Once it is run, it connects to a specified IRC server and waits for control commands. As a backdoor, it allows to obtain information on the affected computer, run and download files, launch distributed denial of service (DDoS) attacks, upload files by FTP, etc.
In addition, certain variants of Gaobot:
- Take advantage of the backdoors opened by the worms Bagle.A and Mydoom.A, in order to spread to those computers affected by these worms.
- End processes belonging to antivirus programs, firewalls and system monitoring tools, among others. This leaves the affected computer vulnerable to the attack of other viruses or worms.
- End the processes belonging to Nachi.A, Autorooter.A, Sobig.F and several variants of Blaster.
With the W32/Gaobot.BKE Remover utility youll be able to easily clean the virus infection fom your computer.
W32.Blaster.Worm Removal Tool 1.0.6.1
Removal tool to clean the W32.Blaster.Worm infections (fix the RPC vulnerability) more>>
It will terminate the viral process, delete the worm files, dropped files, and delete the registry values that were added.
W32.Blaster.Worm is a worm that exploits the DCOM RPC vulnerability (described in Microsoft Security Bulletin MS03-026) using TCP port 135. This worm attempts to download and run the Msblast.exe file.
Block access to TCP port 4444 at the firewall level, and then block the following ports, if they do not use the applications listed:
TCP Port 135, "DCOM RPC"
UDP Port 69, "TFTP"
The worm also attempts to perform a Denial of Service (DoS) on Windows Update. This is an attempt to prevent you from applying a patch on your computer against the DCOM RPC vulnerability.
Enhancements:
- support for variants through F
j-Interop 1.14 Beta
Non JNI based access to COM , Pure, Bi-Directional, Non-Native Java applications which can interoperate with any COM Servers more>>
The implementation is itself purely in Java and does not use Java Native Interface (JNI) to provide COM access.
It comes with pre-implemented packages for automation. This includes support for IDispatch, ITypeInfo, and ITypeLib. For more flexibility (in the cases where automation is not supported), it provides an API set to directly invoke operations on a COM server.
Another important feature is that j-Interop allows full access and manipulation (C-R-U-D) of the Windows Registry in a platform independent manner.
The implementation has been tested on all advanced Windows and Fedora platform(s) and displays upward compatibility from JRE 1.3.1.
Resolve for Agobot 1.07
A tool that removes W32 Agobot more>> A tool that removes W32 Agobot
Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed.
Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.
W32/Agobot-BT is a network worm which also allows unauthorised remote access to the computer via IRC channels.
W32/Agobot-BT copies itself to network shares with weak passwords and attempts to spread to computers using the DCOM RPC and the RPC locator vulnerabilities.
These vulnerabilities allow the worm to execute its code on target computers with System level privileges. For further information on these vulnerabilities and for details on how to protect/patch the computer against such attacks please see Microsoft security bulletins MS03-001 and MS03-026. MS03-026 has been superseded by Microsoft security bulletin MS03-039.
W32/Agobot-BT copies itself to the Windows system folder as sysinfo.exe and creates the following registry entries to run itself on system restart:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Configuration Loader
HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices
Configuration Loader
Each time W32/Agobot-BT is run it attempts to connect to a remote IRC server and join a specific channel.
W32/Agobot-BT attempts to terminate various processes related to anti-virus and security software (e.g. SWEEP95.EXE, BLACKICE.EXE and ZONEALARM.EXE).
W32/Agobot-BT, W32/Agobot-HD, W32/Agobot-HH, W32/Agobot-HL, W32/Agobot-HS, W32/Agobot-IJ, W32/Agobot-IK, W32/Agobot-LG, W32/Agobot-LT, W32/Agobot-MR, W32/Agobot-MW, W32/Agobot-NA, W32/Agobot-NZ, W32/Agobot-OT, W32/Agobot-OU, W32/Agobot-QF, W32/Agobot-QO,
Windows disinfector
AGOBTGUI is a disinfector for standalone Windows computers. To use it you have to do the following:
- Open AGOBTGUI.com file from your desktop after downloading it.
- Click on the Start Scan Button.
- Wait for the process to complete.
Command line disinfector
AGOBTSFX.EXE is a self-extracting archive containing AGOBTCLI, a Resolve command line disinfector for use by system administrators on Windows networks.
After removing the worm you should check the virus analysis for details of any Microsoft security updates you should make, or, on single computers, update with all relevant security patches from Windows update.
For W32/Agobot-HH, W32/Agobot-LT, W32/Agobot-NZ, W32/Agobot-OT, W32/Agobot-OU and W32/Agobot-SX you should replace the HOSTS file from backup, or open it in Notepad and remove any of the entries listed in the virus description.
Paessler WMI Tester 1.1.02
Paessler WMI Tester is a tool for quickly and easily testing the accessibility of WMI counters. "Windows Management Instrumentation" is the latest technology from Microsoft for monitoring and managing more>>
Resolve for Delf-ALI 1.07
A tool that removes Delf-ALI trojan more>> A tool that removes Delf-ALI trojan
Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.
Troj/Delf-ALI is a worm and IRC backdoor Trojan for the Windows platform.
Troj/Delf-ALI spreads to other network computers by exploiting common buffer overflow vulnerabilities, including RPC-DCOM (MS04-012).
Troj/Delf-ALI runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer via IRC channels.
Troj/Delf-ALI includes functionality to access the internet and communicate with a remote server via HTTP.
When Troj/Delf-ALI is installed it creates the clean text file msguid32.dll.
The following registry entry is created to run Troj/Delf-ALI on startup:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun
Microsoft IIS
Troj/Delf-ALI attempts to log details from banking applications related to the following sites:
www.halifax-online.co.uk
ibank.barclays.co.uk
online.lloydstsb.co.uk
online-business.lloydstsb.co.uk
www.ukpersonal.hsbc.co.uk
banesnet.banesto.es
extranet.banesto.es
ebanking.bccbrescia.it
www.bankofscotlandhalifax-online.co.uk
oi.cajamadrid.es
bancae.caixapenedes.com
banking.postbank.de
meine.deutsche-bank.de
myonlineaccounts2.abbeynational.co.uk
ibank.cahoot.com
webbank.openplan.co.uk
bancopostaonline.poste.it
mybank.bybank.it
ibank.internationalbanking.barclays.com
welcome7.co-operativebank.co.uk
welcome11.co-operativebankonline.co.uk
Troj/Delf-ALI modifies the HOSTS file in order to redirect access to the above sites.
Troj/Delf-ALI stores logged information to the following clean text files in the Windows system folder:
abbey.dll
bane.dll
bankofscot.dll
barc.dll
barc3.dll
bccbrescia.dll
bybank.dll
cahoot.dll
caixapenedes.dll
cajamadrid.dll
coo11.dll
coo7.dll
deutchebank.dll
halif.dll
hsbc.dll
lloy.dll
posta.dll
postbank.dll
wool.dll
Troj/Delf-ALI can be removed from Windows computers automatically with the following Resolve tools:
Windows disinfector
DELFAGUI is a disinfector for standalone Windows computers. To use it you have to do the following:
- Open DELFAGUI.com file from your desktop after downloading it.
- Click on the Start Scan Button.
- Wait for the process to complete.
- After removing the worm you should install the Microsoft patch MS04-012 or, on single computers, update with all relevant security patches from Windows update.
Command line disinfector
DELFASFX.EXE is a self-extracting archive containing DELFACLI, a Resolve command line disinfector for use by system administrators on Windows networks.
- Page: 1 of 2
- 1
- 2
