Backdoor.Blarul in Overnet 0.52?

**Fizerani** · February 24th, 2004, 01:02 AM

I've had overnet for quite some time now, and I've recently upgraded to 0.52
I've scheduled my computer to update NAV and then scan while I'm at class, today I come home and I found out that Overnet's infected with Backdoor.Blarul.
I tried downloading the program again from Overnet.com and did a fresh install, with the same results. Anyone else have this problem?

**Psilaxs** · February 24th, 2004, 01:26 AM

You had better watch out, that is all part of the FBI plan, see the FBI really controls and distributes Overnet as a HUGE Honeypot to get IP numbers and identify people who share ANYTHING (even if it is legal) My best advice to you at this very moment, is wipe your HDD with huge elctro magnets, use evidence eliminator, get a 15 LB sledge hammer and smash you HDD into pieces, then burn the remains in an incinerator just to make sure.

If they haven't already got your information, you *should* be fine.........well probably not, but BEST OF LUCK!.

**ccc1005** · February 24th, 2004, 01:26 AM

Same exact thing here

**simon_says_horrible** · February 24th, 2004, 04:08 AM

same time here... here's my screenshot before 2am... horrible. :shoot :cross

**begoodbebad** · February 24th, 2004, 04:56 AM

It's just a screw up by Norton. The latest virus definition has decided that eDonkey and Overnet are a backdoor trojan called blarul...yeah right. Lots of people are pissing their pants and loudly announcing on the ed2k forums how they won't use ed2k until ed2k have fixed the problem.....well the problem is with Symantec.
Overnet and eDonkey have not changed overnight, they are not a backdoor and there is nothing to worry about. All you have to do is switch off NAV Autoprotect, reinstall ed2k/Overnet, and reconfigure NAV(right click NAV tray icon, select configure, click on auto protect and then exclusions and then new and exclude ed2k and overnet. Do the same for the manual scan). Now re-enable Auto protect in the system tray. Done.

**Dark Messenger** · February 24th, 2004, 05:30 AM

i support what begoodbebad says...moreso i've noticed an agenda with norton to purposely and deliberately cause a stir in the p2p community and with its own agenda for mislabelling harmless files calling them trojans when they are not...or purposefully breaking the usefulness of its self to engender recognition or publicity for its self.

I now use AVG as my antifvirus software and am very happy with it.

**Randygod** · February 24th, 2004, 06:17 AM

I vote for the norton , I have overnet 50 and 51 on a cdr made monthes ago and now they both are "infected" and has far has overnet edonkey being a set up I have to chuckle I have been on edonkey overnet since 1998 and have constantly had at least 120gigs sharredhunndreds of files music and film and nt a peep from the law only comcast telling me i use 100 times the average in bandwith and messing with me P2P is agienst comcast TOS and they are cracking down on bandwith hoggs

**begoodbebad** · February 24th, 2004, 08:38 AM

What is really keeping me happy and laughing today is the thought of those poor saps who have ed2k/overnet and Norton AV and also use Zone Alarm Pro. They woke up to find that instead of lots of completed files their p2p app has died and in its place is just a scary virus message. Then they log on to ZP to find out wtf is happening and find out their ever so pretty PRO firewall sucks too.
This has all cheered me up immensely and life seems worth living again. Thankyou Jesus, Buddha, Krsna, Allah, Jehovah and all other imaginary godlike beings too. You really came thru. Finally.
Probably tomorrow will be back to normal?

**Dark Messenger** · February 24th, 2004, 08:51 AM

Originally Posted by begoodbebad

What is really keeping me happy and laughing today is the thought of those poor saps who have ed2k/overnet and Norton AV and also use Zone Alarm Pro. They woke up to find that instead of lots of completed files their p2p app has died and in its place is just a scary virus message. Then they log on to ZP to find out wtf is happening and find out their ever so pretty PRO firewall sucks too.
This has all cheered me up immensely and life seems worth living again. Thankyou Jesus, Buddha, Krsna, Allah, Jehovah and all other imaginary godlike beings too. You really came thru. Finally.
Probably tomorrow will be back to normal?

i like you...you are funny...can i be an imaginary god-like being too? :D

**begoodbebad** · February 24th, 2004, 09:09 AM

Originally Posted by Dark Messenger

i like you...you are funny...can i be an imaginary god-like being too? :D

It's easy.
Hair: shaven head is ok, so are long flowing locks, maybe even a beard. No gels or dyes please.
Gender: male, naturally.
Philosophy: impenetrable, obscure and wise. Or totally fucking scary (see Torah/Bible or Koran).
Special Powers: make sure everyone hears about them but no showing off in public or some shithead tv magician will turn out to be able to do it better and have a sexier looking girlfriend too.
Followers: You're going to have to tolerate some really fucking screwy people. But don't worry, they'll do anything you say, which makes up for a lot of faults.
Money: it's all yours anyway so don't feel bad about getting hold of it any way you can....you're beyond morality, right?
Working hours: tend to be rather long but depending on the belief system you manufacture you could get a lot of holidays too.
Clothing: No trousers, robes are much better.
Non believers: only really two ways to handle this one: ignore them or kill them all.

It helps if you died thousands of years ago of course. Or even better never did exist at all.

**Etnies** · February 24th, 2004, 09:21 AM

Heres what sharereactor have posted in reagrds to the above mentioned trojan

Overnet and eDonkey do NOT have a virus! (24.02.2004 17:19:24) from Simon Moon
Its cleared up now, its a screwup over at the guys of Symantec. Norton Antivirus, with the latest updates, thinks that edonkey and overnet are viruses. Thats not the case. NAV is AGAIN wrong, as this false positive already happened a while ago with other software from another company. Weirdly, the enterprise edition of NAV doesnt do that, as somone tried in their company. Other scanners like Mcafee do not react to it. Your only solution is to explude the files of your client from search. Do not disable your Software and ALWAYS scan what you download, even if you clicked the link on SR. Theres always a chance a virus gets through, but in this case its NOT a virus and you are safe to use edonkey and overnet.

Here the offical statement from the maker of edonkey:
There is no virus or backdoor in Overnet or eDonkey2000. Norton antivirus is incorrectly detecting this. We are working to get them to either change their virus definitions or put up a new exe that doesn't get this warning.
Once again. There is absolutely no problem or danger with running overnet or eDonkey2000.

Virus warning: overnet and edonkey2000 installation files (24.02.2004 12:33:01) from Simon Moon
I got now 3 messages from different users that warned about a virus being in the installation files of edonkey2000 and overnet, version 0.51 and version 0.52. Please update your virus scanner to the latest version, or install one, and check your system. You might have the virus as well. Its a trojan virus that might give others the power over your computer.

Update: It seems like the virus is defined as backdoor.blural by Norton Antivirus. I didnt hear yet other sightings that other updated virus scanners have detected it as well. Blural-A is a trojan virus, very dangerous.
However, at this point in time, i cannot say if its the truth or not. I would advise everyone who is suspicious to NOT use overnet or edonkey for the moment. You could use emule for the time being although, no reports that it has the same message.
For those that trust in edonkey and overnet fully, you can go into your options of Norton, there in autopreotect and tell it to exclude edonkey and overnet's exes. Please keep in mind thats not really a secure way, but it would at least make it possible for you to use these clients again.
I will post again when i know whats going on.

**flantanella** · February 24th, 2004, 09:22 AM

thats funny

I had overnet and no virus warning came up

**flantanella** · February 24th, 2004, 09:28 AM

avg is the one that gives out fake warnings

I had avg, nav and used mcafee online scan. With both 3 scans only avg came up with warnings.

I knew someone that had a similar problem but there is a trojan named overnet.exe and thats what came up

**Ne007** · February 24th, 2004, 09:52 AM

Originally Posted by begoodbebad

It's just a screw up by Norton. The latest virus definition has decided that eDonkey and Overnet are a backdoor trojan called blarul...yeah right. Lots of people are pissing their pants and loudly announcing on the ed2k forums how they won't use ed2k until ed2k have fixed the problem.....well the problem is with Symantec.
Overnet and eDonkey have not changed overnight, they are not a backdoor and there is nothing to worry about. All you have to do is switch off NAV Autoprotect, reinstall ed2k/Overnet, and reconfigure NAV(right click NAV tray icon, select configure, click on auto protect and then exclusions and then new and exclude ed2k and overnet. Do the same for the manual scan). Now re-enable Auto protect in the system tray. Done.

wouldn't this leave incoming files unscanned for viruses?

You would just have to exclude the overnet.exe right....making sure not to exclude the whole folder.....not that you said to exclude the whole folder though.

**flantanella** · February 24th, 2004, 09:57 AM

i have overnet and nav system works 2004. There hasnt been any virus warnings with overnet installed. I even did a restore from a ghost image and still nothing. Is it official that the virus warning is fake and why havent I got the warning.. any help would be apreciated
Thanx