{"ygPerms":{"resourceCapabilityList":[{"resourceType":"GROUP","capabilities":[{"name":"UPDATE"},{"name":"READ"},{"name":"WELCOME_MSG"},{"name":"PENDING_COUNT"},{"name":"ACTIVITY_LOGS"}]},{"resourceType":"PHOTO","capabilities":[{"name":"READ"},{"name":"READ"},{"name":"UPLOAD"},{"name":"UPDATE"},{"name":"DELETE"},{"name":"COPY"},{"name":"MOVE"},{"name":"APPROVE"},{"name":"UPLOADTEMP"},{"name":"GROUPCOVER"}]},{"resourceType":"FILE","capabilities":[{"name":"READ"},{"name":"CREATE"},{"name":"UPDATE"},{"name":"DELETE"},{"name":"AUTO_SEND"}]},{"resourceType":"MEMBER","capabilities":[{"name":"READ"},{"name":"READ"},{"name":"EDIT_MODERATOR"},{"name":"DELETE"},{"name":"CREATE"},{"name":"UPDATE"},{"name":"BAN"}]},{"resourceType":"LINK","capabilities":[{"name":"READ"},{"name":"CREATE"},{"name":"UPDATE"},{"name":"DELETE"},{"name":"MOVE_LINK"}]},{"resourceType":"CALENDAR","capabilities":[{"name":"READ"}]},{"resourceType":"DATABASE","capabilities":[{"name":"READ"},{"name":"CREATE"},{"name":"READ_DATA"}]},{"resourceType":"POLL","capabilities":[{"name":"READ"},{"name":"VOTE"},{"name":"UPDATE"},{"name":"CREATE"},{"name":"DELETE"},{"name":"CLOSE"}]},{"resourceType":"MESSAGE","capabilities":[{"name":"CREATE"},{"name":"READ"},{"name":"DELETE"}]},{"resourceType":"PENDING_MESSAGE","capabilities":[{"name":"READ"},{"name":"UPDATE"},{"name":"DELETE"}]},{"resourceType":"ATTACHMENTS","capabilities":[{"name":"READ"},{"name":"DELETE"}]},{"resourceType":"PHOTOMATIC_ALBUMS","capabilities":[{"name":"READ"},{"name":"UPLOAD"}]},{"resourceType":"MEMBERSHIP_TYPE","capabilities":[{"name":"READ"},{"name":"CREATE"},{"name":"DELETE"},{"name":"UPDATE"}]},{"resourceType":"POST","capabilities":[{"name":"READ"},{"name":"CREATE"},{"name":"UPDATE"},{"name":"DELETE"}]},{"resourceType":"PIN","capabilities":[{"name":"READ"},{"name":"CREATE"},{"name":"UPDATE"},{"name":"DELETE"}]}],"modStatus":"MODERATOR","subStatus":"NORMAL","groupUrl":"groups.yahoo.com","intlCode":"us"},"comscore":"pageview_candidate","ygData":{"userId":227260568,"authorName":"omegatexe","from":"&quot;omegatexe&quot; &lt;steveleg@hotmail.com&gt;","profile":"omegatexe","replyTo":"LIST","senderId":"fULsfPE0y17xfa5Q0Ug0HRHFjOwIFXLJvAsN_z3qOx3xHKr3BtYXqwvRtWdL3z2A1FICOmW_hcWEPwLrlKBjK6CNOxEVsp705Q","spamInfo":{"isSpam":false,"reason":"12"},"subject":"Re: [OmT] Virus again?","postDate":"1118504872","msgId":2251,"canDelete":true,"contentTrasformed":false,"systemMessage":false,"headers":{"messageIdInHeader":"PGQ4ZjEzOCtnZTQyQGVHcm91cHMuY29tPg==","inReplyToHeader":"PDIwMDUwNjExMTM1OTQ3LjEwODMxLnFtYWlsQHdlYjQwOTEzLm1haWwueWFob28uY29tPg=="},"prevInTopic":2245,"nextInTopic":2252,"prevInTime":2250,"nextInTime":2252,"topicId":2234,"numMessagesInTopic":20,"msgSnippet":"Hy Maxym I am a bit wary about turning off my virus scanner as the Trojan horse will start turning off Windows services if it is not checked and eliminated. It","rawEmail":"Return-Path: &lt;steveleg@hotmail.com&gt;\r\nReceived: (qmail 42033 invoked by uid 7800); 11 Jun 2005 15:56:41 -0000\r\nX-Sender: steveleg@hotmail.com\r\nX-Apparently-To: OmegaT@yahoogroups.com\r\nReceived: (qmail 63127 invoked from network); 11 Jun 2005 15:48:14 -0000\r\nReceived: from unknown (66.218.66.166)\n  by m22.grp.scd.yahoo.com with QMQP; 11 Jun 2005 15:48:14 -0000\r\nReceived: from unknown (HELO n28.bulk.scd.yahoo.com) (66.94.237.57)\n  by mta5.grp.scd.yahoo.com with SMTP; 11 Jun 2005 15:48:14 -0000\r\nComment: DomainKeys? See http://antispam.yahoo.com/domainkeys\r\nReceived: from [66.218.69.4] by n28.bulk.scd.yahoo.com with NNFMP; 11 Jun 2005 15:47:55 -0000\r\nReceived: from [66.218.66.79] by mailer4.bulk.scd.yahoo.com with NNFMP; 11 Jun 2005 15:47:55 -0000\r\nDate: Sat, 11 Jun 2005 15:47:52 -0000\r\nTo: OmegaT@yahoogroups.com\r\nMessage-ID: &lt;d8f138+ge42@eGroups.com&gt;\r\nIn-Reply-To: &lt;20050611135947.10831.qmail@web40913.mail.yahoo.com&gt;\r\nUser-Agent: eGroups-EW/0.82\r\nMIME-Version: 1.0\r\nContent-Type: text/plain; charset=ISO-8859-1\r\nContent-Length: 5427\r\nX-Mailer: Yahoo Groups Message Poster\r\nX-Yahoo-Newman-Property: groups-compose\r\nX-Originating-IP: 66.94.237.57\r\nX-eGroups-Msg-Info: 1:12:0\r\nX-Yahoo-Post-IP: 212.146.55.55\r\nFrom: &quot;omegatexe&quot; &lt;steveleg@hotmail.com&gt;\r\nSubject: Re: [OmT] Virus again?\r\nX-Yahoo-Group-Post: member; u=227260568; y=THu5ajCM4VIzMToWcm-mqrV7Loz8uh89du9ZZcXSBNuoxg_V\r\nX-Yahoo-Profile: omegatexe\r\nX-eGroups-Approved-By: korriganyannick &lt;yannick.marchegay@wanadoo.fr&gt; via email; 11 Jun 2005 15:56:41 -0000\r\n\r\nHy Maxym\n\nI am a bit wary about turning off my virus scanner as the Trojan horse\nwill start turning off Windows services if it is not checked and\neliminated. It did so this morning, and I had to pull off the\nbatteries to be able to shut down and reboot on the safe mode\nactivating the virus scanner. As I said, it could be that the\nsourceforge site itself may be OK but there maybe some malicious\nsoftware attached to my browser which, when I try to download an\nexe-file from sourceforge, in addition, downloads something else\nperhaps from somewhere else to the browser cache. This then is\ndetected as Generic backdoor.dr Trojan by the McAfee On-Access\nscanner. Would it be possible for you to try and download the said\nfile, OmegaT_1.4.5_setup.exe, while using the McAfee virus scanner\ninstead of Symantec? Meanwhile, I will try and find some more\ninformation about the Trojan. This issue might have nothing to do with\nthe Omega download in the final analysis, but I just have follow any\nleads and to go by any information I manage to come across.\n\nCheerio, Steve\n\n--- In OmegaT@yahoogroups.com, Maxym Mykhalchuk &lt;mihmax@y...&gt; wrote:\n&gt; Hi Steve,\n&gt; \n&gt; Can you possibly download the file (temporary disabling the\n&gt; antivirus) and send it to me privately?\n&gt; And also why does your McAfee REMOVE, and not CURE the virus?\n&gt; \n&gt; P.S. Anyone else having such a problem?\n&gt; P.P.S. Even with paranoid heuristics?\n&gt; \n&gt; Maxym\n&gt; \n&gt; --- omegatexe &lt;steveleg@h...&gt; wrote:\n&gt; \n&gt; &gt; Hi, Maxim\n&gt; &gt; \n&gt; &gt; I made sure my computer was clean by scanning it thoroughly and\n&gt; &gt; disabling and re-enabling System Restore. It appears that when I\n&gt; &gt; try\n&gt; &gt; to download an exe-file OmegaT_1.4.5_setup.exe, the McAfee online\n&gt; &gt; scanner detects the just arrived Trojan horse in the browser cache\n&gt; &gt; and\n&gt; &gt; deletes it. OmegaT.exe itself is not infected, I checked it. This\n&gt; &gt; time\n&gt; &gt; I downloaded from Lausanne, Switzerland. I realize that this is not\n&gt; &gt; a\n&gt; &gt; virus forum and that OmegaT itself is virus free, but could there\n&gt; &gt; be\n&gt; &gt; something with the setup_exe-file when you try to download it. Or\n&gt; &gt; would anyone be able to give a clue how the Generic backdoor.dr\n&gt; &gt; Trojan\n&gt; &gt; works. Another possibility may be that whenever a user tries to\n&gt; &gt; download an exe from some address a Trojan will introduce itself to\n&gt; &gt; Mr. McAfee? This seems to happen only when I try to download the\n&gt; &gt; Omega\n&gt; &gt; exe from the sourceforge download mirror sites, other sites are OK.\n&gt; &gt; \n&gt; &gt; Cheerio, Steve\n&gt; &gt; \n&gt; &gt; --- In OmegaT@yahoogroups.com, Maxym Mykhalchuk &lt;mihmax@y...&gt;\n&gt; &gt; wrote:\n&gt; &gt; &gt; Strange, Steve,\n&gt; &gt; &gt; \n&gt; &gt; &gt; I&#39;ve just checked, my Symantec Antivirus Corporate with latest\n&gt; &gt; DBs\n&gt; &gt; &gt; (8.06.2005) doesn&#39;t find anything there.\n&gt; &gt; &gt; Did you check your system?\n&gt; &gt; &gt; \n&gt; &gt; &gt; Maxym\n&gt; &gt; &gt; \n&gt; &gt; &gt; --- omegatexe &lt;steveleg@h...&gt; wrote:\n&gt; &gt; &gt; \n&gt; &gt; &gt; &gt; Just when I thought I am shipshape with the Trojan I reported I\n&gt; &gt; got\n&gt; &gt; &gt; &gt; another scare. As Sabine informed me about the OmegaT 1.5, I\n&gt; &gt; went\n&gt; &gt; &gt; &gt; to\n&gt; &gt; &gt; &gt; sourceforge site and tried to download it from\n&gt; &gt; &gt; &gt; nchcdl.sourceforge.net\n&gt; &gt; &gt; &gt; in Taiwan. My virus detection system immediately popped up\n&gt; &gt; &gt; &gt; informing\n&gt; &gt; &gt; &gt; me that  the very same Generic backdoor.dr Trojan had emerged\n&gt; &gt; in\n&gt; &gt; &gt; &gt; qptmngl.exe (Local Settings/Temp folder)file and was removed.\n&gt; &gt; Then\n&gt; &gt; &gt; &gt; I\n&gt; &gt; &gt; &gt; tried downloading it from the German site and the same thing\n&gt; &gt; &gt; &gt; happened.\n&gt; &gt; &gt; &gt; Now, I don&#39;t know how the Trojan works: does it try to attach\n&gt; &gt; &gt; &gt; itself\n&gt; &gt; &gt; &gt; to downloads from certain sites or whether there might be\n&gt; &gt; something\n&gt; &gt; &gt; &gt; wrong with the setup.exe-file. Any ideas? I use McAfee\n&gt; &gt; virusscan.\n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; Steve\n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n&gt; &gt; &gt; &gt; Go to: http://sourceforge.net/projects/omegat/ for bug reports,\n&gt; &gt; &gt; &gt; feature\n&gt; &gt; &gt; &gt; requests, OmegaT test versions etc...\n&gt; &gt; &gt; &gt; To localize OmegaT to your language, or proofread existing\n&gt; &gt; &gt; &gt; translations,\n&gt; &gt; &gt; &gt; read: http://www.omegat.org/omegat/translation-info.html\n&gt; &gt; &gt; &gt; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n&gt; &gt; &gt; &gt;  \n&gt; &gt; &gt; &gt; Yahoo! Groups Links\n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt;  \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; &gt; \n&gt; &gt; &gt; \n&gt; &gt; &gt; \n&gt; &gt; &gt; ================================\n&gt; &gt; &gt; Maxym Mykhalchuk\n&gt; &gt; &gt; phone: (+39) 320 8593170\n&gt; &gt; &gt; icq: 172-308-458\n&gt; &gt; &gt; ================================\n&gt; &gt; &gt; \n&gt; &gt; &gt; \n&gt; &gt; &gt; \t\t\n&gt; &gt; &gt; __________________________________ \n&gt; &gt; &gt; Discover Yahoo! \n&gt; &gt; &gt; Stay in touch with email, IM, photo sharing and more. Check it\n&gt; &gt; out! \n&gt; &gt; &gt; http://discover.yahoo.com/stayintouch.html\n&gt; &gt; \n&gt; &gt; \n&gt; &gt; \n&gt; &gt; \n&gt; &gt; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n&gt; &gt; Go to: http://sourceforge.net/projects/omegat/ for bug reports,\n&gt; &gt; feature\n&gt; &gt; requests, OmegaT test versions etc...\n&gt; &gt; To localize OmegaT to your language, or proofread existing\n&gt; &gt; translations,\n&gt; &gt; read: http://www.omegat.org/omegat/translation-info.html\n&gt; &gt; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n&gt; &gt;  \n&gt; &gt; Yahoo! Groups Links\n&gt; &gt; \n&gt; &gt; \n&gt; &gt; \n&gt; &gt;  \n&gt; &gt; \n&gt; &gt; \n&gt; &gt; \n&gt; \n&gt; \n&gt; ================================\n&gt; Maxym Mykhalchuk\n&gt; phone: (+39) 320 8593170\n&gt; icq: 172-308-458\n&gt; ================================\n&gt; \n&gt; \n&gt; \t\t\n&gt; __________________________________ \n&gt; Discover Yahoo! \n&gt; Stay in touch with email, IM, photo sharing and more. Check it out! \n&gt; http://discover.yahoo.com/stayintouch.html\n\n\n\n"}}