Kazaa possible backdoor?

I searched the threads and didn't find anything, so I thought I'd post about this

I'm currently running Win2k with Zone Alarm and Norton. I have Kazaa Lite running every once in awhile to share files. My question is about what I see, and don't see, in my Zone Alarm logs. My first concern is that when Norton starts up it is automatically disabled, and automatically enables itself. My second concern is that my Zone Alarm logs seem to have been totally erased every time I close the program or restart my computer. And finally, (I know this is getting long but bear with me) When I do a "lock down" and totally shut off internet access (without Kazaa running) my log file lights up with port 1214 access attempts. So my concern is these alerts I'm getting when I lock down my computer. I'm wondering if Kazaa is just built to attempt to connect like this or am I part of a huge DDoS network? I really don't want to format my drive, but I'm getting a bit more paranoid every day. If anyone can answer some of these questions if it would GREATLY appreciated! Thanks!

Kazaa has somewhat of a backdoor called Cydoor. It is, by definition, spyware, that logs the websites that you visit and customizes pop-up ads accordingly. You may want to unistall Kazaa and use its spyware free alternative at www.kazaalite.com . If that doesn't fix it you may want to scan your pc to make sure there is no trojan on it. www.housecall.antivirus.com. Hope gets ya going in the right direction.

neta1o

Quote:

---

Originally posted here by cha_chi
I searched the threads and didn't find anything, so I thought I'd post about this

I'm currently running Win2k with Zone Alarm and Norton. I have Kazaa Lite running every once in awhile to share files. My question is about what I see, and don't see, in my Zone Alarm logs. My first concern is that when Norton starts up it is automatically disabled, and automatically enables itself. My second concern is that my Zone Alarm logs seem to have been totally erased every time I close the program or restart my computer. And finally, (I know this is getting long but bear with me) When I do a "lock down" and totally shut off internet access (without Kazaa running) my log file lights up with port 1214 access attempts. So my concern is these alerts I'm getting when I lock down my computer. I'm wondering if Kazaa is just built to attempt to connect like this or am I part of a huge DDoS network? I really don't want to format my drive, but I'm getting a bit more paranoid every day. If anyone can answer some of these questions if it would GREATLY appreciated! Thanks!

---

Thanks :) But I don't know if I spoke right there. I do have Kazaa Lite installed, so I apologize for simply saying "KaZaa" when I meant Kazaa Lite. But I will check that site out and have my computer scanned. What I'm thinking is that it's a DDoS network that hasn't been detected yet, and wondering if someone could tell me about how KaZaa connects to your computer using port 1214 and why it repeats itself when it can't connect?

Kazaa is not a virus it is a Cydoor,Spware for people who want to advertise junk and expand there network

Here is the disclaimer from ZD net.

Editor's note: This download includes additional applications that are bundled within the software's installer file, some of which may be provided by parties other than the developer of this download. These applications may deliver advertisements, collect information, overlay content or graphics on the Web site you are viewing, or modify your system settings. As with all downloads, CNET recommends that you pay close attention to the options presented to you during the installation process. Mandatory third-party applications bundled with this download include Cydoor. Optional third-party applications include SaveNow, DelFin, MediaLoads, b3d Projector, and New.net.

If you are concerned with what is on your system, try running Adware to check for spyware that may be installed on your machine. Then run a full system scan with your anti-virus and get a good trojan scanner as well.

If your machine is clean, I wouldn't worry too much. There is as noted elsewhere in this thread, a certain amount of risk involved with any p2p software.

Kazzaa is in my opinion nothing more then a trojan with a nice jacket. A prohgramm that allows acces to yer harddisk never is totally secure (history proves). And that combined with the psychology of kazzaa... sharing (copyrighted) files and track the people who use the infrasctruture so you can send em the right adverts.

I have a sepparate windows partition with no access to other partitions, if it tries to by just raw editting my harddisk the progam get's "suspened", like virusscanners can hold the computer if any programmm tries to write to the masterbootrecord. You could also use a separate computer for that... I have installed a nice browser and an irc client and that's all I need if I want to have something from kazzaa. It's a little paranoid, but it's safe and I don't care about any kazzaa virus, because there isn't anything usefull on that box.

Of course there still is a decent firewalland AV. My hardware firewall treats it like a separate network, so it also isn't a danger for my LAN...

**** my story is a mess, sorry for that, I don't even know what I tried to say really... I have a headache from here to the USA and back along the other side of the world.

Yeah, I gotta admit, Kazaa's antics are pretty lame. It targets a large audience of mostly computer illiterate people (in my household anyways). The average user in my household doesn't understand the implications of trojans and viruses. Even though a few weeks prior the entire system couldn't even boot up because of a trojan unloaded on the computer via Kazaa. No matter how much I explain how vile Kazaa is, I get the same response "well, 'so and so' is using it, and they're having no problems. Well, 5 out of 6 times you won't die from playing russian roulette either. To be perfectly honest, I'd rather just buy the damn CD or tape and not have to spend 15 hours trying to figure out why my computer won't boot up.

go to K-LITE home page this is where the real kazaalite is!!
.com has a lil kiddie hack of it pluse their jockin our K++ and tools for kazaa!!! and also drop by the forum where all the devlopers are!! the forum is down at this moment due to the server being switched!! but it will be up shortly very soon!!!
the forum will also be converted soon so we will have all the verifieds back up!!!!

Quote:

---

ShagDevil Yeah, I gotta admit, Kazaa's antics are pretty lame. It targets a large audience of mostly computer illiterate people (in my household anyways). The average user in my household doesn't understand the implications of trojans and viruses. Even though a few weeks prior the entire system couldn't even boot up because of a trojan unloaded on the computer via Kazaa. No matter how much I explain how vile Kazaa is, I get the same response "well, 'so and so' is using it, and they're having no problems. Well, 5 out of 6 times you won't die from playing russian roulette either. To be perfectly honest, I'd rather just buy the damn CD or tape and not have to spend 15 hours trying to figure out why my computer won't boot up.

---

well ya go spend ****in 20 dollars for a cd i will d/l all them for nuthing!!!! get all you buy for free!!!!!kazaa is not a back door to virus's if you use it right you wont get virus's!!if you use some judgement and your brain!!! and there are tones of verified web sites to cut the virus bullshit and fake file crap!!!! and also a good firewall thats configured right will cover all attempted access attempts so kazaa is no back door!!!and that kazaa inbound that you see on ya firewall is kazaa connecting to supernods!!!!come on ppl i thought this site was filled with good info and smart ppl till i seen these posts!!!!get sum knowledge befor you condem a program!!and if you dont know the forum will explain all your question that you may have conserning kazaa and computers related problems!!!!and the forum will also shoot ya stupid ass scare tatic's to hell!!there is nothing going to happin to kazaa "no riaa no body will ever shut it down cause they will have to bust all supernodes that are runnin"and thats impossable cause alot of them are in countries that fileshareing is legal!!and the usa cant stop kazaa cause kazaa is not bound by us law!!!cause its was made by a offshore company
called sherman networks and also the ppl that own the fasttrack network are in a country where file shareing is legal !!!so scare tatic smear tatics!!! you are not scareing anyone cause ppl that read this will come to your site and see its all false!!!!!if ya wana smear sumtin go smear roxio for shoty programs or microsoft for makin a patch for a patch!!!!

get real here ppl!!
im not here to diss anyone im just saying its all bullshit!!!
well anywho im going to d/l a movie now and i will be thinkin bout you buying it at the same time and laughin my ass off !!!! have fun blowing ya money!!! you all know i dunn saved $2.000 on software and two hundred dollars on music cd's!!!!!

I don't believe it..cha_chi has said now atleast twice that KAZAA-LITE is the installed programm.. Why is everyone talking KAZAA?? All the other Issues aside...

My advice may not be much help..
Spybot S&D..or Ad-Aware to find Parasite/Spyware.. (your concern maybe away from Kazaa-Lite)
The Cleaner or Tauscan to check for most trojans.. these will pick up a lot of the common backdoor/key-hookers/trojan.
Or try Process Explorer- and see what is running in your machine.. do some real sluthing.. read about it here


Cheers

ive been telling everyone that the original KaZaA has ****ing spyware, but they wont listen! All they do is just sit there with kazaa and think that they are safe well *errrr* thats wrong! One of my friends has kazaa and they said that their computers are messed up and then crashed! Anyways, all my teachers suck cocks in computers. They dont even know how to print! I have to actually tell them in the simplest words i can but they still dont know! This is crazy! u know i use WinMX, but dont use kazaa or kazaagold

Instead of locking the internet down, select Kaza lite only as a pass thru program and engage the internet lock instead (so now Kaza lite only has Internet access). If port 1214 still lights up, then it wasn't kaza using that port.

Don't forget also...the Kaza servers might just be communicating to you through that port (if it is in fact kaza using thsat port) just to see if you computer is still connected. Then again it might be spyware, who knows... ;)

If you're interested in networking and security, read up a bit in networking and download Tiny Personal Firewall. In my opinion, it's better than Zonealarm in many ways. One of them is it doesn't hog as many resources. It's also much more configurable. Just a thought.

-Mike

Quote:

---

and wondering if someone could tell me about how KaZaa connects to your computer using port 1214 and why it repeats itself when it can't connect?

---

It would seem that normal Kazaa is blocked because the source and destination port 1214 (TCP/UDP) is blocked, but that Kazaa Lite still works... Why? I did several packet captures with Kazaa Light and it would appear that it preloads known network information. I say this because...

- The initial UDP packets are denied by the firewall; they're unanswered
- The ICMP-based traceroutes Kazaa performs don't contain any meaningful information (unless the ICMP payloads are encrypted which is unlikely...)
- The related DNS queries don't return any relavent information like I first suspected
- The inital TCP connections are to the same IP addresses/port sequences...

I went digging throught the registry and found this value (REG_BINARY):

HKEY_LOCAL_MACHINE\SOFTWARE\KaZaA\ConnectionInfo\KazaaNet

This contained a 2401 byte binary value (4802 bytes in hex). I renamed this value to KazaaNet1, created a new (empty) KazaaNet value, and then restarted Kazaa with a sniffer running... Kazaa Lite hangs (no connection)... and the sniffer didn't capture anything. It would seem that this registy value contains Kazaa network information (just like the value name implies, duh.). I attempted to see if this contained network addresses (as 4-byte octets, not dotted-quads), and didn't find anything, but I didn't try very hard.

Anyway, from what I can tell, Kazaa installs initial network state information in this key. If this key empty and the regular means to "discover" the Kazaa net are blocked (port 1214), I believe you can kill Kazaa dead. Unfortunately, this means that one must search for this key on every system with a suspected Kazaa installation and wax it. I recommend that someone else try this solution and if it works, perhaps one could implement a logon script or use policy to automate the eradication process.

Hope this helps!

Quote:

---

[i] Originally posted [url="http://www.AntiOnline.com/showthread.php?
well ya go spend ****in 20 dollars for a cd i will d/l all them for nuthing!!!! get all you buy for free!!!!!kazaa is not a back door to virus's if you use it right you wont get virus's!!if you use some judgement and your brain!!! and there are tones of verified web sites to cut the virus bullshit and fake file crap!!!! and also a good firewall thats configured right will cover all attempted access attempts so kazaa is no back door!!!and that kazaa inbound that you see on ya firewall is kazaa connecting to supernods!!!!come on ppl i thought this site was filled with good info and smart ppl till i seen these posts!!!!get sum knowledge befor you condem a program!!and if you dont know the forum will explain all your question that you may have conserning kazaa and computers related problems!!!!and the forum will also shoot ya stupid ass scare tatic's to hell!!there is nothing going to happin to kazaa "no riaa no body will ever shut it down cause they will have to bust all supernodes that are runnin"and thats impossable cause alot of them are in countries that fileshareing is legal!!and the usa cant stop kazaa cause kazaa is not bound by us law!!!cause its was made by a offshore company
called sherman networks and also the ppl that own the fasttrack network are in a country where file shareing is legal !!!so scare tatic smear tatics!!! you are not scareing anyone cause ppl that read this will come to your site and see its all false!!!!!if ya wana smear sumtin go smear roxio for shoty programs or microsoft for makin a patch for a patch!!!!

get real here ppl!!
im not here to diss anyone im just saying its all bullshit!!!
well anywho im going to d/l a movie now and i will be thinkin bout you buying it at the same time and laughin my ass off !!!! have fun blowing ya money!!! you all know i dunn saved $2.000 on software and two hundred dollars on music cd's!!!!! [/B]

---

You, my friend, are why the filesharing "industry" is getting attacked.

A) Buy CD's after you try out the material (unless it sucks piece...or you only like 1 song)
B) Sharman Networks can, and is being sued in US courts because there was a ruling to OK it.
C) All your 2k worth of software is illegal
I dont object to the last one as much, because some software (namely Photoshop and some 3d rendering programs) cost hundreds of dollars for a full featured legit copy. This isn't fair to the consumers who aren't doing anything commercial with it, and just want to play around...

hey yo, something you might want to try is downloading ad-aware. i think the latest version is 6.0 or something like that. you can get it from download.com or from tucows.com for free. what it does is scan your computer for spyware software and reports back what it finds. from there you can choose to remove them. good luck!!

personally, I've found that Kazaa can be used for only two things, downloading anime mpegs, or getting MP3s. There are so many safer and faster P2P programs out there, that I'd just uninstall and get winMX or sumetin
out

Here's how to disable the Kazaa spyware ads

Be sure to install (Kazaa) first. Under Win98,XP,ECT., it gets installed as \Windows\system32\cd_clint.dll. Make a copy of the original and save it under a different name that you'll remember, say, "cd_clint.org". Then just copy the dummy file included here into \Windows\system32. The reason you need to save the original file is that if you try to uninstall KaZaA, the uninstall will refuse to run because of the dummy cd_clint.dll. So if you uninstall KaZaA, first delete the dummy cd_clint.dll. Then rename the cd_clint.org back to cd_clint.dll. The KaZaA uninstall will then work correctly.

Change the file ext. of the file I included from "cd_clint.txt" to "cd_clint.dll"

Que / Co-Op / Sysop

How to Set MAXIMUM SEARCH/DOWNLOAD Beyond 100

Using the Regedit program in Windows, you can expand the number of search items and downloads that KAZAA/Morpheus will return.

To do it:
a) click the Windows "Start Menu" button
b) click "Run"
c) type "regedit" and hit <enter>
d) click the "+" in front of "HKEY_CURRENT_USER"
e) click the "+" in front of "software"
f) click the "+" in front of KAZZA/Morpheus (whichever you have)
g) click on the folder in front of "Advanced"
h) double click "MaxSearchResult"(in the right-hand window)
i) click on the circle in front of "decimal"
j) change the Value Data field (to something like "500")
k) click on "OK"
I) click on the folder in front of "Transfer"
L) double click "ConcurrentDownloads"(in the right-hand window)
M) click on the circle in front of "decimal"
N) change the Value Data field (to something like "500")
O) click on "OK"
X) close regedit (by clicking on the "X" in the extreme upper right corner of the regedit window)

The next time you run a search in KAZAA/Morpheus, you will be able to receive more than the normal 100 result limit.

NOTE: if you make any changes to (or just visit) your Tools:Options:advanced screen, it will complain about your maximum search count being too high. You will need to cancel out of the screen (OK X out!)

Enjoy

Try TDS3 for trojans (http://tds.diamondcs.com.au/) its alot more complex to use than the cleaner but it seems to be more thorough when its configured correctly. Also its got some usefull tools to investigate whats going on in your puter.