<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">
<channel>
<title><![CDATA[C.I.S.R.T.]]></title> 
<link>http://www.cisrt.org/enblog/index.php</link> 
<description><![CDATA[Chinese Internet Security Response Team (GMT +0800)]]></description> 
<language>en-US</language> 
<copyright><![CDATA[C.I.S.R.T.]]></copyright>
<item>
<link>http://www.cisrt.org/enblog/read.php?100</link>
<title><![CDATA[Black Friday, Backdoor.Haxdoor]]></title> 
<author>smallmo &lt;smallmo@cisrt.com&gt;</author>
<category><![CDATA[Others]]></category>
<pubDate>Fri, 18 May 2007 15:51:56 +0000</pubDate> 
<guid>http://www.cisrt.org/enblog/read.php?100</guid> 
<description>
<![CDATA[ 
	It&#039;s a terrible day for lots of Chinese users (especially Enterprise Users) who use Norton products today. Since this morning, we have received many reports from lots of users. They meet the same problem that Norton detects two system files &quot;netapi32.dll&quot; and &quot;lsasrv.dll&quot; as Backdoor.Haxdoor when they finish upgrading their database to May.17,2007 , and these two files will be deleted. After reboot, the operate system will be loaded into blue screen, and display the following windows file protection message box:<br/><br/><a href="http://www.cisrt.org/blog/attachment/200705/1179458115_0.png" target="_blank"><img src="http://www.cisrt.org/blog/attachment/200705/1179458115_0.png" class="insertimage" alt="Open in new window" title="Open in new window" border="0"/></a><br/>............<br/><br/>Tags - <a href="http://www.cisrt.org/enblog/tag.php?tag=netapi32.dll" rel="tag">netapi32.dll</a> , <a href="http://www.cisrt.org/enblog/tag.php?tag=lsasrv.dll" rel="tag">lsasrv.dll</a> , <a href="http://www.cisrt.org/enblog/tag.php?tag=backdoor.haxdoor" rel="tag">backdoor.haxdoor</a>
]]>
</description>
</item><item>
<link>http://www.cisrt.org/enblog/read.php?100#blogcomment109</link>
<title><![CDATA[[Comments] Black Friday, Backdoor.Haxdoor]]></title> 
<author>bobby &lt;user@domain.com&gt;</author>
<category><![CDATA[Comments]]></category>
<pubDate>Tue, 22 May 2007 03:23:34 +0000</pubDate> 
<guid>http://www.cisrt.org/enblog/read.php?100#blogcomment109</guid> 
<description>
<![CDATA[ 
	Norton screwed up my entire Chinese office&#039;s computers. &nbsp;3 in total. &nbsp;We only use legitimate softwarel all paid for licenses. &nbsp;what a bunch of crap. I will not use norton products after this. We had to reformat 3 PCs and install windows again. &nbsp; they cost us all of our data between scheduled backups. and it is not a small loss, it is HUGE. &nbsp;Do not use their products as they obvioulsly dont test them, checm them, or they possibly took willing action to knock out pirated software while not considering those who paid for their licenses.
]]>
</description>
</item><item>
<link>http://www.cisrt.org/enblog/read.php?100#blogcomment113</link>
<title><![CDATA[[Comments] Black Friday, Backdoor.Haxdoor]]></title> 
<author>Jimo &lt;user@domain.com&gt;</author>
<category><![CDATA[Comments]]></category>
<pubDate>Tue, 22 May 2007 22:13:07 +0000</pubDate> 
<guid>http://www.cisrt.org/enblog/read.php?100#blogcomment113</guid> 
<description>
<![CDATA[ 
	Though this was a terrible mistake on their part, the crash did not require a reformat and reinstall of the OS - but sometimes that&#039;s the quickest way to get things back up and running.<br/><br/>Antivirus is not an exact science so, unfortunately, other protection products are bound to follow suit as others already have (Norton now included) in the past.
]]>
</description>
</item><item>
<link>http://www.cisrt.org/enblog/read.php?100#blogcomment114</link>
<title><![CDATA[[Comments] Black Friday, Backdoor.Haxdoor]]></title> 
<author>Zyndram z Maszkowic &lt;user@domain.com&gt;</author>
<category><![CDATA[Comments]]></category>
<pubDate>Wed, 23 May 2007 09:36:26 +0000</pubDate> 
<guid>http://www.cisrt.org/enblog/read.php?100#blogcomment114</guid> 
<description>
<![CDATA[ 
	pomidor!
]]>
</description>
</item><item>
<link>http://www.cisrt.org/enblog/read.php?100#blogcomment115</link>
<title><![CDATA[[Comments] Black Friday, Backdoor.Haxdoor]]></title> 
<author>Yuri &lt;user@domain.com&gt;</author>
<category><![CDATA[Comments]]></category>
<pubDate>Thu, 24 May 2007 18:05:10 +0000</pubDate> 
<guid>http://www.cisrt.org/enblog/read.php?100#blogcomment115</guid> 
<description>
<![CDATA[ 
	dynia 
]]>
</description>
</item><item>
<link>http://www.cisrt.org/enblog/read.php?100#blogcomment180</link>
<title><![CDATA[[Comments] Black Friday, Backdoor.Haxdoor]]></title> 
<author>adam &lt;user@domain.com&gt;</author>
<category><![CDATA[Comments]]></category>
<pubDate>Wed, 01 Aug 2007 08:50:55 +0000</pubDate> 
<guid>http://www.cisrt.org/enblog/read.php?100#blogcomment180</guid> 
<description>
<![CDATA[ 
	[url=http://o2.pl]aout[/url]
]]>
</description>
</item>
</channel>
</rss>