Gimped support@lindenlabs.com email

I email for support on files identified by TrojanHunter. My original email clearly states the problem and your reply email is really bloated with a lot of typical automated response stuff.

So I am awaiting a real response all day. Get a second email exactly like the first and upon closer inspection... actually reading the bloated automaton type LONG reply.. it says to further this request by email I must reply by entering my info between these stupid lines...

Well guess what?! The cursor will not allow me to.

Granted it might be my own security, but I'm gonna remove my in place security while I have possible trojan, I don't think so.

Below is a copy of my original email.
-----------------------------------------
Hi,

Just wanted to make sure that the file updater.exe in my main SL folder, is
a legitimate SL file.

Also in my C:\Documents and Settings\Owner\Local Settings\Temp\5.exe and
\C.exe. these occurred at the same time as SL 6.exe and SL D.exe.

TrojanHunter app is picking the above files up as SDBot trojans, so I am concerned.

Thanks,

C:\Program Files\Secondlife\updater.exe is a valid Secondlife file, if you have SFV the checksum on mine is 75F3BB65, you could verify against that to check integrity.

Mine is 49,152 bytes.

The email system is a bit bloated but I have seen two other services use it. In the second email, read near the bottom I think - your actual reply from linden will down there right above your message to them.

Basically the format should be

header stuff
place for responce
more automated stuff
most recent correspondence
...
other correspondence
...
first correspondence

Also with SL there is no harm in deleting all, uninstalling, clearing it all and re-downloading. You lose nothing and if you havn't done that in a while you may get a boost in performance.

Thank you si, my updater.exe is the same. I'd asked a friend in game and they have that one, as well. It's mainly the other 2 that have me most concerned.

I did however dump all the files in that temp folder into a zip file and deleted the used folders contents. SL still works fine, which I thought it probably would.

If I'd not had quite a bit of pc activity occurring when I was doing nothing but sitting here, last night, I really wouldn't be concerned. It was most unusual and is no longer happening. Also I was getting an occasional messaging type sound, along with my machine seeming to work extra, yet I was not messaging ingame and have no others installed on this pc.

I do not allow any of my apps to autoupdate and such. It was definitely excessive activity coming from something, so I'd really like to rule out these files.

Ok now I'm terribly concerned.

As suggested by Ama, I did a complete uninstall of SL. I just logged out of game, after having redone all my settings, etc. Actually spent about an hour in game and the only file the new install put in C:\Documents and Settings\Owner\Local Settings\Temp is the shortcut file.

I have all the questionable files zipped up, and there are 2 exe files that have SL icons... 6.exe and D.exe. If there is anyone at LL that would let me know something, I'd sure appreciate it. I'm not going to bother emailing again. That reply from support did suggest I take it up here on the forum.

Haute:

The files you found are from the Second Life automatic updater; it downloads the installer to a temporary file (which is in your docs and settings Temp folder). The updater.exe also copies itself there prior to downloading (due to Windows filesystem ickyness). They generally have names like 0.exe or F.exe. They are harmless, and can be deleted. They only appear after you have gone through at least one auto-update.

It's unlikely, however, that they are actually virus infected; the machines that do the release SL build and deploy have virus scanners running.

Just a suggestion: If you find corresponding with SL support to be too difficult using standard email, try using the web interface on this website. You can view all open tickets and all correspondence. (even if it previously took place via email)