Replicating Trojan on misdirect/WMF-related?

OK, I'm a bit sketchy on a bit of the details. I was getting ready for work early in the AM wednesday morning doing some morning surfing from the news. I was misdirected to another site and I believe I sufferred from the WMF exploit. I have WIndows Home XP SP2 fully updated. I am running Symantec anti-virus professional with live update, it is also fully updated. I run AdAware and Adwatch v1.05, again fully up to date.

Symantec caught the Trojan, and said that it could not quarantine, but did deny access. After shutting my browser, I opened Symantec and found two files in c:\documentsandsettings\myuserfolder\temp. I right clicked on one of them and right clicked and chose "Delete". So far so good. Except it did not delete just one file. The counter for files deleted quickly climbed into the thousands. I quickly stopped the process and rebooted in safe mode. I ran a scan and found nothing in safe mode. I checked the log files and found that every file was in fact deleted. I ran an Adaware scan again in safe mode and found nothing. Stupidy, I ran CCleaner but allowed it to wipe the logs so I can't give you more info on the Trojan--However, as I remember it did not specify the type of Trojan; only that it was a trojan. The infected files were a series of alphanumeric characters, but I don't recall the extension--it was very early and I was rushed.

Anybody see this behavior before? I'm puzzled, please advise.

... and damn! I should have downloaded the latest patch.

OK, I'm a bit sketchy on a bit of the details. I was getting ready for work early in the AM wednesday morning doing some morning surfing from the news. I was misdirected to another site and I believe I sufferred from the WMF exploit. I have WIndows Home XP SP2 fully updated. I am running Symantec anti-virus professional with live update, it is also fully updated. I run AdAware and Adwatch v1.05, again fully up to date.

Symantec caught the Trojan, and said that it could not quarantine, but did deny access. After shutting my browser, I opened Symantec and found two files in c:\documentsandsettings\myuserfolder\temp. I right clicked on one of them and right clicked and chose "Delete". So far so good. Except it did not delete just one file. The counter for files deleted quickly climbed into the thousands. I quickly stopped the process and rebooted in safe mode. I ran a scan and found nothing in safe mode. I checked the log files and found that every file was in fact deleted. I ran an Adaware scan again in safe mode and found nothing. Stupidy, I ran CCleaner but allowed it to wipe the logs so I can't give you more info on the Trojan--However, as I remember it did not specify the type of Trojan; only that it was a trojan. The infected files were a series of alphanumeric characters, but I don't recall the extension--it was very early and I was rushed.

Anybody see this behavior before? I'm puzzled, please advise.

... and damn! I should have downloaded the latest patch.

If your XP is fully patched?

Are you also running Office and Outlook? If so, you should update those as well. There is a wmf-related patch for Outlook.

I'd also update your Symantec, from safe-mode with networking, just to make sure you aren't being blocked and have the current stuff.

Then scan.

If your XP is fully patched?

Are you also running Office and Outlook? If so, you should update those as well. There is a wmf-related patch for Outlook.

I'd also update your Symantec, from safe-mode with networking, just to make sure you aren't being blocked and have the current stuff.

Then scan.

Actually just checked that out: I was fully patched including the WMF patches. All seems fine, however that was really weird what happened. Any similar experiences out there? All scans are clean--which I find somewhat relieving, but that was really strange behavior.

Actually just checked that out: I was fully patched including the WMF patches. All seems fine, however that was really weird what happened. Any similar experiences out there? All scans are clean--which I find somewhat relieving, but that was really strange behavior.

Just because scans tell you that you are clean doesn't mean you are. They rely upon signatures.... That means that the malicious code you _might_ have on your system has to be recognizable by the scanning system. If there is no signature then there is no detection. If there has been some kind of rootkit installed you probably won't be able to detect it for yourself either.

Take a look around here and see what you can do for yourself. If there seems to be nothing you can and you are convinced that there is an issue then think about a reformat and re-install...

PS: don't forget to backup your _data_ files first... :)

Just because scans tell you that you are clean doesn't mean you are. They rely upon signatures.... That means that the malicious code you _might_ have on your system has to be recognizable by the scanning system. If there is no signature then there is no detection. If there has been some kind of rootkit installed you probably won't be able to detect it for yourself either.

Take a look around here and see what you can do for yourself. If there seems to be nothing you can and you are convinced that there is an issue then think about a reformat and re-install...

PS: don't forget to backup your _data_ files first... :)

Hmmm,

Quote:

---

Symantec caught the Trojan, and said that it could not quarantine,

---

I have seen that sort of behaviour with Javascript trojans. Some AVs cannot delete from archived files.

Try downloading, updating and running these in safe mode

http://www.ewido.net/en/
http://www.emsisoft.com.en/software/free/

The last one (A-Squared) is a specialist dialler and trojan killer ;)

I would then be tempted to run an online AV scan such as "Housecall" from PC-Cillin or the Panda one.

:)

Hmmm,

Quote:

---

Symantec caught the Trojan, and said that it could not quarantine,

---

I have seen that sort of behaviour with Javascript trojans. Some AVs cannot delete from archived files.

Try downloading, updating and running these in safe mode

http://www.ewido.net/en/
http://www.emsisoft.com.en/software/free/

The last one (A-Squared) is a specialist dialler and trojan killer ;)

I would then be tempted to run an online AV scan such as "Housecall" from PC-Cillin or the Panda one.

:)

Oh, yeah, I forgot to mention System Restore. Some of these nasties have a habit of hiding parts of themselves in System Restore. If you turn that off (Right-click My Computer, Properties, System Restore) and reboot to SafeMode, you should be able to scan and delete, and have reasonable assurance that it won't reinfect from the system restore files.

nihil's tools will help, too.

Backups? who needs stinkin' backups?

Yeah, Tiger's right, back up your data. Things can get dicey sometimes.

Oh, yeah, I forgot to mention System Restore. Some of these nasties have a habit of hiding parts of themselves in System Restore. If you turn that off (Right-click My Computer, Properties, System Restore) and reboot to SafeMode, you should be able to scan and delete, and have reasonable assurance that it won't reinfect from the system restore files.

nihil's tools will help, too.

Backups? who needs stinkin' backups?

Yeah, Tiger's right, back up your data. Things can get dicey sometimes.

Thanks Friends for the input, here's an update:

All previous scans were done with System Restore off. I then as per Nihil's recommendations downloaded Ewido and a+. I again scanned in Safe Mode with System Restore off. For good measure I scanned with the McAfee freetrial download I had and also with the Trend Micro free trial software that came with this Dell Laptop (I have only had it for a month). I have scoured the net and this site for a similar behavior and have found nothing yet--what I'm referring to is trying to delete one file with Symantec AV and finding the total files deleted climbing to about 4,000 before I stopped the process because it seemed to be going nowhere but up(the count, that is). To go over old ground, all files were successfully deleted, and now Safe Mode scans with products from 5 major vendors (Symantec, McAfee, Trend Micro, Ewido, and a+) that were done with System Restore off and fully updated definitions all say I'm clean.

Comments? What are the odds that something could be left? Performance is fine, I see nothing unusual running in my Task Manager. As far as backups, I tend to use this laptop as a lab for my apps, so there's nothing unique on it (its the slowest CPU I have, I like to test my custom apps on a dog to make sure they don't drag too much on slower computers). Could the steadily increasing file counter with the SAV delete have been a glitch? SAV found the signiture once and then it and every other AV program acted as if the delete was successful. I 'm puzzled by the lack of similar behavior out there, so if anyone else has seen their file counter go up like that upon AV deletion, let me know.

Thanks.

Thanks Friends for the input, here's an update:

All previous scans were done with System Restore off. I then as per Nihil's recommendations downloaded Ewido and a+. I again scanned in Safe Mode with System Restore off. For good measure I scanned with the McAfee freetrial download I had and also with the Trend Micro free trial software that came with this Dell Laptop (I have only had it for a month). I have scoured the net and this site for a similar behavior and have found nothing yet--what I'm referring to is trying to delete one file with Symantec AV and finding the total files deleted climbing to about 4,000 before I stopped the process because it seemed to be going nowhere but up(the count, that is). To go over old ground, all files were successfully deleted, and now Safe Mode scans with products from 5 major vendors (Symantec, McAfee, Trend Micro, Ewido, and a+) that were done with System Restore off and fully updated definitions all say I'm clean.

Comments? What are the odds that something could be left? Performance is fine, I see nothing unusual running in my Task Manager. As far as backups, I tend to use this laptop as a lab for my apps, so there's nothing unique on it (its the slowest CPU I have, I like to test my custom apps on a dog to make sure they don't drag too much on slower computers). Could the steadily increasing file counter with the SAV delete have been a glitch? SAV found the signiture once and then it and every other AV program acted as if the delete was successful. I 'm puzzled by the lack of similar behavior out there, so if anyone else has seen their file counter go up like that upon AV deletion, let me know.

Thanks.

one thing you might want to try is manually killing your temp files... all of them. The temp files stored in windows, the ones under your profile, and the ones stored by your browser, including the objects(note this may affect flash shockwave players and similar)

one thing you might want to try is manually killing your temp files... all of them. The temp files stored in windows, the ones under your profile, and the ones stored by your browser, including the objects(note this may affect flash shockwave players and similar)

Another scan you could try is blacklight by fsecure [google it] ... I think it was one of the members of AO that pointed this program out... [can't remember for sure] ... but it is a rootkit detector

Another scan you could try is blacklight by fsecure [google it] ... I think it was one of the members of AO that pointed this program out... [can't remember for sure] ... but it is a rootkit detector

Hmmmm,

This is a guess but you are running AdWatch and Symantec. Norton is not noted for its compatibility with other products and both would have been running interactively

My suspicion is that the two programs might have gotten into a "deadly" embrace, and were repetitively discovering the same malware. I note that you were in "normal mode" when you tried to delete the file, so adwatch and Norton would both have been running?

As I said, that is a guess, but I did manage to provoke a similar situation a few years back when I loaded several AVs and showed them a CD of "nasties"

:D

Hmmmm,

This is a guess but you are running AdWatch and Symantec. Norton is not noted for its compatibility with other products and both would have been running interactively

My suspicion is that the two programs might have gotten into a "deadly" embrace, and were repetitively discovering the same malware. I note that you were in "normal mode" when you tried to delete the file, so adwatch and Norton would both have been running?

As I said, that is a guess, but I did manage to provoke a similar situation a few years back when I loaded several AVs and showed them a CD of "nasties"

:D

off topic comment: nihil you just gave me a bad visual of steve irwin at a computer.

off topic comment: nihil you just gave me a bad visual of steve irwin at a computer.

Just throwing this out there... Westin's comment about the rootkit detector made
me recall an article I read yesterday in this forum about Sysinternal's rootkit detector (also free).
Their webpage includes some basic yet helpful information for understanding and digging out potential rootkits and hidden files. It doesn't remove them for you, but it will locate hidden directories, potentially shady files and a description of why the file was flagged.
I just boot up with a Knoppix Live cd to view those hidden directories and purge them (in this case, hidden temp files)
http://www.sysinternals.com/Utilitie...tRevealer.html

Thanks for all the input. I ran blacklight(fsecure) and still come up clean so I'm leaning towards Nihil's deadly embrace theory--yes both were running. That was really strange.

If anything new happens I'll give you all an update. Otherwise, I think this thread is pretty well tapped out.