Author Topic: Win32:SdBot-3324 [Trj]  (Read 6834 times)

0 Members and 1 Guest are viewing this topic.

dmbarry777

  • Guest
Win32:SdBot-3324 [Trj]
« on: March 25, 2006, 02:26:41 PM »
I have avast! simple  and it found this trojan but I could not put it in the chest or delete it.

Win32:SdBot-3324 [Trj]
 
C:\temp\CD0.iso\I386\APPS\APP22384\SRC\MSWORKS\PFILES\MSWORKS\WKSV7STD.SBS

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
Re: Win32:SdBot-3324 [Trj]
« Reply #1 on: March 25, 2006, 03:32:41 PM »
Files in use are protected by windows, so that may well be the cause and possibly because it in inside an .iso file that it can't remove it.

Where did you get the iso file from ?
How was it placed in a Temp folder ?
I didn't think MS Works came on an iso image.

A google search for WKSv7std.sbs indicates this is likely to be the file containing Clipart files in the MS Works CD, so it may well be a false positive, however, the iso source would have to be suspect as MS Works isn't distributed in this way.

The only other way to check it would be to pause standard shield (a possible risk) burn the .iso to create a new CD, extract the WKSv7std.sbs file (48.3MB) and scan that to see if it is one clipart files inside that file.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

dmbarry777

  • Guest
Re: Win32:SdBot-3324 [Trj]
« Reply #2 on: March 25, 2006, 03:51:07 PM »
i wrote down that file from avast!4.6 scaning report where it said it could not delete or put in chest. I have no idea what is in that file or where it came from. 

Also I had deleted MsWorks completely from my computar long before this trogan came about or was found by avast;  apparently some files were not completely deleted.

« Last Edit: March 25, 2006, 03:54:00 PM by dmbarry777 »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
Re: Win32:SdBot-3324 [Trj]
« Reply #3 on: March 25, 2006, 04:55:14 PM »
My only thought as to how it came to be there is could the CD0.iso folder be like a system manufactures recovery disk used to restore your system to what it was when you bought it ?
It may have come instead of a windows OS CD.

As I said the reason avast couldn't move or delete it "possibly because it in inside an .iso file that it can't remove it."

If you no longer have MS Works and you can't recall what CD0.iso is, where it came from or how, I would suggest you recover some hard disk space and delete the CD0.iso file completely (what other APPS might be on there isn't know by me, a little program called isobuster should be able to tell you that). However a safer option would be to burn it to a CD so you still have a copy of it if you ever find out what it is for and have a need of it.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

dmbarry777

  • Guest
Re: Win32:SdBot-3324 [Trj]
« Reply #4 on: March 26, 2006, 12:13:25 AM »
Considering the hard disk and RECOVERY,,, each time I try to delete files from there it is LOCKED and says do not delete.

When I try to do a defrag, it says there is not enough free space, needs 15percent to defragment only has 11percent so I wanted to delete unwanted files esp. MS Word . Thanks for your help.


Also, when running avast! virus Cleaner it lists some files it could not scan, should you and how do you delete those??
« Last Edit: March 26, 2006, 12:40:06 AM by dmbarry777 »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
Re: Win32:SdBot-3324 [Trj]
« Reply #5 on: March 26, 2006, 01:14:05 AM »
Many programs (usually security based ones) password protect their files for legitimate reasons such as AdAware and Spybot Search & Destroy, there are others (and avast doesn't know the password or have any way of using it even if it did know it).

When you run scans with the above programs and you delete harmful entries that they detect, a copy is kept (in quarantine/restore/backup) in case you need to reverse what you did. These are usually password protected, you should do some housekeeping and delete old backup/recovery/quarantine entries (older than two weeks or so), this will reduce the numbers of files that can't be scanned.

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.

Files that can't be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned. So there should be an automatic reaction to delete them without investigation.

You should be able to unlock this file to allow for deletion, bearing in mind about what I said about burning a copy first and the warning not to delete (wherever that comes from) - Unlocker http://ccollomb.free.fr/unlocker/ is also good as it also has a few additional features to not only delete the files but stop any process that is stopping you from deleting a file. Youy shouldn't be deleting MS Word if you want to remove a non-essential program you should use add remove programs.

Is defrag correct in its stating that you only have 15% free HDD space and what is the size of your HDD ?
if so you are in need of a huge clean-up, here are two capable of getting rid of temp files and other associated debris - ClearProg - Temp File Cleaner or CCleaner - Temp File Cleaner, etc.. When your HDD gets to within 20% I would say you should be considering a new larger HDD or second HDD and move non essential stuff to that HDD or archive data off it to CD/DVD to clear space.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

dmbarry777

  • Guest
Re: Win32:SdBot-3324 [Trj]
« Reply #6 on: March 26, 2006, 07:21:40 AM »
its in the FAT32 or RECOVERY D drive that it is 11percent of free space left, not the NTFS, C drive that one has  93percent of free space so you see I have very little on the computar. its the recovery locked file that has the 11 percent of free space and it wouln't let me in it. (or I don't know how to get into it when it says it is locked. Understand?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89065
  • No support PMs thanks
Re: Win32:SdBot-3324 [Trj]
« Reply #7 on: March 26, 2006, 03:12:10 PM »
This does sound more and more like a manufactures system recovery setup, however I'm somewhat baffled by the reference to "its in the FAT32 or RECOVERY D drive that it is 11percent of free space left," when the file CD0.iso is in the C: drive ?

So we are now talking about something different to the topic you started. If your system manufacturer set it up this way and has also gone to the trouble of protecting it, breaking that protection and deleting parts of it could royally screw you later if you have any trouble.

What is your system/who made it ?

If that is truly setup by the manufacturer as a Recovery Drive then you shouldn't need to defrag it there should be no activity since creation and no fragmentation. Trying the analyze function first and you would see if it needed defragmentation. The only other option would be to resize the C: partition smaller and increase the D: using a non-destructive tool like Partition Magic. However, as I said I doubt you should need to defragment the D: partition
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33905
  • malware fighter
Re: Win32:SdBot-3324 [Trj]
« Reply #8 on: March 26, 2006, 11:14:55 PM »
Hi dmbarry777,

The solution to the problem lies in the registry. To understand the workings of SD bot, and what some lamers try to achieve, read this tutorial:
http://www.allsyntax.com/tutorials/IRC/6/SD-Bot-Tutorial/2.php
Disinfection instructions can be found here:
http://www.sophos.com/support/disinfection/sdbot.html
greets,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!