Author Topic: win32: invo (cryp)  (Read 8191 times)

0 Members and 1 Guest are viewing this topic.

paddyc

  • Guest
win32: invo (cryp)
« on: November 20, 2008, 06:51:07 AM »
Hi I have just started using Avast having previously used AVG -which has become so bloated. My first scan on Avast produced the above virus which was successfully put in the chest. I have done a search for information on this virus but can find nothing listed. I would like to know what the virus did and how serious a problem it was. Can anyone enlighten me?

Ltangelic

  • Guest
Re: win32: invo (cryp)
« Reply #1 on: November 20, 2008, 11:16:33 AM »
Hey,

What was the file name of the virus that gor moved to the chest? I tried researching and found hat it could have been a file called plugger.exe, but most of the research said it was a valid file. I would like to know the name of the file that your Avast found.
« Last Edit: November 24, 2008, 12:04:22 PM by Ltangelic »

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: win32: invo (cryp)
« Reply #2 on: November 20, 2008, 01:58:52 PM »
main scope of this detection is targetted to fake UPS Invoice and similar mail-spread nasties..

CharleyO

  • Guest
Re: win32: invo (cryp)
« Reply #3 on: November 21, 2008, 01:29:26 AM »
***

I had no problem finding information on this one. See this ScanDoo/google search :

http://g.s.scandoo.com/search?hl=en&meta=on&q=win32%3A+invo

Two examples of what Maxx mentioned above :

http://appriver.blogspot.com/2008/11/xwin32invo.html

http://appriver.blogspot.com/2008/11/xwin32invoc.html

Did you get a similar email with a link that you clicked on ... or ... an attachment that you opened?


***

paddyc

  • Guest
Re: win32: invo (cryp)
« Reply #4 on: November 21, 2008, 03:20:35 AM »
HI Guys

Thanks for the posts. I don't know where I could have picked up anything to do with UPS as I have never used a courier service nor have I used anything like eBay. I never open attachments from people I don't know or I am not dealing with.

The file in the Avast chest is local settings/temp internet files/content.IE5/WOYDU8XI.

This is interesting as I seldom use Internet Explorer and I am using version 7.0.573.13 not version 5. Normally I use Firefox 3 unless the web site does not like Firefox.  ???


Ltangelic

  • Guest
Re: win32: invo (cryp)
« Reply #5 on: November 21, 2008, 02:48:45 PM »
Hey paddyc,

The file in the Avast chest is local settings/temp internet files/content.IE5/WOYDU8XI.

That is the folder name which contains the virus file, not the actual virus file name. The file should have an extension like. exe or .dll.
« Last Edit: November 24, 2008, 12:05:15 PM by Ltangelic »

paddyc

  • Guest
Re: win32: invo (cryp)
« Reply #6 on: November 21, 2008, 03:58:33 PM »
Sorry Ltangelic - the file name was ._file[1].exe. I did say I was new to this! I thought that was a made up file name that Avast had applied.

Ltangelic

  • Guest
Re: win32: invo (cryp)
« Reply #7 on: November 22, 2008, 03:37:09 PM »
Sorry Ltangelic - the file name was ._file[1].exe. I did say I was new to this! I thought that was a made up file name that Avast had applied.

Thanks, that lead me to this result:

http://spywarefiles.prevx.com/spywarefiles.asp?FXC=GFAD44951692

It is a backdoor trojan, which means the trojan author can control and monitor your computer at another server. If you have been using the administrator account on your computer all this while, you are also giving the same ability to the trojan author. Backdoor trojans are pretty dangerous, with full control of your computer, the trojan author can do almost anything to your computer, including modifying system settings, installing more malware files, using your computer as a bot to send spam emails, collect personal information ranging from online account details to bank passwords. etc. Read this article here:

http://www.geekstogo.com/2007/10/03/what-is-a-backdoor-trojan/

I would seriously advice you to reformat your computer. That is the only sure way to ensure that your computer is completely clean. Backup all your documents before reformatting. If you decide to reformat, please do so and come back on here and I'll give you some recommendations to keep your computer malware free. :)
« Last Edit: November 24, 2008, 12:05:51 PM by Ltangelic »

paddyc

  • Guest
Re: win32: invo (cryp)
« Reply #8 on: November 23, 2008, 02:18:39 AM »
Thanks for coming up with this info Ltangelic!

With a trojan this serious I have to ask why AVG 8 failed to pick it up. I ran AVG religiously updating every day and ensured that shield was always in place. I switched to Avast because the AVG scan was taking nearly 4+ hours to process. The Avast scan took a little under an hour and picked this up immediately. Shows how useless the AVG program has become.

I have run Spy Bot and adaware and both of these have come up clean.  I have also run superantispyware and malwarebytes and they only found small adware problems in the registry which have been cleared as spybot and adware did not pick anything up. I should mention that I am also running Spy Blaster and I am using Zone Alarm as my firewall.

I had not noticed anything unusual other than the machine was running slower and that seems to have improved and Freeram is reporting that I have about 750m available out of my 1g when before it was about 500m.

I should mention that I do have a problem with Avast continuing to report a suspicious file that does not exist C:\windows\system32\taskmon.exe. I had reported this as a separate thread but now I am beginning to wonder if they are related. The other thread is

http://forum.avast.com/index.php?topic=40276.0

I am reluctant to do a reformat as the only copy of windows xp that I have is about 5 years old and it will take for ever to get the updates downloaded and actioned. Even if I back up my data is it not likely I would carry over any bugs anyway? Is it possible to monitor the system for a while to see if it is clean?

Re changing password via a clean computer would my laptop be acceptable given that it would be linked on the same lan and is capable of sharing the same files as my desktop?

Ltangelic

  • Guest
Re: win32: invo (cryp)
« Reply #9 on: November 23, 2008, 01:59:43 PM »
Hey paddyc,

Some backdoor trojans are very good at hiding themselves from anti-virus detections. I'm not really sure whether Avast's detection is better or AVG8's better, but I do think that AVG has fallen significantly in quality since the company combined AVG anti-spyware and anti-virus into a commercial pack.

Spybot has been a very good program, but unfortunately, it is becoming outdated with the speed of the emergence of all kinds of malware. It's definitions are not as updated as it was, not to blame the author of Spybot, but how fast malware are being written. Ad-aware, in my opinion, is only good with its paid version. Since Ad-Aware SE personal expired, Ad-aware has been full of problems, at least it is for me. The problem is, Ad-aware in its free version does NOT provide protection against spyware and adware (it's merely a scanner), but Spybot does.

You made a very good choice putting Zonealarm, Spywareblaster, MBAM (Malwarebytes' Anti-Malware) and SUPERAntispyware on your computer. These are probably the best combination of softwares that you can have. But both MBAM and SUPERAntispyware only provide resident protection against spyware in their paid versions, so if you want the maximum protection, I would suggest that you spend on MBAM and enable its full version protection. I think MBAM is worth the expenses, its wonderful both in its free and paid version. I would also say that using Firefox 3.0.4 and installing McAfee Siteadvisor would enhance your protection. Firefox is much faster and safer, and McAfee Siteadvisor warns you before you visit any malicious sites. McAfee Siteadvisor is installed as an add-on in Firefox.

Just to share with you what I'm running on my computer: Avast, Comodo pro free firewall, MBAM, Spywareblaster, McAfee Siteadvisor and Spybot. My computer has been without serious infections for months since I installed them. (Only an occasional malware sneak past my protection layer, but I detect them almost immediately because I run analysis tools like RSIT and ComboFix often. Though, I'm not advising you to run RSIT and ComboFix because they are complex tools that can mess up your computer if you don't know what you are doing.)

taskmon.exe is a valid system application, either it could be a False Positive from Avast, or a hidden malware is using it to do things that you don't know. I would advise you not to do anything to that file at the moment and post a HijackThis log in one of the following free tech help sites and let a malware removal expert help you:

http://www.bleepingcomputer.com/forums/
http://www.geekstogo.com/forum/
http://www.techsupportforum.com/

Many of them have a specific forum for HijackThis log analysis, look for these forums, register an account and follow the instructions given to post your log. Just post ONE log in ONE of the above forums, don't post at multiple forums or post multiple topics regarding a similar issue. The experts there are all busy people, wait patiently for a reply. These forums usually have a place to raise your thread to the experts' attention if it hasn't been looked at for a certain period of time (usually 3 to 5 days). Look for these places if your problem has not been looked at for an extended time period.

Yah changing your password on a clean computer is probably the most important thing you need to do, don't use the infected computer for any online commercial at the moment. Get it cleaned at one of the forums I've suggested, and then look at the advises given by the expert. It is almost guaranteed that a computer can never be 100% clean even with the most updated and powerful protection package, but there are some measures that you can adopt to minimise the possibilities. The reason for having protection softwares is not just to remove any malware that sneaks in, but also to alert the user of a possible infection. Be on your guard, and take actions promptly when something goes wrong, that's the best thing you can do. :)

« Last Edit: November 24, 2008, 12:06:05 PM by Ltangelic »

paddyc

  • Guest
Re: win32: invo (cryp)
« Reply #10 on: November 23, 2008, 04:19:47 PM »
Hi Ltangelic,

Thanks for the sound advice. Since I am already using Firefox I will check out the Macafee advisor and instal that as well. Is Comodo a better option than Zone Alarm?

Finally you never said if my laptop would be clean enough to change passwords. I am not too concerned about bank accounts as mine need a separate dongle and for you to enter a changing number before you can access. All internet banks should have this facility.

Keep up the good work and again thanks.


Paddy c

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: win32: invo (cryp)
« Reply #11 on: November 23, 2008, 08:49:20 PM »
Is Comodo a better option than Zone Alarm?
If it works in your computer, sure it is better.
Personal Firewall Tests & Results. Firewall rating:
http://www.matousec.com/projects/firewall-challenge/results.php
The best things in life are free.

Ltangelic

  • Guest
Re: win32: invo (cryp)
« Reply #12 on: November 24, 2008, 11:34:15 AM »
Hey paddyc,

Comodo is a very good firewall, but it is harder to configure than Zonealarm. Comodo do provide a stronger protection, but if you are not very familiar with firewalls, keeping Zonealarm as your primary choice would be better. When I first installed Comodo, I have a lot of problems because it keeps warning me whenever I install or uninstall a software, it can get pretty annoying. But I managed to configure it to make it less troublesome to use.

You can test out Comodo on any other computer you may have and get used to the features before you use it. The laptop with the taskmon.exe warning is definitely not safe to use and I can assure you that there's something malicious running in the background, but I'm not really sure about the other computer that you mentioned earlier on. As I have said, you can go to one of the forums I suggested and let a malware removal expert clean your computer before you use it to do any online business. You should inform the online banks that your bank account details might have been leaked out and ask them to keep an eye out for any suspicious transfers of money in or out of your account. It would be best that you actually go to the banks to change your bank password instead of changing it online.

I'm not sure how the changing number thing works, but whatever that has been typed from your keyboard would have been made known to the backdoor trojan author, so whether there's a changing number or not doesn't really make it safer as long as your password gets leaked.


« Last Edit: November 24, 2008, 12:06:20 PM by Ltangelic »

Ltangelic

  • Guest
Re: win32: invo (cryp)
« Reply #13 on: November 24, 2008, 01:34:46 PM »
Hey paddyc,

I just realised I missed something important about the taskmon.exe that you are alerted of. It is located in system32, which means it is actually a type of worm. The legit taskmon.exe is located in C:\Windows folder and is usually not found on an XP computer. Look at this:

http://www.bleepingcomputer.com/startups/taskmon.exe-5665.html

You can let Avast quarantine it right away.