Author Topic: Viruses found (Read 7138 times)

spg SCOTT · « **on:** January 03, 2009, 11:15:37 PM »

Currently doing a standard scan with avast and it found these, all are safely within the chest, so no problems:

03/01/2009 19:49:48   xxxxxxxxx   3060   Sign of "Win32:VB-IE [Wrm]" has been found in "C:\Documents and Settings\xxxxxxxxx\Shared\PDF-File PDF Converter 1.zip\Setup.exe" file.

03/01/2009 20:58:06   xxxxxxxxx   3060   Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Qoobox\Quarantine\[4]-Submit_2008-10-13@17.56.zip\hojyr.exe" file.

03/01/2009 21:00:37   xxxxxxxxx   3060   Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Qoobox\Quarantine\[4]-Submit_2008-10-13@17.56.zip\luconnuj.exe" file.

The xxxxxxxx refers to the user name, it is not mine but the previous owner of the computer, (I don't think that they want their name on the internet, go figure) which is odd because I have changed that previously but all of the documents and settings still bear the original name, but the user name at the welcome screen is mine.

The last two, from what i can gather on the internet are from the quarantine folder of ComboFix, I used this to eradicate these files previously when infected, this has, for some time been gone from my system

The first one though, is confusing, because I have never even looked in that folder, or been in there until now and I don't know what it is from.

I will submit the files to Alwil, but I think that they have already had the last two, and I'm pretty sure a I'm clean now

The odd thing with this scan is that the scanner has reached 39% and has been there for some time now but is still scanning and has scanned nearly 450 000 files, is this right?

One last thing, I don't know whether this is relevant, but my computer always turns back on when I shut down or even Hibernate, which is a pain, but hey gotta live with it...

Lisandro · « **Reply #1 on:** January 03, 2009, 11:23:52 PM »

Quote from: spg SCOTT on January 03, 2009, 11:15:37 PM

The odd thing with this scan is that the scanner has reached 39% and has been there for some time now but is still scanning and has scanned nearly 450 000 files, is this right?

If the scanning is not frozen, it's right...

Quote from: spg SCOTT on January 03, 2009, 11:15:37 PM

One last thing, I don't know whether this is relevant, but my computer always turns back on when I shut down or even Hibernate, which is a pain, but hey gotta live with it...

Do you mean the computer restart instead of shutting down or hibernate?

spg SCOTT · « **Reply #2 on:** January 03, 2009, 11:31:17 PM »

Quote from: Tech on January 03, 2009, 11:23:52 PM

Do you mean the computer restart instead of shutting down or hibernate?

When I tell it to shut down it restarts... and even if I hold the power button it still does it, and I have to do it again, so yes

It's a fairly old computer that is just about surviving, could be something to do with the electrics failing after so long, I mean I had to disconnect two usb ports earlier because I discovered a broken one was shorting out something and the computer was turning off

what do you think about the user name issue though?

polonus · « **Reply #3 on:** January 03, 2009, 11:57:47 PM »

The name inicates it is a worm. Worms replicate and spread usually via Network protcocols, email, Peer-2-Peer (P2P) software and a few other methods.

I suggest using the following tool to scan your computer.

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm

polonus

spg SCOTT · « **Reply #4 on:** January 04, 2009, 12:15:39 AM »

Quote from: polonus on January 03, 2009, 11:57:47 PM

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It's probably me but I cannot find the file you suggest to download,

Quote from: polonus on January 03, 2009, 11:57:47 PM

Additional Instructions:
http://pcdid.com/Multi_AV.htm

This link doesn't work, I get a "DNS error - cannot find server."

polonus · « **Reply #5 on:** January 04, 2009, 12:42:54 AM »

DavidR · « **Reply #6 on:** January 04, 2009, 12:45:20 AM »

1. I think the setup.exe might be an FP, so you should check it, see below.

2. This is the ComboFix's Quarantine area, C:\Qoobox\Quarantine\
However, it does surprise me that the quarantine area isn't protected encrypted, etc. so other scanners don't detect what effectively has been dealt with. So I would suggest you clear the quarantine area as basically a) they are old and b) avast is also confirming the original combofix detection.

So the only file that should be sent to avast is setup.exe if it is confirmed an FP.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect\* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

spg SCOTT · « **Reply #7 on:** January 04, 2009, 01:04:43 AM »

DavidR, thanks for confirming

Quote from: DavidR on January 04, 2009, 12:45:20 AM

1. I think the setup.exe might be an FP, so you should check it, see below.

2. This is the ComboFix's Quarantine area, C:\Qoobox\Quarantine\
However, it does surprise me that the quarantine area isn't protected encrypted, etc. so other scanners don't detect what effectively has been dealt with. So I would suggest you clear the quarantine area as basically a) they are old and b) avast is also confirming the original combofix detection.

1. Avast still is scanning but once it is done I will check it at VT
2. That's one of the reasons why I posted, I thought that it would have been encrypted but, as they are in the chest, does that mean that they are not in the quarantine folder anymore?

Polonus, Thanks for the reply.
The second link you gave me worked and I have It downloaded and when avast is finished, or maybe tomorrow, I will have a look at it

spg SCOTT · « **Reply #8 on:** January 04, 2009, 12:13:32 PM »

I have uploaded the file to VT

http://www.virustotal.com/analisis/e9eb1d17f565d51a886972658928a560

12 of 38

AntiVir   7.9.0.45   2009.01.04   Worm/Rbot.174080

Authentium   5.1.0.4   2009.01.03   W32/CodeCru-based!Maximus

Avast   4.8.1281.0   2009.01.03   Win32:VB-IE

eTrust-Vet   31.6.6289   2009.01.02   Win32/Alcan.I!ZIP

F-Prot   4.4.4.56   2009.01.03   W32/CodeCru-based!Maximus

Fortinet   3.117.0.0   2009.01.04   W32/VB.DW!p2p

GData   19   2009.01.04   Win32:VB-IE

Norman   5.80.02   2009.01.02   W32/Solo.A

PCTools   4.4.2.0   2009.01.03   Backdoor.IRCBot.DD

SecureWeb-Gateway   6.7.6   2009.01.04   Worm.Rbot.174080

Sophos   4.37.0   2009.01.04   Mal/HckPk-A

VirusBuster   4.5.11.0   2009.01.03   Worm.P2P.VB.CIY

I don't think it is an FP

EDIT:
Polonus,
Have tried the program you suggested but can't download the files from it
I get the error: bad file descriptor, on all of the options

GrizeBar · « **Reply #9 on:** January 04, 2009, 03:09:41 PM »

Run Combofix, then upload the Log file text to this thread for analysis and recommendation.

Download: http://www.combofix.org/download.php

Tutorial: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

DavidR · « **Reply #10 on:** January 04, 2009, 04:55:09 PM »

Quote from: spg SCOTT on January 04, 2009, 12:13:32 PM

I have uploaded the file to VT

http://www.virustotal.com/analisis/e9eb1d17f565d51a886972658928a560

12 of 38
<snip>
I don't think it is an FP

Nor do I it appears to be a good detection, on occasion setup files get pinged because of what they do, that is however more commonly by the generic signatures like win32:trojan-gen, which wasn't the case here. So it looks like there were some unwelcome gifts in this PDF Converter.

Author Topic: Viruses found (Read 7138 times)

spg SCOTT

Viruses found

Lisandro

Re: Viruses found

spg SCOTT

Re: Viruses found

polonus

Re: Viruses found

spg SCOTT

Re: Viruses found

polonus

Re: Viruses found

DavidR

Re: Viruses found

spg SCOTT

Re: Viruses found

spg SCOTT

Re: Viruses found

GrizeBar

Re: Viruses found

DavidR

Re: Viruses found