Text 67504, 100 rader
Skriven 2011-12-26 20:14:00 av Ed Vance (8467.windowsa)
Ärende: Malware
===============
For several months I have suspected that I had Malware on my XP SP3 box.

I use a Tripp-Lite UPS and have downloaded their PowerAlert software so
it could shut down my XP box automatically.

I clicked on the PowerAlert icon on the taskbar and clicked on a Help
option to read some about it and Firefox opened with 2 tabs with Errors
on them.

The address on one tab was C:\Program , the second tab's address was
something like Files/TrippLite\,,,,,,\xxx.htm and it was trying to open
a page a www.files.com but there was a Web Of Trust warning over the
page.

Later on I thought to use Agent Ransack to search for www.files.com and
also moc.selif.www and found references to it in a Firefox file called
Places.Sqlite .

I emailed Tripp-Lite Tech Support to ask them if they used www.files.com
and they said they didn't and I must have Malware.

I fooled around with it a bit more and decided to delete Firefox 3.6.24
and use Opera instead.

I tried clicking on the PowerAlert taskbar Help option again and found
that Opera wanted to go to www.files.com .

After using Agent Ransack again to search for any more references to
www.files.com or moc.selif.www and there was some in Documents and
Settings so I first looked at them and saw they referred to Firefox so I
Deleted those files.

I finally decided to Remove the PowerAlert software since I figured if a
power failure happened here I would know it by the lights going out and
I would hear the UPS beeping and I could just shut the computer down
myself.

During all this time I had ran McAfee Security Suite Anti-virus,
MalwareBytes Anti-Malware, SuperAntiSpyware many many times without
finding anything referring to .htm files being associated with
www.files.com .

I also ran Trend Micro Housecall.

I typed ASSOC | MORE at a CMD prompt so I could look at what each
extension was associated with, still didn't find any reference.

Last Thursday 12/23/2011 I was reading a Windows Secrets article by Fred
Langa mentioning to check for Rootkits, so I downloaded Rootkit Buster
from Trend Micro which listed in its report 2712 things that it said
were hidden.

Most of the items in the report had a explanation of Zone.Identifier
for the files.
Thumb.db files had a explanation of Encryptable.

I looked through the entire report using Notepad and saw file names that
I had installed, some file names that came with the system and decided
not to click the Fix button but to just Close RootKit Buster.

I next used a copy of SysInternals Rootkit Revealer that I already had
on my hard drive.

First I use RunAs from my Limited Users Account to run Rootkit Revealer.
When I tried to Save the things it found to a file I got several pop up
windows and after I clicked the OK button on one of them the program
disappered and all I could see was the Desktop.

Next I ran Rootkit Revealer from a Administrative Users Account but it
did the same thing when I tried to Save its report.
But this time I used my Camera to take pictures of the data on the
screen before I clicked the Save option.     ;-)

There were 89 discrepencies found but the file I tried to save the data
to only has 14 Registry entries and 12 files in the Document and
Settings\All Users\ directory showing, thats 26 out of 89 things that
were in the listing.

80% of the items were dated the same day I ran Rootkit Revealer the
second time.

Even though the screen said it was "Cleaning Up" the first time I ran
Rootkit Revealer it "Cleaned Up" another 89 items the second time I ran
it.

For a long time I hadn't made a TI backup because I was wanting to get
everything fixed before I made a backup, but I finally did one on Nov
30th, just to have one.

I've downloaded Avira but haven't installed it yet.
I believe I will have to Disable the McAfee Security Suite before I let
it run because when I ran Trend Micro Housecall McAfee "found" 2 Trojans
in Housecall.   ;-)   ?

Thanks for reading my ramblings.


 * SLMR 2.1a #T348 * Without Time, everything would happen at once.
--- SBBSecho 2.12-Linux
 * Origin: telnet & http://cco.ath.cx - Dial-Up: 502-875-8938 (1:2320/105.1)