Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Found Trojan attached to Java file


  • Please log in to reply
3 replies to this topic

#1 John25

John25

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 03 October 2010 - 07:26 PM

I am running Vista OS (32 bit) and Kaspersky Ver 7.0.1.325 anti-virus supplied by Earthlink. I have my router password protected(WPA-TKIP).

I have MBAM and SAS that I update every few days.

Normally I do not perform full-scans as they take so long so complete.

Tonight, I performed a full scan and found a report of (2) Trojans that had infected files. KAS gave me 2 choices; delete the files or ignore. I do not know how long they have been there. I terminated them, rebooted, and they did not show up in the next full scan.

See Kaspersky log below:

Infected: Trojan program Exploit.Java.Agent.ar c:\users\owner\appdata\locallow\sun\java\deployment\cache\6.0\35\37f71d23-6f2c3681 7.6 KB
Infected: Trojan program Trojan-Downloader.Java.Agent.fe c:\users\owner\appdata\locallow\sun\java\deployment\cache\6.0\15\62d2e58f-174a93d4 14.1 KB


I ran MBAM and SAS. MBAM found nothing.
SAS found 4 cookies that I left alone.

Do I need to do anything more to ensure that the computer is clean? I do use it for banking purposes.

Following are the MBAM and SAS reports.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4736

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

10/3/2010 6:06:01 PM
mbam-log-2010-10-03 (18-06-01).txt

Scan type: Full scan (C:\|)
Objects scanned: 250323
Time elapsed: 56 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/03/2010 at 07:04 PM

Application Version : 4.40.1002

Core Rules Database Version : 5623
Trace Rules Database Version: 3435

Scan type : Complete Scan
Total Scan Time : 00:41:48

Memory items scanned : 391
Memory threats detected : 0
Registry items scanned : 17208
Registry threats detected : 0
File items scanned : 39830
File threats detected : 4

Adware.Tracking Cookie
cdn2.invitemedia.com [ C:\Users\owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\S9BB2PMT ]
content.yieldmanager.edgesuite.net [ C:\Users\owner\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\S9BB2PMT ]
C:\Users\owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@casalemedia[2].txt
C:\Users\owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@revsci[1].txt

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:49 PM

Posted 04 October 2010 - 09:16 AM

When a browser runs an applet, the Java Runtime Environment (JRE) stores the downloaded files into its cache folder (C:\Documents and Settings\username\Application Data\Sun\Java\Deployment\cache) for quick execution later and better performance. Malicious applets are also stored in the Java cache directory and your anti-virus may detect them and provide alerts. Notification of these files as a threat does not always mean that a machine has been infected; it indicates that a program included the viral class file but this does not mean that it used the malicious functionality. However, when alerted to this type of threat, it's a good practice to clear the Java cache and clean out Windows temporary files.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 John25

John25
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:09:49 PM

Posted 04 October 2010 - 06:07 PM

I used ATF to clear those directories.

Reran Kaspersky and found nothing.

Thanks for your explanation.
John

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:49 PM

Posted 05 October 2010 - 06:59 AM

You're welcome.

:thumbsup: Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, uTorrent). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs and infections install themselves, read How Malware Spreads - How did I get infected.

Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend you disable Autorun asap as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
How to Maximize the Malware Protection of Your Removable Drives

Security Resources from Microsoft:Other Security Resources:Browser Security Resources:Finally, if you need to replace your anti-virus, firewall or need a reliable anti-malware scanner please refer to:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users