Ad-Aware carrying trojans?

In addition to everything already said, I would also download and install (free)  Superantispyware
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

I still run SpyBot, but have replaced Ad-Aware since testing this.

Vic

Others seem to be having similar problem.

http://www.lavasoftsupport.com/index.php?showtopic=3926

Paul

that's an issue about the message about corrupted definition file.....are you getting the same error too?

Thank SheharyaarSaahil, that sounds like good advice.

Downloading super... as we speak. Thanks for the advice.

Paul

SheharyaarSaahil, this happened DURING a scan but it has never happened before and I run Ad-Aware at least weekly.

Paul

you should be worried if its STILL happening....otherwise if it was for once only, then you can forgive the software :)

Perhaps Avast just happened to be looking in Ad-Aware' temp folder while some trojan had been unpacked from a zip or cab on my pc!

Time for a FULL virus scan! :(

Paul

for sure.....but this time in safemode please :)

To be sure it wasnt a 'doctored' definitions file I had just pulled down I downloaded the beta and followed the instructions. Now it has deleted my old definitions and the download of the new one fails!!! :(

Paul

Even stranger!

I just got

27/05/2007      22:01:01      Moved (Clean failed because the file isn't cleanable)       NT AUTHORITY\SYSTEM      SUPERAntiSpywar      C:\RECYCLER\S-1-5-21-2042538849-3001720675-1536069704-1006\Dc5\Tools\Security Exploits\File Forensics\DPWiper\DPWIPER.exe      New Malware.aj (Trojan)
27/05/2007      22:01:03      Moved (Clean failed because the file isn't cleanable)       NT AUTHORITY\SYSTEM      SUPERAntiSpywar      C:\RECYCLER\S-1-5-21-2042538849-3001720675-1536069704-1006\Dc5\Tools\Security Exploits\File Forensics\Portable GetDataBack\GetDataback_for_FAT.exe      New Malware.aj (Trojan)
27/05/2007      22:01:03      Moved (Clean failed because the file isn't cleanable)       NT AUTHORITY\SYSTEM      SUPERAntiSpywar      C:\RECYCLER\S-1-5-21-2042538849-3001720675-1536069704-1006\Dc5\Tools\Security Exploits\File Forensics\Portable GetDataBack\GetDataBack_for_NTFS.exe      New Malware.aj (Trojan)

from McAfee (sorry, I said Avast earlier) but superantispyware hasnt reported anything! Its still scanning!

Looks like McAfee has found the remains of a deleted trojan in the recycler but this must have been left by super...! So somewhere in my cabs and zips is a number of trojans that McAdee can detect but these other systems wont.

My issue still stands. The last thing I did before my system detected this virus was to download a new definitions file from LavaSoft.

Paul

Hey! Hang on! That is McAfee watching Super... check the recycle bin isn't it! Doh!

yeah i agree...that seems like your system is having plenty of junk files :)

All scans finished and clean, at least as far as McAfee and superantispyware are concerned.

The worrying part is this.

0. I havent had a virus hit for more than a year. McAfee is kept up-to-date. I use FireFox with NoScript.
1. McAfee On-Access detected some trojans while Ad-Aware was running. They were found in its temporary folder.
2. McAfee On-Access detected some trojans while super... was running. They were found in the recycle bin.
3. The last thing I did before the trojans were detected was to download a new definitions file for Ad-Aware.
4. Full deep scans by McAfee and super... found nothing lurking anywhere on my system.
5. I havent visited any unusual sites recently.


The Sherlock Holmes principle suggests to me that the trojan came down in the Ad-Aware definition file. I really don't want to be right here.

Paul

I really dont get this! I just ran yet another Ad-Aware full scan and yet again, McAfee found trojans in the Ad-Aware temp folder while it was running! What's going on???

Paul

Do you have the 'hueristics' feature turned on with your McAfee?
It may just be that some of the character strings in your new Ad-Aware defs resemble some malware-like code.

I am running McAfee on one computer with Defs 5039 dated 25 May.

You might want to try using one of the on-line scanners (won't interfere with existing), just for the peace of mind.

On-Line Anti-virus Scan
http://www.trendmicro.com/hc_intro/default.asp
http://www.pandasoftware.com/products/activescan.htm

Vic

Heuristics is switched on. I've checked that I have the latest McAfee defs.

I'm running a HouseCall scan right now.

Sounds good.
I'll be off line for a while, but will check back.

Vic

McAfee showed:

28/05/2007      10:47:33            Engine version                          =      5.1.00
28/05/2007      10:47:33            DAT version                             =      5039
28/05/2007      10:47:33            Number of virus signatures in EXTRA.DAT =      None
28/05/2007      10:47:33            Names of viruses that EXTRA.DAT can detect =      None
28/05/2007      14:03:49      Deleted       PAULSLAPTOP\CaswellP      IEXPLORE.EXE      C:\Documents and Settings\Paul\Local Settings\Temp\V95CJIa05888      Spy-IEen (Trojan)
28/05/2007      14:04:05      Deleted       PAULSLAPTOP\CaswellP      IEXPLORE.EXE      C:\Documents and Settings\Paul\Local Settings\Temp\V95CJIa05888      Generic PWS.f (Trojan)

while HouseCall was running.

HouseCall found 10 infections, failed to clean 3 of them. I am starting another scan.

Paul

Paul - all of those temp files need to be deleted.
I have used CCleaner on hundreds of XP computers without ever having a glitch.
Clean up all of the junk, then try again.

Also (without re-reading everything) do your SuperAS and McAfee scans in Safe Mode. That prevents a lot of processes from starting and results in a much 'deeper' scan.

Vic

yes, and after that can you please download hijackthis from here?
http://www.majorgeeks.com/download3155.html

run it, and click on Scan and Save a Log File,
paste the log file here >> http://www.hijackthis.de/

hit analyse, and the click on Logfile of Hijackthis link where it says "The following analyses has been stored temporarily"
post the link to the log file here please.

HijackThis log here:

http://www.hijackthis.de/logfiles/c988ded7b84d7829f941883ea3205604.html

CCClean complete.

Panda found some AdWare and some trojans but wanted money to remove them. HouseCall found some stuff and failed to fix them. I am feeling a little cynical.

I've run all the scanners I can find with McAfee On-Access switched off. I'm going to start again with OnAcces switched on next.

If there's something in there, why is McAfee not finding it?

Paul

Ask a friend for an AV boot disk, that's your best bet.

Put the cd in your computer in your cd-rom drive and restart{make sure your BIOS boots from cd first}, and scan. TRY An avg-free boot disk...

Oh yes; forgot to mention; be sure to UPDATE the AV you use to make the boot disk PRIOR to making the disk....

i cannot see anything really bad in your log file except that Flashget thingie, if you are are not really addicted to it, i would advise to get rid of it, and go for Orbit >> http://www.orbitdownloader.com/

It looks like I'm all clear now.

I am guessing that something that contained a virus/trojan had been recently deleted and Ad-Aware, just by looking at it, was triggering McAfee.

I still dont understand why McAfee couldnt find it on a deep scan but that is probably another question.

Thanks all for your help, you guy are amazing!! :)

Paul