Solved

Pushdo Trojan? Same as HackTool.ADRN?

Posted on 2013-06-15
9
1,382 Views
Last Modified: 2013-11-22
I clicked on a certain link this morning and received this message:
Access has been blocked.
Your IP [190.233.117.82] is found at Spamhaus .
If you feel this is incorrect please contact them.

So I visited Spamhaus and this is what I found:

http://www.spamhaus.org/query/ip/190.233.117.82
The first red link on the above page says my machine is sending emails.
The second red link on the above page says :
IP Address 190.233.117.82 is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.

It was last detected at 2013-06-14 00:00 GMT (+/- 30 minutes), approximately 1 days, 13 hours, 30 minutes ago.

This IP address is infected with, or is NATting for a machine infected with Pushdo. Pushdo is a DDOS trojan - meaning that it was (at least of the timestamp given above) participating in a HTTP-based (web protocol) distributed denial of service attack on web server[s].

Pushdo is usually associated with the Cutwail spam trojan, as part of a Zeus or Spyeye botnet. Together, this provides the attacker with DDOS, email spam, and information theft capabilities. This is something you really want to get rid of. But remember, we detected this specifically by the DDOS traffic to a web server.

And it gives this as a reference link:
http://www.theregister.co.uk/2012/09/19/pushdo_spews_fake_traffic/

I just ran a full scan with AVG. (My last scan was 2 days ago.) The new scan found and removed an infection (in 4 files), but it did't call it Pushdo trojan. It is HackTool.ADRN. Same thing, or am I still infected with Pushdo?
0
Comment
Question by:Missus Miss_Sellaneus
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 
LVL 24

Accepted Solution

by:
aadih earned 500 total points
ID: 39250184
These two infections are different.

To make sure, run malwarebytes antimalware (free) and TDSSKiller.

Or, restore your PC to a date before the infections.
0
 
LVL 12

Author Comment

by:Missus Miss_Sellaneus
ID: 39250348
Malwarebytes found the following and removed it:

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.

TDSSKiller found nothing.
0
 
LVL 12

Author Comment

by:Missus Miss_Sellaneus
ID: 39250350
I don't know long I've been infected, so wouldn't know how far back to restore my PC.
0
IoT Devices - Fast, Cheap or Secure…Pick Two

The IoT market is growing at a rapid pace and manufacturers are under pressure to quickly provide new products. Can you be sure that your devices do what they're supposed to do, while still being secure?

 
LVL 24

Expert Comment

by:aadih
ID: 39250353
Well, create a restore point at this point in time.

And, keep using your PC, which seems to be clean now, until you notice any undesirable occurrences.

One note, however:  Just check in the list of installed programs, any that you don't recognize; uninstall or disable form starting up any that you don't recognize. Inspect also all start up programs.  Thanks.
0
 
LVL 12

Author Comment

by:Missus Miss_Sellaneus
ID: 39250371
You say my PC seems to be clean now, but nothing yet has detected Pushdo, which supposedly was on my machine less than 2 days ago.  As far as I can tell, PUM.Hijack.StartMenu isn't the same as Pushdo.
0
 
LVL 24

Expert Comment

by:aadih
ID: 39250375
Note: In many cases, a PUM, Potentially Unwanted Modification, is a false positive.
0
 
LVL 12

Author Comment

by:Missus Miss_Sellaneus
ID: 39250559
Now I've run SpyHunter which found 2 different malware toolbars that weren't found by AVG or MalwareBytes. But I still haven't been able to detect Pushdo which must still be on here.

Everything I'm reading online tells me that Pushdo is very hard to detect but I'd really like to find a program that can detect Pushdo's presence before I restore to an earlier point so I can check that it's really gone after the restore.

I've set up Windows Firewall to log all connections, I might be able to use that to detect traffic from Pushdo by looking for connections made when I'm not using the internet.
0
 
LVL 24

Expert Comment

by:aadih
ID: 39250568
Make sure your AVG is updated and running all the time.
0
 
LVL 24

Expert Comment

by:aadih
ID: 39250606
If you see pushdo come back, use Kaspersky Rescuedisk (to boot from, scan, and clean).

http://support.kaspersky.com/us/viruses/rescuedisk >

You may like to keep a copy handy.

And here is how to keep its data updated:

https://github.com/bbalegere/Kaspersky-Rescue-Disk-Updater/ >
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question