MediaMotor, Ad-watch, NTFS, and ADS

[Guest]

Archived from groups: comp.sys.laptops,comp.security.misc,microsoft.public.security.virus (More info?)

I had an interesting thing happen to one of my laptops that I believe I
solved, but I like to hear from others what theories they may have
besides my own. This is a Toshiba 2595XDVD laptop running Windows 2000.
Has AVG and Ad-watch always running.

Well the other day, I opened up the Windows Calculator and Ad-watch
popup reported Malware MediaMotor. Choices were Accept or Block. I chose
the later. I scanned with Ad-aware, clean as a bell. Scanned with AVG,
still nothing detected. Ran Trend Micro's online scanner, nothing. Ran
Spyware Doctor, still nothing. Opened Calculator again and Ad-watch
popped up the message again.

So I did a search about this malware and it appears to redirect your
browser without permission. Although I never had seen this happen. It's
also supposed to have a file named mmups.exe. And it's launched through
the registry under Run. Nothing was found. Interesting to say the least!

I tried to rename calc.exe and it worked. Although another infected
calc.exe reappeared. I deleted it, and it would reappear. Booted to safe
mode under command prompt and I deleted it there. It's now gone. Booted
up Windows 2000 and copied a good calc.exe off of the network. All seems
well now.

So how could the seemingly the only effected file undelete, un-rename,
etc. itself? And also avoid detection until it tried to run? I don't
understand ADS in NTFS very well. But that is the only thing I can think
of. But can ADS executable actually pull off such a feat? Anybody have
of other ideas?


Cheers!


___________________________________________
Bill (using a HP AMD 1.2GHZ & Windows 2000)
-- written and edited within Word 2000

 

[Guest]

Archived from groups: comp.sys.laptops,comp.security.misc,microsoft.public.security.virus (More info?)

From: "BillW50" <BillW50@aol.kom>

|
| I had an interesting thing happen to one of my laptops that I believe I
| solved, but I like to hear from others what theories they may have
| besides my own. This is a Toshiba 2595XDVD laptop running Windows 2000.
| Has AVG and Ad-watch always running.
|
| Well the other day, I opened up the Windows Calculator and Ad-watch
| popup reported Malware MediaMotor. Choices were Accept or Block. I chose
| the later. I scanned with Ad-aware, clean as a bell. Scanned with AVG,
| still nothing detected. Ran Trend Micro's online scanner, nothing. Ran
| Spyware Doctor, still nothing. Opened Calculator again and Ad-watch
| popped up the message again.
|
| So I did a search about this malware and it appears to redirect your
| browser without permission. Although I never had seen this happen. It's
| also supposed to have a file named mmups.exe. And it's launched through
| the registry under Run. Nothing was found. Interesting to say the least!
|
| I tried to rename calc.exe and it worked. Although another infected
| calc.exe reappeared. I deleted it, and it would reappear. Booted to safe
| mode under command prompt and I deleted it there. It's now gone. Booted
| up Windows 2000 and copied a good calc.exe off of the network. All seems
| well now.
|
| So how could the seemingly the only effected file undelete, un-rename,
| etc. itself? And also avoid detection until it tried to run? I don't
| understand ADS in NTFS very well. But that is the only thing I can think
| of. But can ADS executable actually pull off such a feat? Anybody have
| of other ideas?
|
| Cheers!
|
| ___________________________________________
| Bill (using a HP AMD 1.2GHZ & Windows 2000)
| -- written and edited within Word 2000
|


The calculator should be

Please submit "CALC.EXE" to Virus Total --
http/www.virustotal.com/flash/index_en.html
The submission will then be tested against 17 different AV vendor's scanners.

Another way to submit is to send the suspect file to the following email address
scan<at>virustotal.com
{ replace <at> with @ } with only the word SCAN as the subject.

Please post back the EXACT results.


--
Dave
http/www.claymania.com/removal-trojan-adware.html
http/www.ik-cs.com/got-a-virus.htm

 

[Guest]

Archived from groups: comp.sys.laptops,comp.security.misc,microsoft.public.security.virus (More info?)

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:ehi0T9wOFHA.3940@TK2MSFTNGP12.phx.gbl...
Date: Wed, 6 Apr 2005 21:15:42 -0400

The calculator should be

Please submit "CALC.EXE" to Virus Total --
http/www.virustotal.com/flash/index_en.html The submission will
then be tested against 17 different AV vendor's scanners.

Another way to submit is to send the suspect file to the following
email address scan<at>virustotal.com { replace <at> with @ } with
only the word SCAN as the subject.

Please post back the EXACT results.

Hi David... Well that is definitely good to know. Unfortunately, I
toasted the only two infected copies of calc.exe I had. Plus if calc.exe
itself wasn't infected, but had a tag along ADS data as an executable.
The malicious code would never make it across the network anyway. As ADS
only sticks if going from NTFS to NTFS, is my understanding anyway.


Cheers!


___________________________________________
Bill (using a HP AMD 1.2GHZ & Windows 2000)
-- written and edited within Word 2000

 

[Guest]

Archived from groups: comp.sys.laptops,comp.security.misc,microsoft.public.security.virus (More info?)

From: "BillW50" <BillW50@aol.kom>

|
| "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
| news:ehi0T9wOFHA.3940@TK2MSFTNGP12.phx.gbl...
| Date: Wed, 6 Apr 2005 21:15:42 -0400
|
| The calculator should be
|
| Please submit "CALC.EXE" to Virus Total --
| http/www.virustotal.com/flash/index_en.html The submission will
| then be tested against 17 different AV vendor's scanners.
|
| Another way to submit is to send the suspect file to the following
| email address scan<at>virustotal.com { replace <at> with @ } with
| only the word SCAN as the subject.
|
| Please post back the EXACT results.
|
| Hi David... Well that is definitely good to know. Unfortunately, I
| toasted the only two infected copies of calc.exe I had. Plus if calc.exe
| itself wasn't infected, but had a tag along ADS data as an executable.
| The malicious code would never make it across the network anyway. As ADS
| only sticks if going from NTFS to NTFS, is my understanding anyway.
|
| Cheers!
|
| ___________________________________________
| Bill (using a HP AMD 1.2GHZ & Windows 2000)
| -- written and edited within Word 2000
|


Well you can always extract it back from the Win2K CDROM

Assuming the Win2K Distribution CDROM is in Drive "D:"

expand D:\i386\calc.ex_ %windir%\system32\calc.exe

If you extract it from the CDROM and AVG bitches, you will then know it was/is a False
Positive.

That was the objective of Virus Total. Verify the infection or indicate it as a possible
False positive.

--
Dave
http/www.claymania.com/removal-trojan-adware.html
http/www.ik-cs.com/got-a-virus.htm

 

[Guest]

Archived from groups: comp.sys.laptops,comp.security.misc,microsoft.public.security.virus (More info?)

David H. Lipman wrote:

Dave, WTH you doing here?

Slumming?

Ain't no fish here!

--
James

 

[Guest]

Archived from groups: comp.sys.laptops,comp.security.misc,microsoft.public.security.virus (More info?)

From: "JHEM" <James@ESAD.SPAMMERS.thinkpads.com>

| David H. Lipman wrote:
|
| Dave, WTH you doing here?
|
| Slumming?
|
| Ain't no fish here!
|
| --
| James
|

James:

It must be the laptop group that you hang in you ThinkPad you !

The OP crosseed that with the MS Security and Virus News Group where I hang.

And you are right, there ain't no fish here. However, Spring is here and they'll be at the
end of my line real sson.

Tight Lines James !

--
Dave
http/www.claymania.com/removal-trojan-adware.html
http/www.ik-cs.com/got-a-virus.htm