MediaMotor, Ad-watch, NTFS, and ADS

[Guest]

Archived from groups: alt.games.microsoft.flight-sim (More info?)

I posted the below on more appropriate newsgroups yesterday. Although I
have to admit, the smartest people seem to hang out in here. So here's
my story!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I had an interesting thing happen to one of my laptops that I believe I
solved, but I like to hear from others what theories they may have
besides my own. This is a Toshiba 2595XDVD laptop running Windows 2000.
Has AVG and Ad-watch always running.

Well the other day, I opened up the Windows Calculator and Ad-watch
popup reported Malware MediaMotor. Choices were Accept or Block. I chose
the later. I scanned with Ad-aware, clean as a bell. Scanned with AVG,
still nothing detected. Ran Trend Micro's online scanner, nothing. Ran
Spyware Doctor, still nothing. Opened Calculator again and Ad-watch
popped up the message again.

So I did a search about this malware and it appears to redirect your
browser without permission. Although I never had seen this happen. It's
also supposed to have a file named mmups.exe. And it's launched through
the registry under Run. Nothing was found. Interesting to say the least!

I tried to rename calc.exe and it worked. Although another infected
calc.exe reappeared. I deleted it, and it would reappear. Booted to safe
mode under command prompt and I deleted it there. It's now gone. Booted
up Windows 2000 and copied a good calc.exe off of the network. All seems
well now.

So how could the seemingly the only effected file undelete, un-rename,
etc. itself? And also avoid detection until it tried to run? I don't
understand ADS in NTFS very well. But that is the only thing I can think
of. But can ADS executable actually pull off such a feat? Anybody have
of other ideas?


Cheers!


___________________________________________
Bill (using a HP AMD 1.2GHZ & Windows 2000)
-- written and edited within Word 2000

 

[Guest]

Archived from groups: alt.games.microsoft.flight-sim (More info?)

Sounds like:
W32.HLLC.Happylow
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllc.happylow.html
You must have a setting in AVG that caused it to miss it.
eTrust and Norton do detect it.

--
....Carl Frisk
Anger is a brief madness.
- Horace, 20 B.C.
http://www.carlfrisk.com


"BillW50" <BillW50@aol.kom> wrote in message news:Bye5e.5856$gF5.2242@newssvr30.news.prodigy.com...

I posted the below on more appropriate newsgroups yesterday. Although I
have to admit, the smartest people seem to hang out in here. So here's
my story!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I had an interesting thing happen to one of my laptops that I believe I
solved, but I like to hear from others what theories they may have
besides my own. This is a Toshiba 2595XDVD laptop running Windows 2000.
Has AVG and Ad-watch always running.

Well the other day, I opened up the Windows Calculator and Ad-watch
popup reported Malware MediaMotor. Choices were Accept or Block. I chose
the later. I scanned with Ad-aware, clean as a bell. Scanned with AVG,
still nothing detected. Ran Trend Micro's online scanner, nothing. Ran
Spyware Doctor, still nothing. Opened Calculator again and Ad-watch
popped up the message again.

So I did a search about this malware and it appears to redirect your
browser without permission. Although I never had seen this happen. It's
also supposed to have a file named mmups.exe. And it's launched through
the registry under Run. Nothing was found. Interesting to say the least!

I tried to rename calc.exe and it worked. Although another infected
calc.exe reappeared. I deleted it, and it would reappear. Booted to safe
mode under command prompt and I deleted it there. It's now gone. Booted
up Windows 2000 and copied a good calc.exe off of the network. All seems
well now.

So how could the seemingly the only effected file undelete, un-rename,
etc. itself? And also avoid detection until it tried to run? I don't
understand ADS in NTFS very well. But that is the only thing I can think
of. But can ADS executable actually pull off such a feat? Anybody have
of other ideas?


Cheers!


___________________________________________
Bill (using a HP AMD 1.2GHZ & Windows 2000)
-- written and edited within Word 2000

 

[Guest]

Archived from groups: alt.games.microsoft.flight-sim (More info?)

"Carl Frisk" <c.frisk@REMOVE.verizon.net> wrote in message
news:drI5e.3447$H_5.3389@trnddc01...
Date: Sat, 09 Apr 2005 04:00:09 GMT

Sounds like:
W32.HLLC.Happylow
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllc.happylow..html
You must have a setting in AVG that caused it to miss it.
eTrust and Norton do detect it.

Hi Carl... Not a bad guess, but both AVG and Trend Micro scans should
have picked that old one up. Also that virus leaves all of those .wal
extensions around anyway. And I don't have any of those. Funny thing
that Ad-watch and Ad-aware uses the same definitions. Yet Ad-aware
didn't see it, but Ad-watch did.

Although a guy I know from the UK who works on commercial flight
simulators told me that Windows 2000, XP and he thinks even ME, will
restore some files on it's own. I've never heard of this before! So I
tried it on another Windows 2000 system here and sure enough, rename or
delete calc.exe and a new one pops up like within a second. So the virus
or malware had nothing to do with it at all.

I don't know how Windows pulls out another copy out of its hat? But if I
had to guess, there are copies of calc.exe and others in the dllcache
folder. So maybe that is where the OS gets them. All I can say for sure
is the learning curve just never ends. <grin>


Cheers!


___________________________________________
Bill (using a HP AMD 1.2GHZ & Windows 2000)
-- written and edited within Word 2000

 

[Guest]

Archived from groups: alt.games.microsoft.flight-sim (More info?)

You are correct in the restore for XP and 2000. I refuse to have anything to do with ME and avoid anything to do with
it like the plague.

If you've got current definitions for you anti virus it shouldn't be a problem AND you have done a FULL virus scan
including alternate data paths. Takes a lot longer but does the full job.

There are actually a lot of new variants that play with calc.exe released over the last few months. I haven't heard of
anything brand new though. Windows will restore any missing operating files from it's cache. This is where modern
viruses head for, the cache that windows uses to restore from. Sounds more like you have a bot problem that has gotten
into your registry. Make sure you are doing full scans of everything, not just incremental or smart scans.

--
....Carl Frisk
Anger is a brief madness.
- Horace, 20 B.C.
http://www.carlfrisk.com


"BillW50" <BillW50@aol.kom> wrote in message news:FIT5e.22363$A65.21984@newssvr31.news.prodigy.com...

"Carl Frisk" <c.frisk@REMOVE.verizon.net> wrote in message
news:drI5e.3447$H_5.3389@trnddc01...
Date: Sat, 09 Apr 2005 04:00:09 GMT

Sounds like:
W32.HLLC.Happylow
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllc.happylow.html
You must have a setting in AVG that caused it to miss it.
eTrust and Norton do detect it.

Hi Carl... Not a bad guess, but both AVG and Trend Micro scans should
have picked that old one up. Also that virus leaves all of those .wal
extensions around anyway. And I don't have any of those. Funny thing
that Ad-watch and Ad-aware uses the same definitions. Yet Ad-aware
didn't see it, but Ad-watch did.

Although a guy I know from the UK who works on commercial flight
simulators told me that Windows 2000, XP and he thinks even ME, will
restore some files on it's own. I've never heard of this before! So I
tried it on another Windows 2000 system here and sure enough, rename or
delete calc.exe and a new one pops up like within a second. So the virus
or malware had nothing to do with it at all.

I don't know how Windows pulls out another copy out of its hat? But if I
had to guess, there are copies of calc.exe and others in the dllcache
folder. So maybe that is where the OS gets them. All I can say for sure
is the learning curve just never ends. <grin>


Cheers!


___________________________________________
Bill (using a HP AMD 1.2GHZ & Windows 2000)
-- written and edited within Word 2000