Digerati,
Thanks for the quick reply & info.
I downloaded & ran MBAM to no avail. See reports from
1) MBAM &
2) FSecure below:
Thanks again,
HW
1) Recd this
MBAM report:
Malwarebytes' Anti-Malware 1.28
Database version: 1246
Windows 5.1.2600 Service Pack 2
10/9/2008 9:22:49 AM
mbam-log-2008-10-09 (09-22-49).txt
Scan type: Full Scan (C:\|D:\|E:\|F:\|M:\|N:\|)
Objects scanned: 167825
Time elapsed: 1 hour(s), 8 minute(s), 56 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
--------------------------------------------
2) Then
FSecure produced this report:
F-Secure Malware Information Pages: Trojan-Spy:W32/Small.BSL
[Summary] | [Detailed Description]
Name : Trojan-Spy:W32/Small.BSL
Alias: Trojan-Spy.Win32.Small.bsl, Trojan-Spy:W32/DlRhifrem.A
Type: Trojan-Spy
Category: Malware
Platform: W32
Radar
Summary
Trojan-Spy applications are usually standalone programs that allow malicious individuals to monitor activity on infected computers.
Trojan-Spy:Win32.Small.BSL installs a component designed to steal installed certificates.
Back to the Top
Detailed Description
Creates the following registry entries:
* HKEY_CLASSES_ROOT\CLSID\{BD942DA7-96C8-4342-84C6-E2BCFE69FE11}\InprocServer32
(Default) = "C:\WINDOWS\system32\acrobat.dll"
ThreadingModel = "Apartment"
(Using the name, Adobe Acrobat ActiveX Control)
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion
\Explorer\Browser Helper Objects\{BD942DA7-96C8-4342-84C6-E2BCFE69FE11}
NoExplorer = 0x00000001 (1)
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
Adobe Acrobat ActiveX Control = "Rundll32 acrobat.dll,AInit"
It attempts to create the following registry entry:
* HKEY_LOCAL_MACHINE\Software\Acrobat\
"1" = "124.217.x.x" [IP edited by Digerati]
"2" = 0x00000050 (80)
"3" = /NNN/parse.php
It then drops a file into the following folder:
* %windir%\system32\
The dropped file is called acrobat.dll and is 51712 bytes in size.
The malware sets acrobat.dll with a hidden file attribute and changes its date properties to the current system time.
Small.BSL then displays the following fake/decoy dialog message:
When the dialog box is closed the malware will search for and terminate all running Internet Explorer processes. After this, it will launch Internet Explorer as a hidden process which has the malicious component attached.
This malicious component acts like a Browser Helper Object (BHO).
After the user has started Internet Explorer the malware will attempt to communicate with a server located at the following URL:
*
http://124.217.[REMOVED]/NNN/parse.php
The BHO has the following functionality:
* Steals installed certificates
* Deletes user cookie files
* Updates itself
* Deletes files from C:\Documents and Settings
\%username%\Application Data\Macromedia\Flash Player\
* Updates registry information
