Malware Removal Forums

Symantec suddenly starting to find unnamed trojan horses

lithiumus · 2009-12-08T13:06:05+00:00

Symantec Anti-Virus started to detect "trojan horses" and quarantining legitimate exe's on my laptop. The trojan horses found by symantec were unammed so I'm assuming possible malware. I work in IT Security and do research on bad domains and sometimes get redirected to bad sites. Will need to consider a virtual instance for stuff like this in the future... Thank you in advance! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:58:17 AM, on 2009-12-08 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16915) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\WiFi\bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common F

25 min read

lithiumus

December 21, 2009, 3:48 PM UTC

I went through my Archive folders and simply deleted everything (why take a chance)... I emptied the deleted folders, compacted it and verified that the archive folder size is now 0.

I'm performing another Kaspersky scan now. Below are the entries from the Symantec Risk log. I can't access the "System Volume Information" directories...

Risk	Action	Filename	Original Location	Logged By	Date

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:48

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.5b4dcc.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:45

Trojan Horse	Quarantined	A0021314.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP250\	Auto-Protect scan	2009-12-08 1:12

Trojan Horse	Quarantined	surcodedvd.exe	C:\Program Files\Minnetonka Audio Software\SurCode DVD DTS\	Auto-Protect scan	2009-12-07 20:37

Trojan Horse	Partial	surcodedvd.exe	c:\program files\minnetonka audio software\surcode dvd dts\	Defwatch Scan	2009-12-07 9:30

Trojan Horse	Quarantined	A0019756.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP229\	Scheduled scan	2009-11-18 1:08

Trojan Horse	Quarantined	A0018122.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP212\	Scheduled scan	2009-11-04 10:42

Trojan Horse	Quarantined	A0016443.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP204\	Scheduled scan	2009-10-28 1:10

Trojan Horse	Quarantined	TeamViewer_Setup.exe	C:\Documents and Settings\glau\My Documents\Personal\Software\	Scheduled scan	2009-10-28 1:04

Trojan Horse	Quarantined	TeamViewer_Setup.exe	C:\Documents and Settings\glau\Desktop\Software\Installed\	Scheduled scan	2009-10-28 1:02

Trojan Horse	Quarantined	A0016178.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP199\	Auto-Protect scan	2009-10-23 0:43

deltalima

December 21, 2009, 10:00 PM UTC

Hi lithiumus,

The "System Volume Information" directories are special hidden system folders where the files and other data required to perform System Restore and cannot be accessed via Windows Explorer.

I will give you some instructions (once we have decided that your system is clean) to clear out this folder to ensure nothing remains in there.

ESET online scannner

Please go Here then click on:

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Now click on:
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on:
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Carolyn

December 25, 2009, 7:58 PM UTC

a lack of response,