|
Posted by Daave on April 8, 2007, 4:37 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Daave wrote:
> Okay, this is a new one.
>
> (I'm running 98 SE)
>
> On a whim, I decided to do the Symantec online virus scan. The
> message:
>
> Your computer is infected with at least one known virus or Trojan
> horse.
>
> c:\WINDOWS\SYSTEM32\msmsgre.dll is infected with Trojan Horse
>
> ---------------------------------------------------------------
>
> Interestingly, there's no mention *anywhere* on symantec.com of
> msmsgre.dll!
>
> I then decided to visit http://virusscan.jotti.org/ for more opinions.
> The results:
>
> Service load: 0% 100%
>
> File: msmsgre.dll
> Status: INFECTED/MALWARE
> MD5 32883c56a4cb283d06cfb1f03f003b26
> Packers detected: -
>
> Scanner results
> Scan taken on 08 Apr 2007 17:20:06 (GMT)
> AntiVir Found ADSPY/Agent.o.1
> ArcaVir Found Adware.Agent.O
> Avast Found nothing
> AVG Antivirus Found Generic.NDP
> BitDefender Found nothing
> ClamAV Found nothing
> Dr.Web Found nothing
> F-Prot Antivirus Found nothing
> F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.Agent.o (4, 1,
> 400) Fortinet Found W32/Agent
> Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.Agent.o
> NOD32 Found nothing
> Norman Virus Control Found W32/Agent.VIC
> Panda Antivirus Found nothing
> Rising Antivirus Found nothing
> VirusBuster Found nothing
> VBA32 Found AdWare.Win32.Agent.o
>
> ---------------------------------------------------------------
>
> Right-clicking to get this file's Properties:
>
> Type: Application Extension
> Location: C:\WINDOWS\SYSTEM32
> Size: 136 KB (139,264 bytes), 139,264 bytes used
> MS-DOS name: MSMSGRE.DLL
> Created: Monday, January 01, 2001 8:51:25 AM
> Modified: Monday, January 01, 2001 8:51:26 AM
> Attributes: Archive
> File Version: 5, 1, 2600, 0
> Desccription: Messenger Service Extension Module
>
> Copyright: Copyright 2000
>
> ---------------------------------------------------------------
>
> Opening the .dll file in Wordpad yielded some clues (amidst characters
> which were illegible):
>
> Software\SourceSafe.0
>
> http://safe.w2kserver2.com/
>
> Content type: application/x-www-form-urlencoded
>
>
MyOverlayIcon\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIc
> onOverlayIdentifiers
>
> CorExitProcess
>
> mscoree.dll
>
> Messenger ServiceExt Extension
>
> Microsoft Visual C++ Runtime Library
>
> buffer overrun has been detected which has corrupted the program's
> internal state. The program annot safely continue execution and must
> now be terminated.
>
> Unknown security failure detected!
>
> R6029
> This application cannot run using the active version of the Microsoft
> .NET Runtime
>
> c:\Install Ads\igal\Random job\Messenger Service\Release\adw.pdb
>
> InitializeCriticalSectionAndSpinCount
>
> HeapDestroy
> HeapFree
>
> AVout_of_range
>
> CLSID = s ''
> CurVer = s 'Messenger Service.Messenger ServiceExt.1'
>
> NoRemove ShellIconOverlayIdentifiers
> ForceRemove MyOverlayIcon1 = s
> ''
>
> ---------------------------------------------------------------
>
> Finally, a Web search yielded:
>
> http://kichik.net/
>
> Even more evil files
> Dec 15th, 2006 by kichik
>
> While searching for the complete list of registry keys used by NSIS
> Media, I found yet another update server for an even older version.
> Only this server seems a bit different, it's for removal of NSIS
> Media. Its output contains a URL for an installer that removes a lot
> of files and registry keys I haven't ever seen.
>
> auole4.dll
> aviprope.dll
> brwe042.dll
> cabext32.dll
> cagt041.dll
> cryptdbe.dll
> direjmod.dll
> dobj01e.dll
> dspmode.dll
> dsq052e.dll
> edk052.dll
> iccext.dll
> icmmext.dll
> mail052e.dll
> msgetm.dll
> msgsple.dll
>
> * msmsgre.dll *
>
> mssfdr.dll
> ntext052.dll
> ntfssetx.dll
> prtmde3.dll
> shllimgd.dll
> slpube03.dll
> splsrv4.dll
> syncmte.dll
> tragte.dll
> vidcpl2.dll
> vlcx052.dll
> wint042e.dll
>
> Expect a complete NSIS Media remover very soon
>
> ---------------------------------------------------------------
>
> Weird, huh?! Any ideas? False positive? TIA.
Addendum:
Created by MIDL version 6.00.0361 at Mon Jan 01 17:20:40 2001
| 
XML site map