HTML.ObjectDataHTA

HTML.ObjectDataHTA
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
HTML.ObjectDataHTA 01-04-2006
Posted by Malke on January 4, 2006, 10:57 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
lkriTŠs wrote:

Once again, see answers inline:

> Right two. In this instance these two infected files are not in use
> when Pegasus is closed. And presently Pegasus cannot see them when it
> is launched due to the infection

I was referring to standard malware removal steps in general. I see that
Dave answered you re Pegasus. I've heard of it of course, but haven't
ever used it so didn't know it is unsupported except by peers. As Dave
said, the files are most likely trashed and not recoverable. If the
other messages are important, then you should save them as text files.

> Not sure which AV app to use to do that. That is which AV or
> anti-malware apps support scanning/repairing from Safe Mode Command
> Prompt? I see David referred to using McAfee command line scanner.
> Does it run from the Safe Mode Command prompt?

Dave's Multi-AV uses several different av modules. You should follow his
instructions for using it. It doesn't run from the command prompt but
you should run it in Safe Mode after allowing it to download the
components it needs. I think you should start with Multi-AV. I have the
highest regard for Dave; I use Sysclean when cleaning up clients'
machines because I don't want to install anything I don't have to and I
don't want to connect the box to the Internet until I feel it is clean.
Multi-AV has to connect to get the modules/updates. But I do this for a
living and you are just working on one machine.

>>> The two PMM files are containers for much important unread email.
>>> The point of this exercise is to repair the files. Deleting is the
>>> very last resort option.

I very much doubt the infected files are intact. I don't think you're
going to be able to repair them. While you're at your girlfriend's,
show her how to back up. I'm not saying that to be mean; you will be
doing her a favor.

> Sounds good. So do you recommend I try Multi-AV first and then if that
> does not clean try Sysclean? Or the other way around?

No, just try Multi-AV. You won't need to run Sysclean too.

>>> Also I'm hoping to avoid installing a major number of third party
>>> tools to solve this one time problem. Registry bloat usually occurs
>>> because so many apps don't clean up after themseleves when
>>> uninstalled and many contain malware or DRM crap that I don't need
>>> to deal with.

You do not need to install "a major number" of third party tools to
clean a machine. When I am cleaning a client's infested computer, I
install:

Ad-aware & Spybot permanently
Ewido temporarily if called for (very good with trojans)
HijackThis temporarily
a full-featured av permanently if the client doesn't have one

And that's it, although I may run other tools. HijackThis has an
uninstaller in its Misc. Tools section or you can use Add/Remove
Programs. If HJT is called for, it would be ridiculous not to use it
because you have to temporarily install it. I always uninstall it
afterwards. You do not run HJT from CD or other media. If you feel you
need to run HJT, read the tutorials and post your log on one of these
forums (not here, please). HJT is a tool that requires *expert*
knowledge to use; pick a forum, read its FAQ, and post your log there.

http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Merijn
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42 -
another tutorial
http://aumha.net/viewforum.php?f=30
http://castlecops.com/forum67.html
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

> BTW sorry for the crazy cross-posting. I am still trying to get
> comfortable with my Xnews news reader and still a bit perplexed. My
> intention was to maintain the cohesiveness of the threads, without
> multi-posting, in:

You crossposted to the proper number of groups (no more than 4), but
unfortunately two of the groups are on Microsoft's servers and two of
the groups are on public servers. Naturally MS's servers only carry the
MS groups and not the others. I think the microsoft.public.security one
could have been left out, but the others are appropriate. Next time
just post to microsoft.public.security.virus and then you'll need to
make a second posting to the alt.* groups.
>
> microsoft.public.security,
> microsoft.public.security.virus,
> alt.comp.virus,
> alt.comp.anti-virus

Good luck with your girlfriend's computer.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Posted by David H. Lipman on January 4, 2006, 11:35 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

< snip >

|
| It's not that I wish to limit my repair options. But because my girlfriend
| lives in another town fifty miles away I need to, before my next visit
| prioritize and prepare for the best methods to use to attempt to disinfect
| the files/remove the trojans. And only THEN if not possible then delete the
| files to remove the trojans.
|
| I am receiving lots of recommends so not sure yet which to try first.
|
| My thoughts right now:
|
| 1. Run ZAISS 6.x AV in safe mode to see if I can repair (remove virus).
|
| 2. If this is not successful try a version McAfee VirusScan 9in safe mdoe).
|
| 3. If not successful try Multi-AV, Sysclean and/or Ewido. Not sure which of
| these to try first so I can download and burn all to a CD to take with me.
| I assume I can download updated AV definitions for each of these AV
| utilities and burn to CD? (As I will not have internet access available
| while I work on the computer).
|
| 4. I do have a boot CD at my disposal containing McAfee AV 4.40 and also F-
| Prot AV 3.16b. If I use these tools I assume I will need to obtain updated
| virus defs for these tools also. Not sure how to integrate the updated
| virus definitions if running AV from a boot CD.
|
| I just noted David has tried the McAfee command line scanner with the /MIME
| switch but was not able to clean an infection from within a Pegasus mail
| message store file.
|
| And he reported running Kaspersky and was not able to disinfect.
|
| I much appreciate the VERY informative feedback and the recommends that
| both you and David have provided.
|
| BTW sorry for the crazy cross-posting. I am still trying to get comfortable
| with my Xnews news reader and still a bit perplexed. My intention was to
| maintain the cohesiveness of the threads, without multi-posting, in:
|
| microsoft.public.security,
| microsoft.public.security.virus,
| alt.comp.virus,
| alt.comp.anti-virus
|
| Is it proper ettiquette to cross-port to the above newsgroups? They all
| seem to be used a lot for anti-virus issues.
|
| Or should I apply "Follow-up to:" to only ONE of thses newsgroups, and if
| so, which is preferred?
|
| Thanks again.
|
| Woody

Your posting is fine and On Topic so is your use of Follow-ups

Using the Kaspersky tool in the Multi AV Scanning tool I scanned the C:\PMAIL
folder after I
sent myself a few samples. I had the email with the attached malware in the
P-Mail InBox
and I had copies in a Pegasus Mail folder.

The following is an extract of the Kaspersky scan

C:\pmail\IN\FOL0180C.PMM/[...]/UNNAMED/[From "David H. Lipman"
Wed, 04 Jan 2006 19:59:45 -0500]/avpe32.dll packed: UPX
C:\pmail\IN\FOL0180C.PMM/[...]/UNNAMED/[From "David H. Lipman"
Wed, 04 Jan 2006 19:59:45 -0500]/avpe32.dll infected: Backdoor.Win32.Haxdoor.dw
C:\pmail\IN\FOL0180C.PMM/[...]/UNNAMED/[From "David H. Lipman"
Wed, 04 Jan 2006 19:59:45 -0500]/avpe32.dll disinfection failed:
Backdoor.Win32.Haxdoor.dw
C:\pmail\IN\FOL0180C.PMM/[...]/UNNAMED disinfection failed:
Backdoor.Win32.Haxdoor.dw


I used the Sophos module and I got these results...

>>> Virus 'Troj/Haxdor-Gen' found in file c:\pmail\IN\PG3ZXJM0.CNM\qz.sys
>>> Virus 'Troj/Haxdor-Fam' found in file c:\pmail\IN\PG3ZXJM0.CNM\avpe32.dll
Removal successful
>>> Virus 'Troj/Haxdor-Gen' found in file c:\pmail\IN\PHADILXL.CNM\qz.sys
>>> Virus 'Troj/Haxdor-Fam' found in file c:\pmail\IN\PHADILXL.CNM\avpe32.dll
Removal successful

However, those were test messages in the InBox. The messages tests moved into a
Pegasus
Folder were NOT found nor cleaned.

Trend Sysclean also had mixed results. It found in a Pegasus mail folder
Success Clean [ HTML_PAYLAP.M]( 1) from c:\pmail\IN\FOL04B99.PMM,(NONAMEFL)
and in the InBox
Success Clean [ WORM_KELVIR.A]( 1) from c:\pmail\IN\P9XLLW35.CNM,(cute.pif)

But failed to find the WORM_KELVIR.A in a message in a Pegasus Mail folder.

The results.
McAfee NADA.
Kaspersky, detection but no removal
Sophos detection and removal ONLY in the P-Mail InBox.
Trend Micro Sysclean detection and removal in the P-Mail InBox. And mixed
results in a
Pegasus Mail folder. It could do a HTML Exploit message in a Pegasus Mail
Folder but not a
malware attachment in a Pegasus Mail Folder.

It was an "interesting" experiment to say the least.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by David H. Lipman on January 4, 2006, 10:30 am
If you were  Registered and logged in, you could reply and use other advanced thread options

| @TK2MSFTNGP15.phx.gbl:
|
>> lkriTŠs wrote:
>>
>>> Hi.
>>>
>>> I have found that several files on XP SP2 machine are infected with
>>> "HTML.ObjectDataHTA", as reported by ZoneAlarm Pro Internet Security
>>> Suite 6.x Anti-virus scan.
>>>
>>> The two infected files are .PMM email folder files used by the Pegasus
>>> email client. I suppose they are infected attachments within the PMM
>>> file.
>>>
|
>> Try running the scan with your regular av in Safe Mode.
|
| Yes scanning files in safe mode was by next step but hoping some tools/tips
| might be applicable/useful in my circumstance in normal startup mode.
|
>> You may also be able to delete the files in Safe Mode. If you know what
>> the files are, you don't need to open them. Just right-click and
>> delete.
|
| The two PMM files are containers for much important unread email. The point
| of this exercise is to repair the files. Deleting is the very last resort
| option.
|
| FYI I think the infections made it onto the PC via SPAM between the time
| NAV live update subscription ran out and the time ZAISS 6.x was installed
| (several weeks). If was up to me I would never allowed that time frame to
| elapse without installing updated virus definitions (it is my girl friends
| PC).
|
>> You might also try scanning with either Sysclean or Dave Lipman's
>> Multi-AV. Ewido is also excellent for catching trojans. You can use
>> Ewido's free trial and then uninstall it afterwards.
|
| I observed recommendations of Ewido on another forum so it was already on
| my list to tryout if other tools did not quarantine or repair the trojan.
|
>> http://www.elephantboycomputers.com/page2.html#TrendMicros_Sysclean
>> http://www.ik-cs.com/multi-av.htm - how to use Dave Lipman's Multi-AV
>> http://www.ik-cs.com/programs/virtools/Multi_AV.exe - Multi-AV download
|
| I don't know anything yet about Multi-AV or Sysclean. So Sysclean is from
| Trend Micro? Thus is it hosted on the TrendMicro site. I am wary of
| downloading from non well-known (to me) sites (e.g. elephantboy).
|
| Also I'm hoping to avoid installing a major number of third party tools to
| solve this one time problem. Registry bloat usually occurs because so many
| apps don't clean up after themseleves when uninstalled and many contain
| malware or DRM crap that I don't need to deal with.
|
| e.g. Uninstalling a-squared auto launched my web browser opening a survey
| webpage asking why I was installing their free product. I refused to submit
| the form and closed the browser, so the uninstall did not complete. I found
| major garbage left behind in file directories and the registry. I lost my
| trust in the a2 product or emsi software with this experience.
|
| Thanks for the recommends. Still open for others.
|
| Woody
|

You can't repair the files. The body of the email is using exploit type code.
The email
messages need to be deleted.

There is NO tech support for Pegasus mail as David Harris, the New Zealand
author, has
released into the public domain. At best their is the News Group;
comp.mail.pegasus-mail.ms-windows
However, in this circumstance the Virus News Groups posted to are the *best*
area for this
problem. I do suggest P-Mail v4.31 :-)


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by David H. Lipman on January 4, 2006, 9:57 am
If you were  Registered and logged in, you could reply and use other advanced thread options

| Hi.
|
| I have found that several files on XP SP2 machine are infected with
| "HTML.ObjectDataHTA", as reported by ZoneAlarm Pro Internet Security
| Suite 6.x Anti-virus scan.
|
| The two infected files are .PMM email folder files used by the Pegasus
| email client. I suppose they are infected attachments within the PMM
| file. If I attempt to open either file with notepad text editor, ZA
| reports file is infected and will not allow me to open. ZA AV scan says
| it is "unable to delete the infected file". Cannot repair or quarantine
| either. ZA suggests "opening file within archival utility". Not sure what
| this means in this context.
|
| Ran a-squared Free (from emisoft) which did not find anything.
|
| Ran deep scans in Adaware SE and Spybot Search & Destory and no negative
| reports either.
|
| I have a list of other things I can try but i thought I would ask for
| tips before proceeding. Appreciate your advice.
|
| Woody

Is this really Zone Alarm or is this really CA eTrust providing this error
message ?

"HTML.ObjectDataHTA" is CA eTrust's naming convention and I believe that's what
is
generating the message --
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=39302

You have two choices..

1. Exclude the p-mail folder c:\pmail, run P-Mail and delete the messages.

2. Disable CA eTrust, Run P-Mail and delete the messages. Re-enable CA
eTrust.

I suggest #1. It won't lower your security. I do this with Mcafee VirusScan
v7.1E and
McAfee VirusScan v4.5.1.

Any malware scanner you use *must* be able to scan MIME and remove infectors in
MIME encoded
files. You won't find that Ad-aware, SpyBot, etc.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by =?Utf-8?B?bGtyaVTQBXO=?= on January 5, 2006, 12:52 am
If you were  Registered and logged in, you could reply and use other advanced thread options

>
>| I think you hit the nail on the head with this last statment. Any
>| suggestions for tools that can do this? That is "able to scan MIME
>| and remove infectors in MIME encoded files".
>|
>>

> P-Mail is a simple email program. It is NOT like an email application
> that uses VIM or MAPI to scan email messages. P-Mail stores email in
> MIME ASCII files. However, P-Mail is proprietary. I don't know of
> any other email application that works the same or store email
> messages and folders the same way.

Right. I have been using Pegasus email client for five plus years now and
really like it. And yes the message store is different than standard email
client stores. I have learned over the years a bit of how the storage
structure works when I had to recover corrupt folders and
resynchonize/rebuild the folder structure or message store.

BTW previously you stated David placed Pegasus in the public domain but
then it sounds like you later discovered that it is indeed proprietary.
Anyway I am on the PM-NEWS announce list and did not see an announce that
he placed in public domain.

Yes v.4.31 is cool. Everyone using previous versions should upgrade or at
least should read the two December 2005 PM-NEWS notices at:
http://bama.ua.edu/cgi-bin/wa?A1=ind0512&L=pm-news

> I only see the two options I provided.
>
> Now the McAfee Command Line Scanner CAN scan MIME files with the /MIME
> switch parameter. However, I don't know if it can SAFELY remove
> viruses without corrupting the P-Mail email storage structure. So I
> ran an experiment. I emailed myself three WMF-Exploit files. I
> downloaded the email and and moved it in a folder.
>
> I then manually ran the McAfee commnad line scanner on the c:\pmail
> folder (after I made a backup) and I scanned using the /MIME switch.
> No go. It didn't work.

Too bad. Your efforts in testing is much appreciated.

> I then tried kaspersky. It could see the infected files in the email
> but could NOT disinfecte the messages.

Bummer.

If any other ideas pop in your head let me know. I'm going to girlfriends
house tomorrow eve to see if I can do a quick disinfect/repair. If not will
bring the PC back to my location. If we have to delete the two files in the
Pegasus store I will do but I'm not ready to throw in the towel yet.

> ElephantBoy Computers is a company by Malke. She is a Microsoft MVP
> as "she can be trusted".

Very good to know. I just noticed the provided download link for for Trend
Micro's SysClean was hosted on the ElephantBoy site which I thought a bit
odd.

It's amazing to see the number of MS MVP's actively using, supporting and
promoting alternative third party software. I'm all for balancing ones
portfolio.

> I am the author of the Multi AV Scanning tool and it is just a front
> end to the command line scanners from; Trend Micro, Mcafee, Sophos
> and Kaspersky.

That's good info. Will check out Multi-AV. I need to learn some of these
tools BEFORE I need them again.

Thanks again for your assist. In the meantime if you or anyone else come up
with any fresh ideas please let us all know. Best regards,

Woody

Similar ThreadsPosted
No HTML access!!! December 3, 2008, 11:48 pm
C:\WINDOWS\secure32.html October 16, 2005, 6:05 am
Trojan-Spy.HTML.Fraud.gen May 14, 2008, 2:02 pm
Trojan-Spy.HTML.Fraud.gen August 8, 2008, 12:55 pm
HTML/scripted.gen virus August 16, 2008, 8:31 pm
IE home pg stuck as msblank.html October 17, 2005, 8:46 pm
Pagefile.sys infected by HTML.PHishing.Pay-131 August 31, 2006, 9:12 am
Lost HTML for Running Active Desktop July 31, 2005, 7:20 pm
Exploit.HTML.IFrame reported as virus in email December 29, 2005, 12:55 pm

The site map in XML format XML site map

Contact Us | Privacy Policy