I'm not being critical of anything you've said, UsernameIssues. I'm trying to learn more about security and malware detection and that's why I pose these questions:...
Even if someone was critical of my amateur analysis, I'm okay with that. I'm fully aware of my ability to come to the wrong conclusions. And while I've been doing this off and on for a long time - that might only mean that I'm a slow learner
I can only hope that the info below is correct. It is all coming from my memory and the infection file has changed many times. MSE's actions towards it change too. Some versions raise no flags. Other versions show what you see in the screenshots. All of the versions seem to do the same thing and yet MSE handles them differently. Tonight's version is back to not triggering any action from MSE :-(
Since we are back to a version (or versions) that raise no flags (cause no actions by MSE)... I'm wondering if MSE is using heuristics to protect that registry key. Maybe it does detect some stuff that it never tells the user about.
~~~
1. According to your 2nd screenshot, MSE did detect the malware and placed it in quarantine. Under "recommended action" it suggests you remove the software immediately and it allows you to check mark > remove all. But it also says an error occurred and the program (MSE) could not find the malware on the computer. How could MSE categorize the malware, describe it, and then place the malware in quarantine if it couldn't find it?
~~~
MSE created a popup in the notification area that said the computer was being cleaned. That popup said something like:
no further action was needed. MSE never turned red. Even the popup was green. The fact that the file was still on the desktop was the first clue that something was wrong. I manually opened MSE and looked at the screen shown in that second screenshot. If the infected file had been launched from a less visible folder (maybe the downloads folder) I might never have know about MSE's failure to quarantine the file. As you see in that second screenshot, MSE does state that the threat has been quarantined. That seems to be wrong. It has not been quarantined. [I did not try to have MSE remove the file from the quarantine area since it was not in that area.]
>
How could MSE categorize the malware, describe it
The detection/description could have been based on what was loaded into RAM.
>
and then place the malware in quarantine if it couldn't find it? My guess is that MSE wrote the summary of its actions before it wrote the details of the error. They seem to contradict each other.
I restarted the virtual computer and went into the infected profile to give MSE a chance to prevent the shell from being replaced. (Well sort of replaced - it is actually just covered up.) MSE did not stop the infected cache.dat file from running. The very cache.dat file that is mentioned in this link:
Trojan:Win32/Urausy.E
The infected file was still on the standard user's desktop, so I...
...did a ctr-alt-del
...logged that infected user off
...logged on as the built in administrator
...let the computer build the profile (since this was the first log on)
...used that same infected file
......in the same file/path location
......to infect that second profile
All while MSE was "protecting" this virtual machine.
This indicates to me that the infected file was never quarantined... that is was still fully functional.
While infecting the admin profile, MSE did that exact same thing:
told me that it found stuff
told me that I did not need to do anything
never turned red (or even orange)
gave the same error.
~~~
2. Do you think this is a question of MSE software coding being bunged up rather than MSE not being able to detect/quarantine malware?
~~~
I really don't know what to think at this point. I'll leave that for MSE to figure out. I setup MSE to share the maximum amount of info back to MS (automatic file submission and advanced MAPS). The automatic file submission might not work for files that MSE cannot find.
~~~
3. And do you think MSE is simply erring on the side of caution by NOT removing the malware and allowing the user to make that final decision?
~~~
Such does not seem to be the case. In yesterday's tests, if I have MSE installed before downloading the infected file, the file never makes it out of the temporary internet files area. The user is never given a option to complete the save to the desktop or to any other area.
Quote
