Trojan.VB.VZO

[DJG]

Anybody know anything about Trojan.VB.VZO? Couldn't get anything useful from Bing or Google other than a couple of "i seen it"s. It's suddenly now being flagged in an installation Zip archive for Next Up!'s Natural Voices' Audrey (yes, my car's MP3 player is a gorgeous British Lass, so sue me!). Thing is, Ive installed this from Winzip several times over many years. Only now I got a hit on a scan.

What is the potential damage? I guess I'm about to reload everything over again (except this!) .

 

[Antman]

On the case with no solution yet. But I did find this one and thought it was "cute".

Trojan.VB.Zu blocks access to pornographic web pages based on the sites keywords. Upon visiting one of these sites, Internet Explorer is minimized and a message from the Koran is displayed.

 

[Antman]

And, duh. If your scanner got a hit, your AV provider has a definition at their site.

 

[mickey megabyte]

hopefully a false positive as it comes from a commercial software company?

have you tried submitting zip file to any online scanners?

(sorry if i'm stating the obvious...)

 

[DJG]

And, duh. If your scanner got a hit, your AV provider has a definition at their site.

And zero info other than "it's a trojan!" Gee, thanks! I did Bing & Google - got a hit for Trojan condoms!

Oh no! My porno life is ruined! OK, let me test that one out, see if it's a pseudonym.

Typically, while I understand the backdoor paradigm, how do they normally get activated and used? Is it mostly annoyanceware? I haven't had any unusual behavior, other than some BSODs attributable to shifting OC parameters in the hardware.

The firewall hasn't reported anything like "Trojan.VB.VZO is asking to trash your C: drive [DENY] [ALLOW]".

I always set my FW to no auto rules and no auto training. I get prompted 1st time for everything and it creates the rule based on my response.

I started to upload but it's a 654MB Zip archive, and I have 800Kbs upstream - would take forever ... I'm waiting to get a little more info if possible.

 

[Antman]

I did Bing & Google...

I would not do that without a Trojan.

But I DO have one! HE-LLOOO! Read the title!

You are free to Bing & Google your brains out.

 

[DJG]

But I DO have one! HE-LLOOO! Read the title!

 

[DJG]

OK, I just rebooted from my 7232 install, which hasn't been up in a few days. Also I have an earlier beta of OSS. I immediately scanned the file and - no hit. So it's either new heuristics in the released version, or new def. I run the update cycle & re-scan- Bingo! Trojan hit.

I'm scratching my head. If it's a new ware, what's it doing in an old file? Maybe injected recently? It's a huge zip file, so probably tempting place to hide crappola in. I suppose they can do it without altering size & dates. The file is originally from 2005. I extracted from an image backup from 6/22 and it's there too.

Or maybe it's a false positive? I have installed this thing many times, several in the past three months . If it is indeed infected, wonder what it's doing? I hope they get really bored, fall asleep on the keyboard, hit the DEL key and delete their main data bank ...

OMG! Antman used a wormhole post!

 

[Antman]

...OMG! Antman used a wormhole post!

I can find ref's to Trojan.Downloader.VB.VZO, circa 2005-2006. No good def's though.

At a minimum, write protect your compressed files. I find it odd that someting would inject a payload into a single archive. Transient malware. Hit one file and leave before detection, with the payload undetected? That is one clever worm.

Speaking of clever worms, I have a court date at 10 a.m.

 

[DJG]

Well, I'm on a new fairly bare clean install. I think it may be a false positive. When I have time I'll ship it upstream to Agnitum and let them check it out. Now I'm re-installing and putting things back in order, again, minus the one. Sigh ...

OTOH, that install was an upgrade, so I don't feel as bad .

Thanks for the scouting. Have a fine day in court ...

 

[Mercurial]

which AV you using?

 

[DJG]

which AV you using?

Hi Mercurial,

I'm using Agnitum's Outpost Security Suite, the latest release which just went public.

 

[ussj4brolli]

Hi Mercurial,

I'm using Agnitum's Outpost Security Suite, the latest release which just went public.

Have you tried a few of the online scanners?
Im sure this has ben resolved due to the newest untouched RTM available so you prob. reinstalled.
Any resolution?

 

[DJG]

The file is ~.7 GB. I calculate it takes me over 2.5 hrs to upload if all goes well at my 800Kbs upstream rate, and renders the rest of my internet activity pretty useless as it sucks up all my upstream bandwidth. I'm doing one upload to Agnitum - one attempt already got canned as I tried some other internet surfing, and I have to remember not to reboot while this is going on . I'll post when I have more details. Meanwhile my house and tenants need some looking after .

 

[DJG]

Well, as I was about to start a new upload marathon, I suddenly had the idea, if it was scanning OK before and then starts scanning positive after the update from 7/23 (verified in two images - I hadn't used 7232 since the 18th, and when I first booted the scan was OK, then after the latest update it scanned positive like in 7600), maybe the new updates would correct a false positive?

Well, I just scanned it again since I've had a bunch of updates since the 23rd, and I'm back to negative again! Woo-hoo! Either way I'll send it to them and have them peruse it.

 

[mickey megabyte]

all's well that ends well - good to see that it was indeed a false positive

one day AV makers will get it right...:sarc:

 

[DJG]

all's well that ends well - good to see that it was indeed a false positive

one day AV makers will get it right...:sarc:

Yes, and pigs will fly, and the governments (all of them) will be just, efficient and effective, and relatively tax-free . I'm appreciative of AV being part science, part black art :shock:.

Well my second upload attempt crapped out also sometime while I was having lunch - I think the file is just too big. I'll see if I get any response in their forum.

 

[mickey megabyte]

did you say in the OP that the file was part of a zip archive?

can you isolate the 'suspect' file and just upload that, rather than the whole zip?

 

[darkassain]

from what i can tell it might have been a single file in a zip archive from what i can see...

if you are able to recreate the same scenario you could the AV off then scan the folder you extracted the archive too...

and for the AV makers, well Morro is coming out so it turn ugly (and it just out to be good for us consumers as there is a base standard which every commercial AV vendor must at least surpass in order to be profitable...)

 

[DJG]

Well, I have been reluctant to do anything that might remotely trigger the potential malware, not even opening the archive with Winzip (I actually have a license, how anal is that!) until I have a better handle on the sitch.

And unfortunately it appears my false positive gone experience wasn't quite true. What happened is I did a file-specific right-click / Scan for malware, and apparently that works different, or possible doesn't work as expected in Win 7 which is still in beta trim for this release. I just did another full system scan and they (I have two copies currently) showed up again.

The good news? The same sig showed up this time three times, the two zip archives, and an OCX in my 7232 partition's SysWOW64, mswinsck.ocx which is a skimpy 106KB. And it matches what might have been installed by that installation ZIP. I'll send that and see what happens now.

BTW, the right-click / Scan for malware gives positive on the OCX file, but not on the ZIP that seems to contain it.