Another poorly detected Trojan.Zlob

winhelp2002 — Mon, 24 Sep 2007 06:40:00 GMT

Landing on "thesuperxxx(dot)com" the visitor is presented with a bogus "Message Box Object error"

Clicking any of the above buttons leads to prompts "You must install ... yada yada" to view the movie. There are 10 other sites involved in this latest Trojan.Zlob (Codec) infection. All these sites will be added to the next HOSTS file update.

Running "VideoAccessCodecInstall.exe" thru VirusTotal, you can see it is not very well detected. 12.5%

These type infections are becoming so rampant that they are now the #1 detection at "Microsoft Malware Protection Center" and that's just the ones that Microsoft detects, which Microsoft usually does not detect very well ...

Did you know you can run the "Malicious Software Removal Tool" (MSRT) anytime? Usually you only see the "Quick Scan" from Windows Update monthly, however you can get (mrt.exe) to run a "Extended Scan". Simply locate "Windows\System32\MRT.exe", right-click and select > SendTo > Desktop (create shortcut). Next right-click the new icon on your Desktop and select: Properties. From there you can change the "Target" to a desired option.

/Q or /quiet - Use quiet mode. This option suppresses the user interface of the tool.
/? - Display a dialog box that lists the command-line switches.
/N - Run in detect-only mode. In this mode, malicious software will be reported to the user but will not be removed.
/F - Force an extended scan of the computer.
/F:Y - Force an extended scan of the computer and automatically clean any infections found.

An undocumented switch that I use ... if you have more than one hard drive (or partition) is to add the drive letter if you only want to scan one drive. Otherwise MSRT will scan all drives ... and it takes a while ... more info here.

C:\Windows\System32\MRT.exe /f D:

Where "/f" runs a extended scan and "D:" scan only drive D. The results are recorded here: "Windows\Debug\mrt.log".
Folks this is not a replacement for your Antivirus, simply another (free) tool you can use if you suspect you are infected.

Note: I ran the above and it did NOT detect: "VideoAccessCodecInstall.exe" (noted above)

Hosts News : Trojan.Zlob

Another poorly detected Trojan.Zlob