1

One of our users is having a recurring problem with a virus. It has happened to this user on two different machines, in each instance infecting the same program with the same virus.

Malware bytes detects the malware, and yesterday I cleaned the system. Note that MSE doesn't find anything. Malware bytes real-time scanner is running too, but I checked again today and the system is re-infected.

It's a Win 7 Pro SP1 system, it has the latest updates, it's running Windows firewall (as well as being behind a corporate firewall), MSE and MBAM on the system, and still it gets re-infected!

I've scanned the user's network drives in case they're picking it up from there, but so far nothing's been found.

How can I get to the bottom of this recurring virus problem and stop the system from getting infected once and for all?

5
  • Are you using roaming profiles or did you copy the profile from the old box to the new? It is likely in the profile. Also, what are they getting infected with? Apr 20, 2012 at 11:44
  • Nope not using roaming profile. It's being infected with Trojan.Agent.Gen. It causes the computer to completely freeze up.
    – kafka
    Apr 20, 2012 at 11:45
  • are you servers being av'd also?
    – tony roth
    Apr 20, 2012 at 16:12
  • Are you using Folder Redirection or Offline Files?
    – joeqwerty
    Apr 20, 2012 at 16:30
  • Yeah servers have AV on (ESET) I'll run a scan on them to be sure. We're not using Folder redirection or offline files.
    – kafka
    Apr 21, 2012 at 10:53

4 Answers 4

3

Trojan.Agent.Gen is a Generic signature. It means that Malwarebytes' heuristics found something, but the application is not sure what it is, so it removes the application only, so any backup or masked copies can still be left on the system. There's even a small chance that this is not a virus at all. If it is a virus, we need to establish a signature first.
Please, kindly do the following:

  1. Scan your PC with a real antivirus engine and post the results. I suggest you use a free utility from kaspersky, they contain their latest virus definitions and a full scale antivirus engine: http://www.kaspersky.com/virusscanner
  2. Take the file that MalwareBytes found and send it to virustotal: https://www.virustotal.com/ Post a link to the results, so I can find a description and give you further advice.
  3. If, for some reason, step 1 doesn't give you any results and you can't find the specific file in step 2, we'll have to do the analysis manually. You'll need to collect an AVZ System Analysis Log. Download the AVZ4 utility http://z-oleg.com/avz4.zip, run standart scripts 1 and 2 and post the results.

P.S. Microsoft Essentials and Malwarebytes are not a substitute for good endpoint security products. They can't handle a lot of viruses because they lack sophisticated security components needed to catch them. If you don't want to run into such problems again, consider bying an industry standard endpoint software by either McAffee, Kaspersky or ESET. Especially if you work in an Enterprise environment.

8
  • OK thanks very much for the info, I'll attempt this on monday when we're back in the office. We do have ESET NOD AV, so I'll make sure it goes onto this machine.
    – kafka
    Apr 21, 2012 at 10:54
  • I restored the exe from the quarantine and submitted it to virus total. It hasn't detected anything wrong with the exe. virustotal.com/file/…
    – kafka
    Apr 23, 2012 at 14:22
  • Can you tell me the name and path to the file that was deemed infected by the MBAM?
    – Temikus
    Apr 24, 2012 at 15:35
  • Also, did you run the AVP Tool mentioned in the 1st point?
    – Temikus
    Apr 24, 2012 at 15:36
  • c:\program files (x86)\ACT\ACT for Windows\ActSage.exe - each time there is an infection it is this file, plus associated registry keys.
    – kafka
    Apr 25, 2012 at 8:03
1

The usual suspects:

The logged-on user has inappropriate elevated permissions or rights.

There is a vulnerable and outdated Adobe Flash browser helper installed.

There is a vulnerable and outdated PDF reader installed.

There is a vulnerable and outdated Java runtime installed.

Use of an infected removable media (USB drive).

Note that for many APT's (advanced persistent threats), it is trivial to build a one-off, custom, unique hostile application that can be downloaded by a victim. These may not be flagged by a scan due to encryption of the binary. In some cases, it is necessary to profile the network activity to detect an incursion. This is one of the ways that products such as FireEye and Trend Deep Security differ from a traditional client-based antivirus application.

5
  • The user has the correct level of rights. Would increasing the level of UAC help prevent unwanted changes? The app which keeps being infected is installed from a DVD each time. The app is on every machine in the domain. I could scan another machine, to see if a false positive is being reported. I have had issues with the affected machine completely freezing, although this may be unrelated and caused be something else.
    – kafka
    Apr 20, 2012 at 12:48
  • If you get a hit on the infection with a particular machine, upload that infected file to an online tester that scans against multiple engines and that can help give you the odds that it's a legit infection. Apr 20, 2012 at 12:55
  • I've run MBAM on another machine with the app installed to see if it's a false positive and nothing came up in the scan. So the common denominator here is the user.
    – kafka
    Apr 20, 2012 at 15:30
  • Still not quite the same as uploading to a virus scanning aggregator. And you've still not tested a file that was listed as infected with an aggregator. Apr 20, 2012 at 18:28
  • OK I'll give that a go see what they say.
    – kafka
    Apr 21, 2012 at 11:46
1

In addition to Greg Askew's answer, here are some thoughts.

If the user has this infection following him, it has to be something that is particular to this user's habits or account.

Normally it could be roaming profiles, which you said isn't in use.

To get re-infected, it would imply a dropper of some kind or rootkit-hidden program that is re-downloading software after a cloak; is the user running with elevated privileges? In which case the only way to get rid of the re-infection is to reformat the computer and completely start over, even blowing away the boot sector. If something is cloaked in the background and re-downloading software that is detected, this would wipe it completely.

Otherwise you would have to resort to checking the user's browsing habits. Do you have a proxy system that monitors web browsing activity? Can its logs tell you what sites your user is visiting around the time of the infection? (If the software is being downloaded via http your proxy may also be possibly configured to block the download site, depending on what it is...that can help prevent some re-infection vectors)

Another thought; it's a false positive. Take the executable and upload it to an online virus scanner that tests executables against multiple AV engines and see if it actually triggers most of them. I've had trouble with false positives in the past. Again the proxy server, or a packet sniffer, can help determine if the computer is actually doing something it shouldn't be. Just having an AV trigger an alarm doesn't mean the computer is actually doing anything it shouldn't.

You said the infection is causing the computer to lock up; to me, that's kind of strange, since the goal of most malware today isn't to go out of its way to be detected by making the computer outrightly act strange and call attention to itself. Could it be something is corrupting the executable? Could it be coincidence that the machine is locking up?

The reinfection and inability to find a remote install (like the shares or home directory having the infecter) would mean monitoring the user's habits, nuking the install on the workstation and reinstalling from scratch to eliminate hidden kits, and using privilege limits so the user can only "infect" his own directories to which he has access, and verify that the infected executable is really infected by using a third-party website to scan.

3
  • I'm not 100% that the computer freezing is due to the Trojan, and sadly the logs aren't telling me much. It was after a freeze that I scanned the machine and found the infection; it may be that there is no causation there. The second machine that this has happened on is a new machine - barely a month old. It could be a website that is causing the issue although there doesn't seem to be anything 'dodgy' in the history.
    – kafka
    Apr 20, 2012 at 12:46
  • It might not be in the history, or it can be a legit site that has been compromised (hacked Wordpress site, etc.) You'd need to have a proxy or sniffer in between to see what is actually being requested and pulled down. Apr 20, 2012 at 12:49
  • run microsoft offline systemsweeper, its a bootable unit that will find the rootkit if its there.
    – tony roth
    Apr 20, 2012 at 16:21
0

My recommendation is to find any backup copies of the malicious software by running HijackThis with admin privileges and using the log analysis tool to find out any suspicious entries in the windows registry. In addition, a scan with Adwcleaner and an anti-rootkit tool would be great.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .