This morning I received a direct message from my brother on Facebook (warning #1) with a link to a url that just looked 'crazy', I clicked (mistake #1).
I was redirected to a site that appeared to be hosting a video, but prompted that it "Required Adobe Flash Player 10" to continue and attempted a download of file "setup.exe". I downloaded the file and ran it (mistake #2).
Luckily, I am running Windows Defender, which detected changes to my system and prompted me for approval before committing them. Windows Defender prompting me after an install is not unusual, however, it gave me a critical moment to collect my thoughts (first cup o'coffee this am, after all) and review what was about to occur. That's when I noticed that the "Adobe Flash Setup" had installed several Windows drivers. Drivers? Nothing from the browser should EVER install a Windows driver?!
I'm now suspicious (sharp as a spoon, I am) and decide to investigate a little further.
I reviewed the "setup.exe", and viewed its details, there was no manufacturer data. I then navigated to Adobe and downloaded its installation program for Adobe Flash 10. The file name is "install_flash_player.exe" and when viewing the file details is stamped repeatedly that its from Adobe.
Windows Defender reported the following changes to my system.
| Windows Defender Report |
| Description: Advice: Resources: file: Category: |
| Description: Advice: Resources: runkey: file: Category: |
| Description: Advice: Resources: runkey: file: Category: |
That's enough for me...I deny the changes in Windows Defender, which requires a reboot to rollback. After the reboot, all is well in the 'verse.
Shortly afterwards this morning I got an email from my brother warning me about it - he wasn't so lucky.
This is not the first time Windows Defender has saved my bacon. If your running Vista, or Windows XP SP2/3, make sure your running Defender, or a good virus scanner. Defender seems to be less intrusive than the actual virus scanners I've tried over the years.
Just a few minutes ago I accidentally let the same file get through into my system through a keygen. By deleting it's registry entry (my action thus far), would you reckon that I'll be safe?
ReplyDeleteI'm running a full system search, and deleting any files that it yields right now, which should help if that wasn't enough. Cheers.
Mike,
ReplyDeleteOnce infected, I'd be surprised if it went away that easily. One can always hope, though! :)
It may require booting back up in safe mode, removing the registry keys and deleting the executables that were installed.
Sysinternals autoruns.exe is a nice tool to help clean up registry entries related to Run/RunOnce, etc.
I don't deal with this sort of thing on a regular basis, so my problem is that I imagine that its doing all sorts of nasty stuff that will be difficult/impossible to track down once it gets through.
Good luck!
Z