Window's Defender and SAS.

[Seth]

To the best of my knowledge, no malware expert would ever recommend Window's Defender. However, techs may be wondering how much malware removal income they'll lose since Vista comes with Defender. Probably not much.

Case in point:

I just finished disinfecting a Vista system protected by Window's Defender. Vista would not complete its boot. "Explorer can't start. Your computer is shutting down". That message would appear before the programs began to load and about 5 seconds later a shutdown would initiate. In that 5 seconds I noticed an icon on the desktop for "VirusProtectPro" (Rogue antimalware application). At that point I knew the shutdown was likely being caused by a malware infection.

I needed to get control of the system, so I tried Safe Mode and Last Known Good Configuration to no avail. I now had no choice but to slave the drive and remove the malware.

SAS log:

SUPERAntiSpyware Scan Log

https://www.superantispyware.com

Generated 09/06/2007 at 12:50 PM

Application Version : 3.9.1008

Core Rules Database Version : 3301

Trace Rules Database Version: 1307

Scan type : Complete Scan

Total Scan Time : 01:16:57

Memory items scanned : 293

Memory threats detected : 0

Registry items scanned : 5619

Registry threats detected : 0

File items scanned : 90118

File threats detected : 26

Adware.180solutions/ZangoSearch

F:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS

F:\USERS\WAYNE(A.K.A. DAD)\APPDATA\LOCAL\MICROSOFT\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\MUSNF7RO\SETUP[1].EXE

Adware.MyWebSearch

F:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE

Malware.VirusProtectPro

F:\PROGRAM FILES\VIRUSPROTECTPRO 3.7\UNINST.EXE

Adware.Lop-Variant

F:\PROGRAMDATA\ANTIEQ\BYTE IDOL MEOW.EXE

F:\PROGRAMDATA\ANTIEQ\LTNOJQPV.EXE

F:\PROGRAMDATA\ANTIEQ\RVGZJFJU.EXE

F:\PROGRAMDATA\ANTIEQ\TVAHDTNR.EXE

F:\USERS\CAROL NAYLOR\APPDATA\LOCAL\TEMP\LIST JOY.EXE

F:\USERS\CAROL NAYLOR\APPDATA\LOCAL\TEMP\STA2CE9.EXE

F:\USERS\CAROL NAYLOR\APPDATA\LOCAL\TEMP\STA4A1D.EXE

F:\USERS\DAVID NAYLOR\APPDATA\LOCAL\TEMP\BIS5880.EXE

F:\USERS\DAVID NAYLOR\APPDATA\LOCAL\TEMP\BIS7687.EXE

F:\USERS\DAVID NAYLOR\APPDATA\LOCAL\TEMP\LIST JOY.EXE

F:\USERS\DAVID NAYLOR\APPDATA\LOCAL\TEMP\STA7F7B.EXE

F:\USERS\DAVID NAYLOR\APPDATA\LOCAL\TEMP\STAC376.EXE

F:\USERS\DAVID NAYLOR\APPDATA\LOCAL\TEMP\STAC940.EXE

F:\USERS\GUEST\APPDATA\LOCAL\TEMP\LIST JOY.EXE

F:\USERS\GUEST\APPDATA\LOCAL\TEMP\STA1BD8.EXE

Browser Hijacker.Favorites

F:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\ONLINE SECURITY GUIDE.URL

F:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\SECURITY TROUBLESHOOTING.URL

F:\USERS\GUEST\FAVORITES\ONLINE SECURITY TEST.URL

F:\USERS\PUBLIC\DESKTOP\ONLINE SECURITY GUIDE.URL

F:\USERS\PUBLIC\DESKTOP\SECURITY TROUBLESHOOTING.URL

Trojan.Smitfraud Variant

F:\WINDOWS\SYSTEM32\IKLQCX.DLL

Trojan.Unknown Origin

F:\WINDOWS\SYSTEM32\__C00FCB20.DAT

I installed the drive back into the computer and all was now well with Vista. Since the registry is not scanned on a slaved drive, I loaded SAS and scanned the registry only:

SUPERAntiSpyware Scan Log

https://www.superantispyware.com

Generated 09/06/2007 at 01:38 PM

Application Version : 3.9.1008

Core Rules Database Version : 3301

Trace Rules Database Version: 1307

Scan type : Custom Scan

Total Scan Time : 00:02:33

Memory items scanned : 0

Memory threats detected : 0

Registry items scanned : 8708

Registry threats detected : 39

File items scanned : 0

File threats detected : 13

Trojan.Media-Codec/V3

HKLM\Software\Classes\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}

HKCR\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}

HKCR\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}\InprocServer32

HKCR\CLSID\{1C3C4699-B285-475F-BE47-0B26088CE876}\InprocServer32#ThreadingModel

C:\PROGRAM FILES\VIDEO ACTIVEX ACCESS\IESPLG.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{1C3C4699-B285-475F-BE47-0B26088CE876}

Unclassified.Unknown Origin

HKLM\Software\Classes\CLSID\{47B83D78-F986-4E96-9769-2C55EF14DA0B}

HKCR\CLSID\{47B83D78-F986-4E96-9769-2C55EF14DA0B}

HKCR\CLSID\{47B83D78-F986-4E96-9769-2C55EF14DA0B}\InprocServer32

HKCR\CLSID\{47B83D78-F986-4E96-9769-2C55EF14DA0B}\InprocServer32#ThreadingModel

C:\WINDOWS\SYSTEM32\__C00B62B1.DAT

HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{47B83D78-F986-4E96-9769-2C55EF14DA0B}

HKCR\CLSID\{47B83D78-F986-4E96-9769-2C55EF14DA0B}

Trojan.Smitfraud Variant

HKLM\Software\Classes\CLSID\{de5ede53-9db0-422d-b32d-5c41c96d6f52}

HKCR\CLSID\{DE5EDE53-9DB0-422D-B32D-5C41C96D6F52}

HKCR\CLSID\{DE5EDE53-9DB0-422D-B32D-5C41C96D6F52}\InProcServer32

HKCR\CLSID\{DE5EDE53-9DB0-422D-B32D-5C41C96D6F52}\InProcServer32#ThreadingModel

C:\WINDOWS\SYSTEM32\IKLQCX.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\SharedTaskScheduler#{de5ede53-9db0-422d-b32d-5c41c96d6f52}

Malware.SpyLocked

HKCR\videoaccessactivex.Chl

HKCR\videoaccessactivex.Chl\CLSID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Windows Safety Alert

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Windows Safety Alert#DisplayName

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Windows Safety Alert#UninstallString

Malware.VirusProtectPro

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\BPumAnixoRp

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\bUvrcpmMlVrxH

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\epvfvvtj

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\flibxwljvi

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\InprocServer32

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\InprocServer32#ThreadingModel

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\kgKzUwdy

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\ljujcmwjuzz

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\ProgID

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\Programmable

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\TypeLib

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\Version

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\VersionIndependentProgID

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\wfjs

HKCR\CLSID\{45C2FDBE-1D46-B98E-F9A9-9D44B93A9D52}\yuigmkVgduuNI

HKLM\Software\VirusProtectPro 3.7

HKLM\Software\VirusProtectPro 3.7#refid

C:\Program Files\VirusProtectPro 3.7\blacklist.txt

C:\Program Files\VirusProtectPro 3.7\Lang\English.ini

C:\Program Files\VirusProtectPro 3.7\Lang

C:\Program Files\VirusProtectPro 3.7\Logs

C:\Program Files\VirusProtectPro 3.7\msvcp71.dll

C:\Program Files\VirusProtectPro 3.7\msvcr71.dll

C:\Program Files\VirusProtectPro 3.7\Quarantine

C:\Program Files\VirusProtectPro 3.7\VirusProtectPro 3.7.url

C:\Program Files\VirusProtectPro 3.7\vpp.dat

C:\Program Files\VirusProtectPro 3.7