Test99Premium
join:2003-04-24
San Jose, CA
kudos:1 | reply to cbrain
Not Just Trixbox I recently installed a Windows port of Asterisk from this site: »www.asteriskwin32.com/ to evaluate it.
The next Zone Alarm scan discovered this nasty critter:
Win32.Backdoor.IRCBot.td
in c:\Program Files\cygroot\bin\cygwin.dll
This is the registry entry:
File: C:\Program Files\cygroot\bin\cygwin1.dll
Module: C:\Program Files\cygroot\bin\cygwin1.dll
RegistryKey: HKEY_CURRENT_USER\Software\Cygnus Solutions
RegistryKey: HKEY_LOCAL_MACHINE\SOFTWARE\Cygnus Solutions
I'm still investigating to see what I have to do to clean the system.
--
50775@fwd.pulver.com |
|
 tommy13vPremium
join:2002-02-15
Niskayuna NY | That DLL acts as a Linux API emulation layer providing the linux functionality. |
|
Test99Premium
join:2003-04-24
San Jose, CA
kudos:1 | said by tommy13v:That DLL acts as a Linux API emulation layer providing the linux functionality. Understood. What's not yet clear is where it acquired the ability to take orders from Internet Relay Chat.
--
50775@fwd.pulver.com |
|
BPremium,MVM
join:2000-10-28 | I'm betting (guessing) that it didn't, and that this is a false positive... Good luck. You could try running it by one of the multi-engine scanners (Jotti).
-- B
--
In a realm outside causality and function |
|
Test99Premium
join:2003-04-24
San Jose, CA
kudos:1 | said by B:I'm betting (guessing) that it didn't, and that this is a false positive... Good suggestion. You may be right. Scans thus far have not detected any other signs of intrusion. Writing malware detection programs must be a difficult assignment.
--
50775@fwd.pulver.com |
|
BPremium,MVM
join:2000-10-28 | Maybe, but I suspect the opposite -- that it's astonishingly EASY, at least as it's currently practiced, and that the rewards are so great that no one has to try very hard.
That's why free products (from AVG to the open source ClamAV project) can perform so well, and that's why the mainstream commercial offerings (McAfee and Symantec) are such festering mounds of bloated feces, and that's why the slightest little change in code lets malware continue to slip by the overwhelming majority of "detectors".
Yeah, it's a losing proposition because one person's trojan is another person's remote control feature, but that's not much excuse for today's shoddy state of affairs. When in doubt, just blame Windows. 
-- B
--
In a realm outside causality and function |
|
|
|
