Re: [security] Unusual Activity in Ad-aware 6 Personal, Build 6.181

[Shawn McMahon]

--6c2NcOVqGQ03X4Wi
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 20, 2004 at 10:36:16AM -0400, fedhead said:
>=20
> My apologise if I am posting in the wrong list but I am not sure if this =
is
> a known issue in Ad-aware or if this even is an issue with Ad-aware.

It's normal operation of Ad-aware.

> Seems benign enough. Every night when it runs, after the first scan of the
> registry, it creates four files in the C:\Program Files\Lavasoft\Ad-Aware
> 6\cache folder which Norton AV catches as trojan scripts:

Every day, you get infected again. Every day, Ad-Aware finds it.

Sounds like you've got an issue with Norton AV, not with Ad-Aware.

> The most unusual part is that it happens at the end of the registry scan =
in
> Ad-aware. A google search doesn't turn up any relation between this explo=
it
> and Ad-aware so it could be something unique to my system but at this poi=
nt
> I am at a loss as to what it could be.

Try "ad-aware cache" for your Google search next time.

http://www.lavasoftsupport.com/index.php?act=3DST&f=3D42&t=3D14501&st=3D0#e=
ntry115743


--=20
Shawn McMahon | Let's set the record straight. There is no argument
EIV Consulting | over the choice between peace and war, but there is
UNIX and Linux | only one guaranteed way you can have peace - and you
http://www.eiv.com | can have it in the next second - surrender. - Reagan

--6c2NcOVqGQ03X4Wi
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQFA2GIbEcl9bQ0RMt0RAmROAJ4vsx08lpGlKUVn9svLSR 4bM7vXgQCaAi6o
Wun5aM6mDXkMWabbFvqBKzU=
=pG6a
-----END PGP SIGNATURE-----

--6c2NcOVqGQ03X4Wi--

[Russell J. Wood]

--gBBFr7Ir9EOA20Yy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hello,

I just scanned my dad's PC with Ad-aware 6 Personal and monitored that directory
whilst doing so. No files turned up at all, and the directory was removed after
the scan was complete.

Maybe these files are placed there before being moved to quarantine?

- Russell

On Sun, Jun 20, 2004 at 10:36:16AM -0400, fedhead wrote:
>Seems benign enough. Every night when it runs, after the first scan of the
>registry, it creates four files in the C:\Program Files\Lavasoft\Ad-Aware
>6\cache folder which Norton AV catches as trojan scripts:
>
>exploit.chm
>installer.htm
>shellscript.js
>shellscript_loader.js

--gBBFr7Ir9EOA20Yy
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFA16xa5WL5lrZ5g2cRAjwcAJ9NT5KuwAVAkbpUFe2A99 BTiKPJ9wCeOp7O
lYfYG9n4pEV3oyglNobi2tY=
=uAKB
-----END PGP SIGNATURE-----

--gBBFr7Ir9EOA20Yy--

[fedhead]

I have tracked it down and Dave, your assessment seems to be correct for my
situation. Ad-aware was scanning an old Palm Attachment folder I had in my
profile which stored the attachments of e-mails I had synced with my Palm,
including my Bugtraq e-mail which contained Jelmer's zip of this IE exploit.

It would appear that Ad-aware stores the file its scanning into the cache
folder only fop the time length it takes to scan that file, thus when it
read the zip file, Norton AV also scanned the file and found the trojan.

Sorry for all the confusion everyone and thanks for the feedback.

Matt

-----Original Message-----
From: Dave [mailto:djm@mcoe.k12.ca.us]
Sent: June 22, 2004 10:58 AM
To: fedhead
Subject: Re: Unusual Activity in Ad-aware 6 Personal, Build 6.181


What did the ad-aware LOG say? I am also using ad-aware 6, I have a
"Cache" directory while ad-aware is actively scanning my system. When the
scan completed, the cache directory disappeared, probably because it had
nothing more to do other then remove cookies.

My best guess is AW is finding this trojan on your system, isolating it, but
not quarantining it. I would suspect that Norton is finding it after its
found by AW.

This is not a shock, Norton has frequently not found active exploits in the
past until another program "reveals" the hidden objects. Switch to Sophos
or McAfee, rescan your system to remove the exploit, and run Ad-aware
manually to see the logs of whats happening.