Hi Everyone! I uploaded the 8 part Norton Internet Security Review to YouTube. You can watch any of my reviews by going to YouTube.com/mrizos.
NIS2009 performed pretty well! It removes a lot of serious malware, however it leaves behind a little adware (vundo) and a few trojan downloaders (the exe’s). Here is the HiJackThis log after a FULL scan and removal. Items bolded are malware files or malware based registry entries that NIS2009 did not detect:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:40 AM, on 9/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesNorton Internet SecurityEngine16.0.0.125ccSvcHst.exe
C:Program FilesJavajre1.6.0_04binjusched.exe
C:Program FilesVMwareVMware ToolsVMwareTray.exe
C:Program FilesVMwareVMware ToolsVMwareUser.exe
C:WINDOWSsystem32regsvr32.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesVMwareVMware ToolsVMwareService.exe
C:Program FilesNorton Internet SecurityEngine16.0.0.125ccSvcHst.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSsystem32wuauclt.exe
C:WINDOWSSoftwareDistributionDownload66b1d8e81a20b4b541ab3e558f2fd638updateupdate.exe
C:Program FilesJavajre1.6.0_04binjucheck.exe
C:Program FilesTrend MicroHijackThisHijackThis.exe
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://google.com/
O2 – BHO: (no name) – {01BA2111-5518-D0C8-A667-01E739079356} – C:WINDOWSsystem32tnxqilzf.dll (vundo)
O2 – BHO: (no name) – {182C7ED7-E56D-4509-9D9B-AC49318D9895} – C:WINDOWSSystem32urqqrsr.dll (file missing)
O2 – BHO: Symantec NCO BHO – {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} – C:Program FilesNorton Internet SecurityEngine16.0.0.125coIEPlg.dll
O2 – BHO: Symantec Intrusion Prevention – {6D53EC84-6AAE-4787-AEEE-F4628F01010C} – C:Program FilesNorton Internet SecurityEngine16.0.0.125IPSBHO.DLL
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:Program FilesJavajre1.6.0_04binssv.dll
O2 – BHO: (no name) – {7C109800-A5D5-438F-9640-18D17E168B88} – (no file)
O2 – BHO: 717305 helper – {963916CD-6311-485D-93DC-3BD1B9E2D2CB} – (no file)
O3 – Toolbar: Norton Toolbar – {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} – C:Program FilesNorton Internet SecurityEngine16.0.0.125coIEPlg.dll
O4 – HKLM..Run: [SunJavaUpdateSched] “C:Program FilesJavajre1.6.0_04binjusched.exe”
O4 – HKLM..Run: [VMware Tools] C:Program FilesVMwareVMware ToolsVMwareTray.exe
O4 – HKLM..Run: [VMware User Process] C:Program FilesVMwareVMware ToolsVMwareUser.exe
O4 – HKLM..Run: [wofgrqls] C:WINDOWSsystem32wofgrqls.exe
O4 – HKLM..Run: [apadibub] regsvr32 /u “C:Documents and SettingsAll UsersApplication Dataapadibub.dll”
O4 – HKCU..Run: [MSMSGS] “C:Program FilesMessengermsmsgs.exe” /background
O4 – HKLM..PoliciesExplorerRun: [rTwrdHqj21] C:WINDOWSwpopejyl.exe
O4 – HKLM..PoliciesExplorerRun: [J286hthVnp] C:WINDOWSwpopejyl.exe
O4 – Startup: LimeWire On Startup.lnk = C:Program FilesLimeWireLimeWire.exe
O7 – HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, DisableRegedit=1
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O15 – Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 – DPF: {2F0E7094-51A2-ECEB-8CF6-EF32B5ECD15E} – http://virusremover2008.com/VRM_Free.exe
O16 – DPF: {7D5DD829-6C90-42C5-B54C-2AFA82F988BA} (CLoader Object) – http://www.av-xp2008.com/tools/virusremover.dll
O16 – DPF: {C931FDF3-0319-0CAE-6DFD-8D061EABF08D} – http://virusremover2008.com/VRM_Free.exe
O21 – SSODL: zip – {177ab526-6b94-4cc2-b303-c1b6a4070316} – C:WINDOWSInstaller{177ab526-6b94-4cc2-b303-c1b6a4070316}zip.dll (file missing)
O21 – SSODL: CheckMon – {b62df42a-0f78-46d6-81d0-3f0ae0d8dc6b} – C:WINDOWSInstaller{b62df42a-0f78-46d6-81d0-3f0ae0d8dc6b}CheckMon.dll (file missing)
O22 – SharedTaskScheduler: frowardness – {b0fdc513-46b9-46fc-8e70-d575ee546dae} – (no file)
O23 – Service: Norton Internet Security – Symantec Corporation – C:Program FilesNorton Internet SecurityEngine16.0.0.125ccSvcHst.exe
O23 – Service: VMware Descheduled Time Accounting Service (vmdesched) – VMware, Inc. – C:Program FilesVMwareVMware Toolsvmdesched.exe
O23 – Service: VMware Tools Service (VMTools) – VMware, Inc. – C:Program FilesVMwareVMware ToolsVMwareService.exe
–
End of file – 4441 bytes
Over all, that’s not too bad. The malware left behind could easily be removed with a combination of mbam and sas (or it could be removed manually).
I have to really hand it to Symantec, their products are getting better and better these days!!! …com’on you’ve got to admit it…
