Is there virus in this program?

On Thu, 20 Dec 2007 15:51:10 -0800, Andrea L. Johns wrote:

> Can you please tell me if this PowerDVD program has virus inside?
> http://www.4shared.com/dir/5013147/9a3ab9ea/sharing.html

Download to desktop but don't install; Then scan with an updated AV
application. Alternatively you can submit a sample to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's
scanners. That will give you an idea what it is and who recognizes it. In
addition, unless told otherwise, Virus Total will provide the sample to all
participating vendors.
You can also submit a suspect, one at a time, via the following email
URL...
mailto:scan@virustotal.com?subject=SCAN
OR
(http://www.virustotal.com/)
(http://virusscan.jotti.org/)

> Most of our XP systems in this office are infected with TROJ_MUDROP.M virus.
> This tech support department has been busy trying to reload as many systems
> as fast as we can. We are unable to pin point how we got infected. But, all
> these systems were supposedly protected with each of either Trend Micro or
> McAfee or Norton (we are told to keep each computer with its original loaded
> antivirus programs, because of license) were not much used.

If you think all one has to do is installing a software suite to protect
your computer then you're dead wrong.

If you think with a security suite in place everything is done which one
can possibly do to have security then you're even wronger.

If you're really concerned about the security of your computer and data
then you just will have to learn the rules how to keep secure.

The only reasonable way to deal with malware is to prevent it from being
run in the first place. That's what AV software or Windows' System
Restriction Policies are doing.

> So, we are trying to pin point how were we infected. We isolated many of the
> infection program date started inside Microsoft Explorer's Temporary
> Internet File folder.

Download David H. Lipman's MULTI_AV.EXE from the URL:
http://www.pctipp.ch/downloads/sicherheit/35905/multi_av_scanning_tool.html

The web site is in German but the MULTI_AV scanning tool is in English.
Anyway, go down to near of the bottom of the page and you'll see a box
titled "Infos Zum Download - Multi-AV Scanning Tool". You'll see: Download
von www pctipp.ch and the link to download:
>> Multi_AV Scanning Tool 5.01 (679.88KB) -

Once you've clicked this link, it will bring to:
http://www.pctipp.ch/index.cfm?pid=1411&pk=28470.

You will have to wait for a few seconds or so and the 'Download file'
window should appear - just follow the prompts to download Multi_AV.exe

If however the 'Download file' window does not appear don't panic, don't
click, don't do anything, just look for:

Der Download started in wenigen Sekunden automatisch.
Fall nicht, klicken Sie bitte -hier-.

Translated to English:
The download process is going to start in a few seconds.
If not, click -here-.

This should be pretty self-explanatory.

Additional Instructions:
http://pcdid.com/Multi_AV.htm
Ignore the links displayed within this site as they are not valid anymore
and have not yet been updated to current status.

Still no luck? Go to:

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Read, comprehend and implement.

Also:
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)

Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)

Once done 'run HijackThis' save a scan log and post it to any of the
following (expert) forums for analysis.

*Note, registration is required prior to posting a log.
- Not listed in any particular order -

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a...0bff6&s
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13

Good luck
 >> Stay informed about: Is there virus in this program?