To Customer Support To Customer Support

Possible undetected infection: dropper64.exe_Trojan.Crypt

  • 21 January 2014
  • 7 replies
  • 48 views
garlicwebroot
Rank
Userlevel 3
Please see VT report: Virus Total report
 
So I found and file and scanned it with VT and it came up nasty. Wanting to test WSA I decided to run it and it did execute then the file disappeared from desktop. Nothing seemed to happen so I figured WSA was monitoring the program. I recall watching a video by WSA employees talking about how WSA will monitor a file it doesnt know and wait till it does something bad. Anyway, I decided to scan with HitMan Pro just for the heck of it, HitMan Pro did detect 3 Trojan temp files. I did not do anything about the detections. I rebooted the PC and it locked into an endless boot cycle, typical symptom of malware.
 
Now here is the part I don't understand. I had WSA heuristics set to the highest level, I also had the firewal set to prompt for any file it doesnt recognize, not just when infected. WSA did not make a peep at all, not a single things as far as  could see. So did this file get past WSA? What did exactly happen? I have the file URl or I can send ot zipped to anyone that wants it. I really want to know why WSA failed, if it did in fact fail.
 
Thank you for your help.
__________________________________________________________ check out my idea and vote for it if you agree! https://community.webroot.com/t5/Ideas-Exchange/Ability-to-disable-quot-security-disabled-quot-warnings/idi-p/77439

7 replies

Rakanisheu Retired
Userlevel 7
So Hitmanpro removed the infection and now the PC wont boot? The file isnt too common and has only been seen on two PC`s with one of those being a malware sample PC (guessing the other one is your PC). 
garlicwebroot
Rank
Userlevel 3
No, Hitman Pro only detected the infection, which is why i ran it. I did not have it clean or quarantine anything.
 
The PC would not boot, correct. I reimaged it.
 
 
even with the virus being new, is it strange that not a single warning came or anything? Let alone the boot issue
__________________________________________________________ check out my idea and vote for it if you agree! https://community.webroot.com/t5/Ideas-Exchange/Ability-to-disable-quot-security-disabled-quot-warnings/idi-p/77439
Rakanisheu Retired
Userlevel 7
To be honest I can say as I have no idea what hitman pro did (or tried to do). Looking at the behaviour of the dropper I dont see anything that would really cause a boot issue. 
garlicwebroot
Rank
Userlevel 3
I am no expert on HitMan Pro, but all i did was use it to scan, i never had it perform any tasts, do you really think it was HitMan that caused the boot issue?
__________________________________________________________ check out my idea and vote for it if you agree! https://community.webroot.com/t5/Ideas-Exchange/Ability-to-disable-quot-security-disabled-quot-warnings/idi-p/77439
Rakanisheu Retired
Userlevel 7
Without data from the PC I cant tell, since its been re-imaged we will never know what exactly happened. I could test the malware but since its in a completely different enviroments its not going to have the same results.
garlicwebroot
Rank
Userlevel 3
oky thats understandable. Can you tell me why WSA didnt detect anything or even prompt when i executed it? Is that normal?
__________________________________________________________ check out my idea and vote for it if you agree! https://community.webroot.com/t5/Ideas-Exchange/Ability-to-disable-quot-security-disabled-quot-warnings/idi-p/77439
Rakanisheu Retired
Userlevel 7
The file wasnt marked bad in the database so on your PC it was montioring (journalling) the file. 

Reply


Terms & Conditions

© 2004 - Webroot Inc.

We have recently updated our Privacy Policies. We encourage you to read the full terms here.