...I was wondering if it might be possible to tell what the primary infection(s) might have been or even where they came from, ie internet browsing or downloading an infected executable. I even suspect my original install of nlite was infected from months ago, is this possible?
I can't say whether your original install of nlite was infected, this is out of my realm of knowledge as I honestly don't know anything about nlite. Though I can honestly say, as far as I know, your thread is the first one I have worked on with an nlite install AND this is the first time I have ever seen the BackDoor .Bifrost Trojan but this doesn't necessarily mean this nlite install was the reason for the infection, I just don't know.
But I can tell you a "bit" about the infections found. First of all they were Trojans, not viruses. Most anti-virus programs won't stop them or even find them. Spybot is an anti-malware program and generally doesn't stop items from coming onto the computer, though it certainly will remove many.
Trojan do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include spam emails, IRC, P2P networks, newsgroup postings, etc.
The ones found by the Dr. Web-Cureit program were
BackDoor .Bifrost. Bifrost is a backdoor trojan horse family of more than 10 variants which can infect Windows 95 through Vista which are the result of "drive by downloads" meaning these are installed without the users knowledge. This one is possibly the result of a Windows Metafile vulnerability in 2005 the Windows WMF exploit was used to drop new variants of Bifrost to machines. There is a patch available from Microsoft for this vulnerability.
Computers can also be affected via the spread of infected e-mails which may carry the hacked WMF file as an attachment. Infection may also result from:
* Viewing a website in a web browser that automatically opens malicious WMF files, in which case any potential malicious code may be automatically downloaded and opened. This includes Internet Explorer, the default Web browser for all versions of Microsoft Windows since 1996.
* Previewing an infected file in Windows Explorer.
* Viewing an infected image file using some vulnerable image viewing programs.
* Previewing infected emails in older versions of Microsoft Outlook and Outlook Express.
* Indexing a hard disk containing an infected file with Google Desktop.
* Clicking on a link through an instant messaging program such as Windows Live Messenger, AOL Instant Messenger (AIM) or Yahoo! Messenger.
I honestly cannot say how your computer was infected.
Now for anti-virus programs, like I said, they work to protect your computer from Viruses and a Trojan is not a virus. Myself, I use the FREE version of Antivir and am very satisfied with it. It doesn't automatically scan this must be done manually but it does automatically update, at the very least daily, sometimes more than once a day. I use Spybot for scanning and I also use MBA-M for scanning and it does normally remove most Trojans. I also use the Windows Firewall and also am very satisfied with it and I use SpywareBlaster. I wouldn't run my computer without it. It is FREE. It does NOT run in the background but it DOES protect a computer from spyware, adware, browser hijackers, and dialers and to quote it's website
Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
Block spying / tracking via cookies.
Restrict the actions of potentially unwanted or dangerous web sites.
I can tell you it works, without a doubt.
I would suggest to be safe that you run a scan with ESET Online scanner and allow it to fix or remove whatever is found. This online scan picks up a lot of things that other online scanners don't and it DOES fix.
- You will need to use Internet Explorer to to complete this scan.
- You will need to temporarily Disable your current Anti-virus program.
- Be sure the option to Remove found threats is Checked
- and the option to Scan unwanted applications is Checked.
- When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.
Let me know if it finds anything and their locations.
Reply With Quote
Originally Posted by philtro
But the entire system could have been 100% infection free right now if I had been given full information.
