Norton Internet Security / Norton AntiVirus

[Calls]

Ok induldge me as I step way out on a limb of the paranoid/conspiricy tree here.
Now let me prefrace this by saying this does not apply to everyone posting a problem with these trojans.
But what if some of this is a calculated attempt to make Norton look bad? It has already been pointed out that some of these posters are new to the forum. What if this is an attempt to say hey look Norton cant stop this, Norton cant fix this. An unpaid volunteer has to help these norton customers cause Norton can't.
We do know thhere are people out there whose ambition in life is to discredit norton.
Just wondering

[Kelly]

Calls,

In my line of work, some paranoia is required - it's in the job description - so I can relate.

I noted the same post, and I note the same pattern - most posters reporting trojan infections registered this month, and often on the date of their original first posts.  There are only a couple of exceptions.  Your theory is certainly a strong possibility, especially if you do a Google search for trojan zeroaccess - the top few result pages are links to the cases reported in this forum.  Coincidence or by design?  Hmmmmmmmmmm

I've certainly learned a lot from this thread (and other posts as well).  Firstly, Symantec's response (which is what I asked for in the original post) was quite informative.  Secondly, some of the follow-on explanations were quite helpful as well. 

Maybe one day when Quads can take a breather, he can give us a few thoughts on what he sees as the common threads running through these trojan infection reports (a stab as the likely root causes).  Maybe he already has, and I missed it, though a comment he made in one post said the problems are user-induced foot suicides, not a wholesale issue with NIS/AV.

I'm the IT tech in my family and circle of friends (that would tell you how little they know if they look to me as their computer guy), and out of six computers running NIS and three running 360, none of them have had any issues whatsoever.  I set the computers up for them, and I maintain them periodically - I must be doing something right, as I've had no cries for help from them.  I also have in my circle of friends and family some who are quite frankly knuckleheads - they know enough about computers to be dangerous, and not enough to know their limits.  They believe whatever their unknowing friends tell them, and do things like constantly download from P2P sites, run two or more real-time AV programs, haven't updated their OS in over a year, and think those things that pop up and beg you to update are nuisances and hence they ignore them.  You know the type, the ones still running Adobe Reader v6, and are still running WinXP current with SP TWO.  One of my nephews let his AV subscription expire, and had been convinced that if he scrapped IE and go to Firefox he could get rid of the AV software.  Bless his heart (which is southern for ummm idiot).

At the end of the day, I remain confident both NIS and N360 are doing the job quite well.

Regards,

Kelly

[Kelly]

And further to Calls' observation -

I browsed through the French and German forums (I'm competent with both languages) to see what's going on there.  Strange, there's little mention of it in either forum.  In the German forum there's only one recent mention of a trojan.gen detection that Norton successfully blocked, and the poster was wondering if he was really safe.  Most of what's going on in those forums deal with subscription issues, minor issues with browsers - all definitely tame and quiet there compared to the frenzy of trojan infections and requests for removal help reported here.  So the possibility of self-infection and a deliberate effort to cause chaos is not far-fetched. 

Regards,

Kelly 

[Quads]

Attached is a ZA dropper analysis

Quads

[Kelly]

Thanks, Quads!

[joen]

c:

> what if some of this is a calculated attempt to make Norton look bad?

> It has already been pointed out that some of these posters are new to the forum.

Think about your car.

If you are a typical car owner -- meaning someone who just uses it for transportation --  do you frequently drop by your local repair shop just to chat with a mechanic?

Or do you just see the mechanic when you have a problem with the car?

Now replace "car" with "computer."

Those of us who are into computers, want to understand the details of those computers and the software that they run, frequent this and other forums.  We are not typical of the average computer user.

[joen]

k:

> most posters reporting trojan infections registered this month,

> and often on the date of their original first posts. 

When you look at the bell curve that shows "computer knowledge", that's what everyone in the _bottom half_ of the curve would do.  That is, get help only when they need it.

The probability of what you say is non-zero.  But the _sheer number_ of posts by _different_ forum members would be a huge task for someone.  And the other implication, a "conspiracy" of _lots_ of people, would be even less probable.  But not zero.

In any case, Symantec has the ability to rule out the case of one or a few posters doing that by simply looking at the IP addresses, which Symantec makes a note of for each post.  You can see it for yourself by looking at your profile.

[Quads]

---

joen wrote:

c:

> what if some of this is a calculated attempt to make Norton look bad?

> It has already been pointed out that some of these posters are new to the forum.

---

That't has nothing to do with it at all,   Most people may not get infected or just get a simple file come in that Norton can easily deal with, so why come to the forum, if you have no problem?? No need to.

Like users infected with TDL2 + FakeAV appear on the forum, Now clean they disappear from 2009, 2010 and not come back, no need to.

Expect one that had TDL2 back then and has appeard back the other day with another infection.

I noticed other things in the logs.

Quads

[twixt Regular Contributor]

---

Kelly wrote:

And further to Calls' observation -

I browsed through the French and German forums (I'm competent with both languages) to see what's going on there.  Strange, there's little mention of it in either forum.  In the German forum there's only one recent mention of a trojan.gen detection that Norton successfully blocked, and the poster was wondering if he was really safe.  Most of what's going on in those forums deal with subscription issues, minor issues with browsers - all definitely tame and quiet there compared to the frenzy of trojan infections and requests for removal help reported here.  So the possibility of self-infection and a deliberate effort to cause chaos is not far-fetched. 

Regards,

Kelly 

---

Hi, Kelly.  There are other possibilities:

1. The cohort of users who regularly and continually download pirateware have known for years that much of that software has virus, trojan, rootkit and bootkit droppers embedded in the software.  They know that installing this stuff is an open invitation to get infected eventually.

2.  Up until very recently, many of those users have simply accepted that having an infected machine is an acceptable tradeoff for the benefit of access to pirated movies/software/whatever.

3.  However, the latest developments in rootkit technology include annoyware-rootkits - along with the traditional stealth-rootkits.

4.  Furthermore,  Anti-Malware Software is getting quite good at being able to reliably detect "stealth" infections - no matter what the malware writers cook up to try and keep their infections hidden.

5.  The result of Items 3 & 4 is a rash of successful detections of rootkit/bootkit behaviour - which has not occurred in the past.  Many of the machines that have been running infected for months/years are now being "found out" by the latest Anti-Malware Engines that can strip away stealth-routines and reveal rootkit/bootkit infections as a matter of course.

6.  However, as mentioned by Quads in all his malware-infection-removal threads - as well as by myself in earlier posts in this thread - "Find" is not enough.  So what is happening is people are seeing the "self healing" process return their machines to an infected state very shortly after they supposedly "remove" the infection using an Anti-Malware Software Company's out-of-date rootkit/bootkit eradicator software.  And thus, infected users return to Item-5-status in ever-greater-numbers.

7.  Consequently, the load on Anti-Malware Forums such as BleepingComputer and MalwareBytes has increased.  The number of "braindead" has risen to levels where the Competent Malware-Removal-Experts are swamped with requests for help.  They have responded to this by creating Forum Policy where they refuse to aid people who cannot read, comprehend and correctly follow instructions.  IMO, rightly so.

8.  Bootkit/rootkit removal is not a procedure amenable to monkeydiddling.  It requires a combination of the detective skills of Sherlock Holmes, the surgery skills of Christiaan Barnard, the tenacity and dedication of Nelson Mandela and the patience of Job.

9.  Despite the rarity of the skillset mentioned in Item 8, the ever-increasing-number of people who fit Item-5-status - descend like hordes of flying monkeys upon Forums where Competent Malware-Removal-Experts are available.  Ergo, this Forum's massive increase in rootkit/bootkit eradication threads.

10. And then those who are regulars in the Forums here note the burgeoning list of rootkit/bootkit eradication threads - and ask the question which is the topic of this thread.

IMO, the increase in threadlist-frequency of dedicated bootkit/rootkit eradication topics is absolutely inevitable - when someone of the calibre and Competence of Quads is available to help those who are currently being regularly notified by their Anti-Malware software that they are infected.

Now, let's add into this the cohort of users who are being infected by Zero-Day Drive-by-Download attacks.  Some of these users are going to Porn Sites, Gambling Sites and various forms of fetish and sleaze sites where the people running those sites are leaving their webservers open to hijacking because they are not properly securing their websites from compromise.  Interestingly, Church websites are front and centre on that list as well - because so many of them are administered by volunteers with little to no training in Website Security practices.

Thus, more load for Quads and the other experts on BleepingComputer, MalwareBytes and so forth.

Conclusions that can be drawn from this thread:

1.  Could the burgeoning rootkit/bootkit eradication threadlist in this Forum be trolls at work?

      Absolutely.

2.  Is that the only explanation?  No.

3.  Do we have a way to tell the various types of infected users from each other?

     Quads knows something about that - simply as a result of the probes he needs to perform

      to detect the infections and variants in place on a user's machine before he scripts for removal.

      The topic doesn't get raised very much by experienced Malware-Removal-Experts because it

      leads to fingerpointing and flamewars rather than productive discourse.

4. Can Symantec make a post like I've just done?

     No.  The Lawyers at Corporate would have a fit, along with conniptions and kittens.

            

Hope this helps your understanding.

[Quads]

As to the other Norton language forums.

Hmmm,   I have had users for removal, from countries, in Europe (France, Denmark, Germany Sweden, Italy, UK etc,)  The USA and Canada,  Asia (Hong Kong, Japan, China, India (but I did send one way due to not good enough english))  Australia, South Africa, Kiwi Land.

They were the ones I can remember seeing by logs 

So by the fact they went to the English Norton Forums and not the others, doesn't really matter, maybe they don't have a Quads 

Doesn't really matter as long as they have good enough English for this.

Quads