Failure to block WD32.SillyDC

My laptop, which has Norton Internet Security 2009 running on it, had a camera memory card used on it. To my concern some time after the owner of the card said how pleased they were to access there images as their  computers antivirus (Avast) blocked the card as it had a virus.   

I ran Quick Scan and it found and it removed WD32.SillyDC. When I next rebooted I found some Word documents on the desktop had had doc amended to docx and some were greyed as was a desktop ini file. The former could be renamed and the latter took a number of attempts to remove it, it kept “coming back”. I have now run two full scans, used Spybot none of which have found anything.  

My concern is why could a free antivirus provide better protection than a paid for one?  I ask this as someone whom until a month ago used Avast and changed to Norton thinking it would be better protection and feel very let down!

My install is on default settings so maybe there is something I need to change, but again I am not very impressed that Norton by default offers les protection than Avast by default!

My laptop, which has Norton Internet Security 2009 running on it, had a camera memory card used on it. To my concern some time after the owner of the card said how pleased they were to access there images as their  computers antivirus (Avast) blocked the card as it had a virus.   

I ran Quick Scan and it found and it removed WD32.SillyDC. When I next rebooted I found some Word documents on the desktop had had doc amended to docx and some were greyed as was a desktop ini file. The former could be renamed and the latter took a number of attempts to remove it, it kept “coming back”. I have now run two full scans, used Spybot none of which have found anything.  

My concern is why could a free antivirus provide better protection than a paid for one?  I ask this as someone whom until a month ago used Avast and changed to Norton thinking it would be better protection and feel very let down!

My install is on default settings so maybe there is something I need to change, but again I am not very impressed that Norton by default offers les protection than Avast by default!

Thanks for reply my laptop is fully updated; its Vista and SP2 went on Tuesday! I have no idea of what updates their PC has, but that is less relevant than Avast DID block the camera memory card and Norton didn't on my laptop which is kept fully updated.  (the need to type the word verication is driving me mad, I am dislexic and its near impossable for me!}

Don't worry about dylexia here John7, we have a lot of users for whom English is a second or third language.  Our interpretation skills are honed.

 

As I mentioned, the moment of most vulnerability is at the moment of inserting a device.  It is not that Norton didn't recognize it, it was more of a case that it occurred before Norton was able to stop it.

 

Have a look at this Microsoft knowledge base article with applicable downloads to hopefully prevent this from happening again.

 

http://www.microsoft.com/technet/security/bulletin/ms08-038.mspx

 

I'll add this one as well as it is also helpful to the situation.

 

http://support.microsoft.com/kb/967715

 

When the MBAM scan is done, you can paste it here for us to review, if you wish.

Message Edited by delphinium on 05-30-2009 02:57 PM

http://www.microsoft.com/technet/security/bulletin/ms08-038.mspx covers Vista SP1, as I am SP2 don’t think safe to act on former build download?

 

With http://support.microsoft.com/kb/967715 Gpedit.msc came up with “no items match your search”?

 

I have found Control Panel\AutoPlay where you are able to change autplay for a wide range of devises and options as well as turning it off. Is this the same as autorun being off? The infection was via a memory card being used in the laptop memory card reader and I’m not sure what to do about that other than disable everything?

 

 

You said “When the MBAM scan is done”, the only MBAM thing I found was Malwarebytes' Anti-Malware and have run that with it not finding anything. Malwarebytes' Anti-Malware 1.37 Database version: 2199 Windows 6.0.6002 Service Pack 2 31/05/2009 12:22:51 mbam-log-2009-05-31 (12-22-51).txt Scan type: Full Scan (C:\|) Objects scanned: 155431 Time elapsed: 1 hour(s), 39 minute(s), 23 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected:

 

 

 The problem I have with dyslexia isn’t posts, spell checking works wonders, usually. It’s the security words when posting, I usually need a few attempts to get these right as I find it difficult to identify the words and to see if I have entered the same letters!

Message Edited by john7 on 05-31-2009 04:35 AM

 

I have found a way of making a test memory card to see if autorun is working, http://blogs.computerworld.com/test_your_defenses_against_malicious_usb_flash_drives.My one wasn't so owner of the memory card would have had to run a program, they say not, or it was attached to something else. It appears they had been using their camera and memory card on public PC's were digital camera training was being done.  As said in the original post as Avast blocked the card as soon as it was put in to their memory card reader. So it looks to me like it’s back to different antivirus programs worked  or in Norton’s case didn’t work in blocking a virus present on a memory card.

 



I have found Control Panel\AutoPlay where you are able to change autplay for a wide range of devises and options as well as turning it off. Is this the same as autorun being off? The infection was via a memory card being used in the laptop memory card reader and I’m not sure what to do about that other than disable everything?

 

 


You definitely want to disable autoplay in all devices.  That stops anything from automatically entering your system and gives you the time to scan the contents before allowing it in.  Please check in your settings in Norton through the main screen, computer pane>settings.  Scroll down and make certain that "Removable Media Scan" is set to "On" and "Advanced Sonar Protection" is set to "On."  I also have "Advanced Heuristic Detection" set to "Aggressive."

 

 

I have never used Avast so I am not aware of how that program works or how the settings might have been set up in your friend's computer.  It would not have been necessary for them to run a scan to find it, and as you say, they did not.  It would not normally have been necessary with Norton either.  

 

As I say, I have seen Norton respond appropriately to the Silly family of trojans, so I can only assume there would have been a difference in settings or a difference in function between Avast and Norton.

 

The other thing that can have an impact is conflicting programs.  Do you have Spybot S&D with Teatimer running at the same time.  Sometimes conflicting antivirus programs have trouble deciding who gets the bug and as a result, neither one does.

 

If you want On-Demand Scanners along-side Norton, I would Highly-Recommend Malwarebytes' Anti-Malware and SUPERAntiSpyware Free Edition; with Malwarebytes', do not Pay for it un-less you do not have an Anti-Virus Product on your computer.

 

I would first suggest you try the Removal Instructions for W32.SillyDC (below).  There is a Document on the "Summary" of the Write-Up which I would suggest you read.

 

I would also suggest Updating both Norton and Malwarebytes', re-start in to Safe Mode, and do a Full System Scan with Norton and Malwarebytes' of all Drivers, dis-connected from the Internet; this should be followed up by a Full System Scans with both Products in Normal Mode, dis-connected from the Internet.  Let us know how you get on!

 

 

Removal Instructions for W32.SillyDC:  http://www.symantec.com/security_response/writeup.jsp?docid=2007-011714-4020-99&tabid=3.

 

Malwarbytes' Anti-Malware for Windows: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=contentBody;mostPopTwoColWrap.

 

SUPERAntiSpyware Free Edition for Windows: http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html?tag=mncol.

 

Starting your computer in Safe Mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam.

 


delphinium wrote: 

Scroll down and make certain that "Removable Media Scan" is set to "On" and "Advanced Sonar Protection" is set to "On."  I also have "Advanced Heuristic Detection" set to "Aggressive."


The "Removable Media Scan" is On by De-fault.

 

I would also suggest Turning on "Early Load" under the Computer Settings > Real-Time Protection.

 

 

Thanks for repys, there is no other security running, it was due to conflicts between diffrent programs I changed to Norton so I have kept it simple. I hae turned early load on but don't really see how loading scanning early would do any diffrewnt in this case, a memory card used some time after booting?

I also don't know how avast and Norton may be set up, I do know the owner of the card (in there 70's) has little intrest/knolidge of software so will have a totally defult set up of Avast. To me this is worrying if the basic setup offers more protection than so far I have been able to set up in Norton!

I used Malwarbytes but not in safe mode. It took over an houre, when I have time I will give it another go. **bleep** said above it didn't fimd any thing nor did spybot.

Message Edited by john7 on 05-31-2009 03:31 PM

I have run as sujested the two scaners in safe mode and again found nothing. Norton removed the virus on the first scann, its not getting rid of it thats my concern. Its Norton NOT blocking it when the camera memory card was put into the laptop as Avast had done on the other PC!

The reason why you should have Early Load On is because Auto-Protect will Scan you Drivers as they are being Loaded-Up, so, Auto-Protect will have a greater chance of Detecting Threats as they are being Loaded-Up.

 

Thanks for the information. Its been anoying that there is no “manual” for Norton and so much is finding out how to use/set it up by trile and errer.


john7 wrote:
Thanks for the information. Its been anoying that there is no "manual" for Norton and so much is finding out how to use/set it up by trile and errer.

 

Open Norton Product > ? Help & Support > Support Resources > Quick Links: Product Manuals.

 

That link isn’t on my installs, I have Help, One Click Support, Subscription Status and Abut nothing else?


Floating_Red wrote:

The reason why you should have Early Load On is because Auto-Protect will Scan you Drivers as they are being Loaded-Up, so, Auto-Protect will have a greater chance of Detecting Threats as they are being Loaded-Up.

 


 

I thought 'Early Load' was just an Auto-Protect setting that applied to when you powered-on your computer.

john7 wrote:

That link isn’t on my installs, I have Help, One Click Support, Subscription Status and Abut nothing else?


 

Must have got ahead of myself there!  Go to One-Click Support and then Support Resources, and so on.  Sorry!

 

Message Edited by Floating_Red on 06-02-2009 06:58 PM

elsewhere wrote:

Floating_Red wrote:

The reason why you should have Early Load On is because Auto-Protect will Scan you Drivers as they are being Loaded-Up, so, Auto-Protect will have a greater chance of Detecting Threats as they are being Loaded-Up.

 


 

I thought 'Early Load' was just an Auto-Protect setting that applied to when you powered-on your computer.

 

That's Correct.  When your computer has been Off and you Turn it On, then that is when "Early Load" will Scan all the Files being Loaded-Up upon Start-Up. 

 

"Go to One-Click Support and then Support Resources, and so on. Sorry!"

 

 I did that and what a total waste of time it’s not a manual it’s the install instructions that you get with the CD! Is there no actual manual with Norton or do users have to find out by trial and error what to do or rely on others with more experience, as here, passing on what they have found out themselves?

 

Clearly its not your fault its a Norton problem!

I thought you'd say that.  L.o.l.!

 

When you Open-Up the Settings, the is a wee "?" next to each of the Settings; if you put your Curser/Arrow (excuse me?!) or Click on it, more Information should be Available as to what this Settings does/for. 

 

Maybe you could suggest a better Manual for Norton 2010 Products by suggesting it in the "Norton Internet Security Suggestion Box", if not already done so.