Trojan.Pidief.G

NAV2008

Vista Home Premium 32 bit, service pack 2

 

Just moments ago I was on yahoo.com. Clicked on a story from the yahoo home page.

Norton box popped up on the lower right hand corner of the screen indicating the following

 

Auto Protect has detected Trojan.Pidief.G

 

when I look in my recent history I see

Component :  Auto Protect

Action Taken: Blocked

Status: Blocked

 

It says -  Recommended action- Resolved no action

 

File name/affected areas

C:\Users\My-PC\AppData\Local\Microsoft\Windows\TemporaryInternetFiles\Low\ContentI.E5\

then a whole string of letters and numbers ending in .PDF

 

What if any actions do I need to take next? Do I need to go into the location in temp internet files and remove that item?

Does this mean auto protect prevented the item from getting on my system or detected it ON my system?

Action Taken: Blocked

 

It was an PDF-Exploit which Norton has blocked!

Are you sure that you were surfing on real Yahoo page?

 

You should be safe now!

 

You can read more about this Threat on this Page:

http://www.symantec.com/security_response/writeup.jsp?docid=2009-072209-2512-99&tabid=2

 

If you want to be sure that you are safe and not infected you could try a scan with Malwarebytes Anti-Malware, its free!

http://www.malwarebytes.org/

 

thanks

 

yes I was on the real yahoo page. Clicked a story on the front page

so was this coming from the yahoo page? If not where did it could it have come from? Something internal from my system? I did not notice and inbound activity through my firewall at the same time

 

 

Were you only surfing on yahoo page or also on other pages?

As i don't use or visit yahoo page i cannot tell you if it came from yahoo page!

It came from your Browser (i think)!

 

Please dont forgett to use Windows Update and also update Adobe PDF and Adobo Flash Player to newest version, older versions may have security holes which allow trojans to enter your system!

NAV2008

Vista Home Premium 32 bit, service pack 2

 

Just moments ago I was on yahoo.com. Clicked on a story from the yahoo home page.

Norton box popped up on the lower right hand corner of the screen indicating the following

 

Auto Protect has detected Trojan.Pidief.G

 

when I look in my recent history I see

Component :  Auto Protect

Action Taken: Blocked

Status: Blocked

 

It says -  Recommended action- Resolved no action

 

File name/affected areas

C:\Users\My-PC\AppData\Local\Microsoft\Windows\TemporaryInternetFiles\Low\ContentI.E5\

then a whole string of letters and numbers ending in .PDF

 

What if any actions do I need to take next? Do I need to go into the location in temp internet files and remove that item?

Does this mean auto protect prevented the item from getting on my system or detected it ON my system?

You stated you think it  came from my browser- does that mean my browser is infected? I scanned the browser with Malwarebytes and Norton, both come up clean.

 

My Java, Adobe reader, and Adobe Flash are all up todate as is my Vista OS

 

Could this have been a false positive??

No, no! You understoond it wrong!

With "it came from browser" i mean it came while you were browsing on a page and you clicked something that you shouldn't click on and from that link the PDF-Exploit tried to infect your computer through your "browser", but Norton has blocked it!

Try a quick scan or full scan with Malwarebyte's if you want to be sure that your computer is clean!

 

I dont think it was a false positive, on PDF files the False Positive possibility is low!

 

More about this threat:

Exploit.Pidief.G exploits vulnerabilities found in Adobe Flash Player and Adobe Reader to drop and download additional malware onto infected computers.

 

Edit: Just found this, you can read more about the threat!

 


The authors of the exploit have managed to take a bug and turn it into a reliable exploit using a heap spray technique. Typically an attacker would entice a user to visit a malicious website or send a malicious PDF via email. Once the unsuspecting user visits the website or opens the PDF this exploit will allow further malware to be dropped onto the victim’s machine. The malicious PDF files are detected as Trojan.Pidief.G and the dropped files as Trojan Horse.

 

 

http://www.symantec.com/connect/blogs/next-generation-flash-vulnerability

so is there anything more I need to do? Do I need to go into the temp files and find this entry and delete it?

There is nothing in the quarantine folder of My Norton history

 

Did scan with up to date maleware bytes and spybot with nothing detected

No, you are clean and safe!

Blocked means that Norton has blocked the .pdf file from entering your Computer!

 

I would clean the browser history, cache and temporary files!! You can use CCleaner!

 

And also i would try to get Norton 2010 as it has much more security functions and is much faster than 2008!

So any sense how this could have happened? I was just on m.www.yahoo.com  and clicked on a story about reducing debt that was on the front page which took me to shine.yahoo.com so it was legit.

 

Could it be an infection in my browser? But then wouldn't it cause problems more than just once?

Could it be that the particular yahoo page was compromised? Anyone else experience this morning?

Hi Calls,

 

Most likely the page you visited had been compromised, or an advertisement on the page was malicious.  This particular bit of malware uses vulnerabilities in Adobe Reader and Adobe Flash Player that were patched last summer.  So, if you have been diligent in keeping your software updated there is no way you could have been infected by this, even had Norton not had an attack signature for this exploit.  You can clear your browser cache and temp files just as a matter of good housekeeping.

 

http://www.adobe.com/support/security/advisories/apsa09-03.html

 am surprised that this did not happen to more people. it was a story on yahoo front page and then when I clicked the story it took me to shine.yahoo.com  that sounds like a legit site and my guess would be a popular one.

 

So it doesn't sound like it has something to do with my browser, but rather the website itself?

I encountered problems with my computer last night involving this and another trojan horse let me explain. While my daughter was on the computer at Neopets and Photobucket under her profile, something popped up informing her about a virus. Unfortunately, she didn’t call me in to see it and just clicked OK….well you know what happened next. Explorer would not work under her profile. When I opened Norton Safety Minder and looked at her activity, laptopantivirus.net showed up like three times in a minute. I logged on under my profile, googled it and discovered it was a hijacker malware. I scanned with Norton 360 and Trojan.pidief.G and Trojan.fake.AV was found. Went to the Norton site and they say to disable system restore, run a complete scan, restart and turn system restore back on. I did that yesterday and explorer under her profile would still not run. Get the white screen with the “run diagnosis” button. It did work on my profile. Explorer was working earlier today under my profile. My daughter logged on hers to play Sims3. My wife logged her on to ours so she could edit a picture in Photobucket and Explorer just bogged down completely. Had to unplug the computer to shut it down. I re-scanned, nothing new was found. I was able to get on Explorer via Programs/Norton Products. When I googled laptopantivirus.net, the article talked about possibly having to manually edit the registry. The site also had a patch to fix it. Norton doesn’t address this the same way. I did run the registry cleaner in Norton 360. I’m afraid to run any other antivirus program since I know Norton can have serious problems when you introduce a second antivirus program. Recommendations???

Hi Bagger

 

You can try running a full scan with the free version of Malwarebytes to see if that will clean it up properly. The free version of Malwarebytes works fine with your Norton product.

 

Download the free version, install and update then run a FULL scan. After the scan completes you should post the logs back to this thread.

You can find Malwarebytes here

http://www.filehippo.com/download_malwarebytes_anti_malware/

It is a safer location to get the program from than malwarebytes themselves because some malware creators have large lists of sites that they block. Please be careful to down load the correct program ----the FREE version of MALWAREBYTES

(Thanks to Delph for providing the alternative site)

bagger- In my case there was no phoney virus scan result pop up. I was just on yahoo.com and clicked a story that took me to shine.yahoo.com

 

Did you get an auto-protect status blocked message?

Thanks Floplot and SendofJive

 

So There is nothing further that I need to do? I don't have to clear system restore like bagger?

 

What I'm understanding is that the infection attempt never "got on" my system? Is that correct understanding?

 

Only thing that is throwing me off on this is why did the Norton message indicate that the affected area is

 

C:\Users\MyPC\AppData\Local\Microsoft\Windows\TemporaryInternetFiles\Low\Content.ie5\I3uls7rh\

then a bunch of letters and numbers random ending [1].pdf

 

so do I need to find that and remove it?

Calls…Not sure. My daughter was somewhat vague. Had to piece the scenario together by viewing the Norton Safety Minder activity log and History. She was on neopets and playlist when the laptopantiviurs.net showed up on the NSM activity screen. She said something did pop up but I’m not sure if it was Norton or something else. Going to run the malware bytes scanner now. Thanks everyone…will post results.

I have what may be a dumb question…just went to the link to get Malwarebytes 1.44. Every link I follow appears to take me to some other free download. The one that looks like will take you to the free downoad goes to Spyware Doctor. I’m assuming this is not what I’m looking for. I can’t to find the correct download.

Update…Pop up blocker was preventing the download. Got it installed and will be running it in a few.

Bagger,

 

  The Filehippo link above is the correct one , on the left of the page it does supply an offer for pc-tools spyware doctor-ignore that.. Instead look to the upper right column and see the "Download latest version" 4.88 Mb. It has a green arrow and blue words. I tried it and it was Malwarebytes.

 

 

Hope this helps.

 

 

[Edit] I was too slow in responding.... Apologies.... But glad you figured it out. lol.