how do I get infested with limited xp account? how is it possible?!

[Anandtech787]

Hello all,

I do full scan using latest updated Malwarebytes this weekend about few days ago.. Found NOTHING wrong with it at all.. Malwarebytes claims to be able to detect the "SecurityTool" vrius, thus this rules out the theory that my virus was lying dormant for months on end, etc..

So therefore this had to be a recent infection..

My computer is Windows XP Pro and I have it LOCKED DOWN (meaning I don't use admin profile, admin profile has long password, and I'm using only the "User" level with no admin privileges..) Two other people share this home computer, they are mostly computer illiterate and do NOT know my admin password..

Suffice it to say, this morning everything was working as normal, and tonight I come home to find this extremely nasty "SecurityTool" virus, could not get rid of it.. (can't even open regedit or notepad, the whole thing just takes control and comes to the forfront again..) so I had to do a complete reformat..

My question is, if just two days ago I did complete full scan with Malwarebytes (and I'm thinking Malwarebytes can find "securitytool" virus..) and I have my computer LOCKED DOWN with no admin or even power user privileges how did this virus find its way on my computer? How does it have rights to install itself and hijack my XP system?

Anyone?

The really funny/strange thing is, I set my AT&T 2wire network to as secure as possible, I have also set the freaking Windows XP firewall to block all unknown and DO not allow exceptions..

I am 100% sure my Windows user account is locked down with only bare minimum user privileges (no admin) and the default admin account is chained with a STRONG password.. No one else knows this password.

How can this happened?!?!?!

When I set my account to "user" mode with no poweruser or admin access privileges I can't even change the system time, I can't even install any programs or access the program files/ windows/ system32 directories to make any changes to any files..

So how is it possible that virus install itself? Does virus have root access somehow?!?! So if a virus can gain admin access even on a locked account then does that mean it is possible to make a program that can do things on locked account that has equal power of admin account?!

What happened to rings of execution privileges? What is the point of admin/user account differentiation if the security can be bypassed so easily?

I'm saying I had my system on locked down.. user access .. no admin no privileges.. How would the XP kernel even allow virus to do such a thing?

 

[sourceninja]

All security has holes and bugs. It's obvious that said piece of software must of exploited one of them.

 

[compman25]

Just curious, what anti-virus software do you use?

 

[Lemon law]

I do not know if this will make you feel better or worse, but it could be a false alarm.

http://www.spywarevoid.com/remove-lsasblasterkeylogger-and-lsasblasterkeyloger.html

And your problem may be due to using a rouge security program, that instead of protecting you, downloads malware.

 

[elcamino74ss]

a non admin account is just to help but a local user account still has rights and some exploits/drive by downloads can install without admin rights. those fake av ones are rather nasty to clean up. check your hosts file first so you can start clean up

 

[tzdk]

May be a hint as to why they made Vista and UAC Think of account trick as user control more than malware protection - or don't be too happy about strong passwords and locked users. I have no clue about Vista/7 UAC being "cracked", doubt it as of today, but no surprise if XP has been easy target since forever.

You can remove such crap fairly easy. http://www.bleepingcomputer.com/virus-removal/remove-security-tool

Note step 20. Could be why Malwarebytes have closed eyes.

 

[MrPickins]

You probably clicked a pop-up that installed SecurityTool. (It's a fake anti-virus)

http://www.bleepingcomputer.com/virus-removal/remove-security-tool

Get firefox and NoScript.

 

[Red Squirrel]

May be a hint as to why they made Vista and UAC Think of account trick as user control more than malware protection - or don't be too happy about strong passwords and locked users. I have no clue about Vista/7 UAC being "cracked", doubt it as of today, but no surprise if XP has been easy target since forever.

You can remove such crap fairly easy. http://www.bleepingcomputer.com/virus-removal/remove-security-tool

Note step 20. Could be why Malwarebytes have closed eyes.

The problem with the UAC concept is that it prompts for EVERYTHING so after a while the user is just conditioned to always click yes. Also I'm sure malware is designed to execute in a way to bypass UAC anyway. UAC is only really good to warn less knowledgeable people that they are about to enter something that could mess up their system if they don't know what they're doing.

Also I find limited or full access accounts have little to no difference in the windows world. Most IE viruses just walk right through and go straight to the system. They don't care what type of access the logged in user has. I work in IT and users don't have admin rights yet we see virus infections often enough. Most, if all of these are through IE exploits.

 

[macd7]

http://pm.beyondtrust.com/company/pressreleases/03Feb2009.aspx

I think its definitely harder to infect a limited user account. Most important thing is keeping all applications up to date, there are exploits that work in firefox or other apps no matter what OS you have and no matter what the account privileges are.

I think the original poster should be asking himself what apps he has installed, what apps are out of date, if he has a software restriction policy, is an anti-virus monitoring the system, what OS is he running and any other security measures used like DEP or sehop, etc, and most of all what sites have been visited and what has been downloaded.

 

[tzdk]

I was more thinking of protecting system files/folders including hosts file and IE than dumb prompting. You can dismiss even the best HIPSY firewall with that "user just click anyway" argument. And many times you should, heh. If it can go wrong it will go wrong is how some compute out in the real world.

64bit helps as well... but as I said it is probably wise to only regard this account set up as a way of managing users, not so much as a flawless guard against malware. Does not matter which Windows. Subscribe to "matter of time" theory even if whatever has yet to be exploited. Rootkits on 64bit Windows is still up for debate? Without knowing too much I would say this about accounts being waste of time depends a lot on which Windows version. I can believe XP is hopeless in 2010, at least can be proven to be that "great", if and if, but afaik UAC in modern OS is not just a gimmick. But do give some links Some are of course trying to break it regardless of whoever is logged in. What was true yesterday can be BS today, how it is with security.

Seems to me most of those who get into trouble are using XP or not using later Windows correctly? Is that a wrong sense of facts?

Dumb prompting is almost cured by chosing "silent" UAC btw. Should be a choice in 7, in Vista it is a "tweak". I think MS should have made "disable" feature a tweak and silent mode a tickbox in Admin account.

 

[snikt]

Where the malware is installed can determine how it gets installed as well. If the malware is written to install in the user's profile, i.e C:\Document and Settings, that's where it will be installed since users have Full Control over their own profile folders, unless NTFS permissions are modified by admin.

According to the link below, this particular malware is installed in the user's profile. Its noted towards the bottom of the page.

http://www.bleepingcomputer.com/virus-removal/remove-security-tool

 

[MrChad]

As others have mentioned, it is certainly possible for malware to install itself in a user profile folder even if you are running as a limited user account. The limited account will limit the malware's ability to propagate into your system files, however, and it should make it easier to remove once you figure out what/where it is.

I noticed in your screenshot that you have Security Center alerts (red shield icon in notification area). This means you have missing / out-of-date AV software, updates turned off or your firewall disabled. Are any of these the case?

Also I find limited or full access accounts have little to no difference in the windows world. Most IE viruses just walk right through and go straight to the system. They don't care what type of access the logged in user has. I work in IT and users don't have admin rights yet we see virus infections often enough. Most, if all of these are through IE exploits.

Exploits that allow viruses to elevate their privileges are pretty rare. In most cases, a limited user account + a decent and up-to-date AV program + a good software restriction policy will stop almost all viruses dead in their tracks, even if your users run IE.

 

[Lemon law]

The other thing to note is that many exploits are conditional. What ails you may have been hidden on your computer for months or years, just waiting for a buffer over run to occur. Sometimes the best way to prevent such buffer over runs is patch windows and use secunia to identify outdated programs with known security holes.

And once your computer becomes even temporarily vulnerable, one piece of malware can install in milliseconds, and then instruct your PC to down load more malware. Some of which disables existing security programs.

That is why a process control program or two is a must, as it will seek user input before allowing that first piece of malware to install.

 

[dyn2nvu]

I just had this virus problem on a computer I'm working on. First get sdfix and combofix, download them, and run them in safe-mode, one at a time. (XP only)

http://www.bleepingcomputer.com/forums/topic131299.html

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Then delete all the temp files on the computer from firefox and IE in all the profiles.

Delete the java cache.

Most likely you have sun java.

http://java.com/en/download/help/plugin_cache.xml

You should be okay now. But to be sure...

Run malwarebytes again in safemode, make sure you have it updated.

Run an online virus scanner, like http://www.eset.com/onlinescan/

 

[VirtualLarry]

Contrary to popular belief, limited-user accounts can become infected by drive-by downloads just as easily as admin accounts. The difference is, the damage is limited to that particular account, and it cannot install itself as an admin program, and cannot infect other accounts on that computer, as far as I know.

The benefit of limited-user accounts in XP Home is itself very limited, but with XP Pro, you can enable Software Restrictions Policies, to block nearly every kind of drive-by malware from ever getting a chance to execute on your system.

It's a crying shame that MS hasn't taken this capability, and beefed it up, and made it more prominent in newer windows versions. It is easily as strong, if not stronger, than any anti-virus software. Plus, it doesn't bog down your system like an anti-virus does.

 

[SirGeeO]

^there lies your point and yet your answer all in the one.....that keeps the money flowing in.. *pss pss*