Quarantined Cable Modem

[elpsam59]

I was informed by my Cable Provider that one of my 2 computers (Desktop & PC) had a Trojan(s) present, thus they quarantied my access to the Cable Modem.

After using Ad-Aware and AntiVir on both, I found that my laptop had 7 instances of Trojans save on System Restores.

Can anyone tell me how that can happen? What can I do to prevent such an event from happening?

Looking forward to your replies.

elpsam59

 

[Harvey]

Practice safe hex. That is, update and run your AV and anti-spyware progs often. Be proactive, and don't rely on them to run in the background to keep you safe.

If you're using the old version of Ad-Aware (personal 6.0), it's no longer being updated, and the last reports and reviews I've seen about Ad-Aware 2007 are mixed, suggesting some have experienced as yet unresolved performance problems.

I used to love Ad-Aware 6, but those reviews are the reason I switched to the free version of SuperAntiSpyware, which appears to work quite well.

Being on the paranoid side, I also use the free version of Spybot. They had some performance issues when they first released ver. 1.5, but ver. 1.52 seems to have resolved those issues.

I use both. Neither interferes with the other or any other program.

Finally, use good backup. I have a second drive mounted in a mobile rack, and I use and older version of Norton Ghost to clone my drive immediately after running all my protection programs and before installing any new program. If my drive becomes infected, I can just Ghost back from my last known good condtion. If my main drive fails, the other drive just plugs in and works, and the most it costs is the price of a new backup drive.

When I'm done, I power down and unplug the drive. There's no virus or spyware written that can jump the air gap when your backup drive's unplugged.

I've heard that the newest version of Ghost works differently. I haven't tried it so I can't comment. Some people prefer Acronis True Image, which also clones drives.

 

[elpsam59]

Harvey,

I think my Ad-aware is at 6 (I'm at work, so I'll check once I get home). I also had Spybot 1.5 on the laptop, but I guess the Trojan some how managed to remove the exe file. I had a shortcut on the desktop and the icon went to white instead of the Spybot icon. When I tried to find the exe file it was not there.

I will look at getting the Ad-aware updated and re-install Spybot.

Still looking for more info and tips.

Thanks,

elpsam59

 

[Harvey]

Check reviews on the new Ad-Aware before you install it. The negatives I found, even on their own forums, were the reason I went looking for a replacement. Others on this forum suggested SuperAntiSpyware, which I like, so far.

Some spyware is so malicious and imbeds itself so deep that the only way to remove it is to format your drive and re-install Windows from the ground up. If it hit your AV and anti-spyware progs, that may be the fastest way back to a secure machine.

 

[UsandThem]

Originally posted by: elpsam59

After using Ad-Aware and AntiVir on both, I found that my laptop had 7 instances of Trojans save on System Restores.

Can anyone tell me how that can happen? What can I do to prevent such an event from happening?

elpsam59

There is no antivirus program or anti-spyware program that is 100% effective. Virus writers are always one step ahead on the programs (hence the signature updates).

The best thing like Harvey said is to use a good anti-spyware program (SuperAntiSpyware is good) and get a very good rated antivirus (Kaspersky, Norton, etc - just follow the links in Schadenfroh's post at the top of this forum).

It is also a good idea to run an online virus scanner (Kaspersky or Trend Micro) once a month to make sure that a virus has not compromised your protection.

Also make sure you have your cable modem's NAT filter and firewall capabilities set (if these features are offered on your unit). You also did not mention if you are using a software firewall or not.

Lastly, depending on what you download or look at online, make sure you are doing it under a limited account.....not under a admin login.

Also, what OS are you using and are all updates installed on your PC?

 

[degibson]

1) Don't download from untrusted sources.
2) Use an external router/firewall (avoid SW firewall vulnerabilities).

Personally, I find the above two steps suffice -- no need for anti-virus software at all (I also agree with UsandThem and will make an even stronger statement -- antivirus software doesn't work, because the coverage is lousy).

If you must violate 1) ... if you HAVE to download something shady, for the love of Smacky do it in a virtual machine.
There is no substitute for 2)

Edit: I forgot to mention: Don't use IE.

 

[mechBgon]

The problem with simply avoiding untrusted sites, is that trusted sites get compromised. My suggestions for reducing/mitigating risks on Windows systems without placing excessive reliance on your judgement or your antivirus/antispyware software, or your precious non-IE web browser either : http://www.mechbgon.com/build/security2.html

 

[Medea]

You probably had a few instances of malware getting on your system. Obviously, what you have for protection nuked it, but it was saved by System Restore first. It's not a big thing. It can't run from there.

I've got a problem with your ISP disconnecting you because you 'had a trojan present'. How are they scanning your system like that?!

After you've made sure your system is clean, to get rid of the old System Restore Points, do the following.

? Create a new Restore Point:
- Go to Start > All Programs > Accessories > System Tools > System Restore.
- When the utility opens, select "Create a new restore point" and click Next
- Name the restore point - something like "After infection cleaned" or "After cleaning"
- Click Create.

? Delete the old Restore Points:
- Go to Start > All Programs > Accessories > System Tools > Disk Cleanup. Click Ok.
- Click the "More Options" tab.
- Where it states "System Restore" - click Clean up.
- All of the old Restore Points will be deleted EXCEPT for the one you just created.

 

[elpsam59]

Medea,

Thanks for the input. I was wondering also on how the ISP was able to detect the trojans. I followed the previous posters advice and looked in the security thread at the top also. Installed SUPERAntispyware, Secuna PSI and Spybot. Spent most of the day making sure that all 3 progs went through my system and cleaned anything they found and re-scanned.

The ISP (Time Warner) wasn't too helpful or forth coming. Don't you just love a monopoly!

To all people who have replied. Thanks and I will keep your advice in mind.

elpsam59

 

[Captante]

Originally posted by: elpsam59
Medea,

Thanks for the input. I was wondering also on how the ISP was able to detect the trojans. I followed the previous posters advice and looked in the security thread at the top also. Installed SUPERAntispyware, Secuna PSI and Spybot. Spent most of the day making sure that all 3 progs went through my system and cleaned anything they found and re-scanned.

The ISP (Time Warner) wasn't too helpful or forth coming. Don't you just love a monopoly!

To all people who have replied. Thanks and I will keep your advice in mind.

elpsam59

My guess is that somthing you were infected with was attaching itself to e-mails and was detected by them in the process of being sent ... many ISP's scan for virus's on inbound/outbound messages these days.

Its less likely but also possible that your system had been taken over & was being used for somthing along the lines of a DDOS attack which they were able to detect.

Either way take this as a lesson ... you can't be too careful these days because the bad guys are really clever!

 

[degibson]

Another big clue to ISPs that you might be compromised is constant bandwidth usage -- this also flags on torrenters as well.

For what its worth, mechBgon is completely right about prevention -- the best thing you can do is not run as an administrator.

 

[Medea]

I agree with the replies including mech's advice not to run as an administrator which I wholeheartedly agree with. Also, an ISP will scan email for malware and will either delete the attachment if that's where it's located or the content of the email itself. Given the amount of spamming with malware, it's now common for ISP's to scan email.

However, what is still strange is that his ISP "quarantied"[his] access to the Cable Modem.. IMO, all they should be doing is scanning his email for malware. I'm not sure what he means by their having "quarantined" his access, but his ISP should NOT be modifying his access at all.

 

[Captante]

Originally posted by: Medea
I agree with the replies including mech's advice not to run as an administrator which I wholeheartedly agree with. Also, an ISP will scan email for malware and will either delete the attachment if that's where it's located or the content of the email itself. Given the amount of spamming with malware, it's now common for ISP's to scan email.

However, what is still strange is that his ISP "quarantied"[his] access to the Cable Modem.. IMO, all they should be doing is scanning his email for malware. I'm not sure what he means by their having "quarantined" his access, but his ISP should NOT be modifying his access at all.

I agree that it seems strange but I've heard of this same thing happening to several other people ... the only difference is that they were all told simply that their internet connection had been temporarily shut down due to a virus & to the best of my knowledge none of them were running any kind of file-sharing software.

 

[elpsam59]

Captante,

I am not running any file sharing software. I got the "quarantine" removed on Friday. Yet, when I asked the "tech", he would not give me any information. All he stated was that they had detected a "trojan" on one of the two computers at home.

Since, my original question. I have added Superantispyware, Spybot and Secundia PSI, to Antivir and Adaware2007.

I am will be also setting up a limited account as advised today, that way the laptop is not under administrative login. Now if I can convince my wife to do the same in the desktop.....

Thanks to all who have given me advise on this forum.

elpsam59