Notepad.exe on XP

[Kernel Krumpet]

8:30am PST.

 

After spending a couple of days on a client's Zbot Cryptolocker removal and file restoration - the blocking of executables running from XP's %username%\Application Data\ folders and sub-folders was implemented through Group Policy.

 

As a test I just now copied notepad.exe from c:\windows into the \application data\ folder. But, Malwarebytes blocked this and called Zbot Crypto on notepad.exe - and Quarantined.

 

Next, Right Click notepad.exe and 'scan with malwarebytes' - no malware found?

 

Next, Delete notepad.exe from windows\ and windows\system32\ and replace with known good copy.

 

Next, copy good notepad.exe into %username%\application data\ again. Again, Malwarebytes calls Zbot Cryptolocker on the copy and quarantines.

 

Next, copy thunk??.exe into %username%\application data\ folder & run. Group Policy blocks the execution!

 

Whassup with copying notepad.exe from \windows into %username\application data\ ?

 

Thanks.

[Firefox]

Not sure if your just testing things, but if the computer was/is infected it would be best to have an expert take a look under the hood to make sure the infection is completely gone...

Being that you are probably infected, feel free to follow the instructions below to receive free, one-on-one expert assistance in checking your system and clearing out any infections and correcting any damage done by the malware.

Please see the following pinned topic which has information on how to get help with this: Available Assistance for Possibly Infected Computers

Thank you

[Kernel Krumpet]

Hmmmmm.

 

Given the 10-page-or-so  bleepingcomputer Cryptolocker thread along with 2 full Malwarebyte scans and RootKit checks, I was thinking more like false positive but, your 2 comments "...take a look under the hood to make sure the infection is completely gone......" & "...Being that you are probably infected..." are duly heeded.

 

Thank you.

[Firefox]

Well if you got help over at Bleepingcomputer, with clean up, and they gave you an all clean you should be good to go, if you still have that topic open over there, perhaps you can direct your question to the person that helped you, to avoid confusion and having two different experts helping you....

[Kernel Krumpet]

To clean up any confusion, no, no help from bc - just reading the 10 page thread on Cryptolocker. You are the only other helping.

[Kernel Krumpet]

Case closed. Thank you.

[David H. Lipman]

 

After spending a couple of days on a client's Zlob Cryptolocker

 

Sorry, you are confusing malware.

 

The Zlob trojan is not associated with the present renditions of crypto trojans. 

 

However there are ties to the Zeus Bot (aka; Zbot) network for distribution.

 

The Zlob and Zbot are not the same nor related.

[Kernel Krumpet]

Indeed. I have been called many things but never that!

 

Cryptolocker bundled with Zbot malware was, as you probably perceived, the intention.

 

Thank you for pointing this out. It has been duly edited.

[shadowwar]

To let you know. You are triggering our heuristics by putting notepad in a place that it doesnt belong.

 

We usually dont let too much get away with running in the root of appdata.

[Kernel Krumpet]

@shadowwar

Tx for that. Yes, Tom quickly clued me in to that after I'd followed FF's advice in his/her 1st post above.

I would assume that Malwarebytes Heuristics catches more than the notepad executable. They might like to add twains and thunks too!

I didn't want to post Tom's solution detail as I thought it might be too revealing... Mea Culpa apparently.