Visual Studio 12 (Trojan.Llac)

[jkeegan]

I think these may be false positives but I am unsure. 

 

 

Files Infected:

C:\$Recycle.Bin\S-1-5-21-3137687710-1416735958-361854081-4366\$R3UHWLB.exe (Trojan.Llac) -> No action taken.C:\$Recycle.Bin\S-1-5-21-3137687710-1416735958-361854081-4366\$RA60TD7.exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Microsoft SDKs\LightSwitch\v3.0\Design\vs_lightswitchwif.exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\Setups\vs_profiler_x64_enu.exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Microsoft Visual Studio 11.0\Team Tools\Performance Tools\Setups\vs_profiler_x86_enu.exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\redist\1033\vcredist_arm.exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\redist\1033\vcredist_x64.exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Microsoft Visual Studio 11.0\VC\redist\1033\vcredist_x86.exe (Trojan.Llac) -> No action taken.C:\ProgramData\Package Cache\{29828f33-4679-462a-8c98-1c3507678922}\VS2012.3.exe (Trojan.Llac) -> No action taken.C:\ProgramData\Package Cache\{363a2c1e-637f-45ce-933b-5a5463efd945}\sdksetup.exe (Trojan.Llac) -> No action taken.C:\ProgramData\Package Cache\{56ef8912-352f-4fab-9c73-6f1c92a7127f}\patch_KB2781514.exe (Trojan.Llac) -> No action taken.C:\ProgramData\Package Cache\{72a589f5-52d2-4e9e-b3d0-77d589ff8c2f}\vs_professional.exe (Trojan.Llac) -> No action taken.C:\Windows\Installer\$PatchCache$\Managed\CE0CDFFC429674330B743133E9BDCE82\11.0.50727\F_VCRedist_arm_exe (Trojan.Llac) -> No action taken.C:\Windows\Installer\$PatchCache$\Managed\CE0CDFFC429674330B743133E9BDCE82\11.0.50727\F_VCRedist_x64_exe (Trojan.Llac) -> No action taken.C:\Windows\Installer\$PatchCache$\Managed\CE0CDFFC429674330B743133E9BDCE82\11.0.50727\F_VCRedist_x86_exe (Trojan.Llac) -> No action taken.C:\Program Files (x86)\Mozilla Firefox\updater.exe (Trojan.Agent) -> No action taken.

[shadowwar]

Can u attach some of those files please in a zip here?

[jkeegan]

Here you go. Thanks for checking this.

ScanLog.zip

[shadowwar]

i actually need one of the executables that was detected.

 

Thanks.

[jkeegan]

Here is one of the EXE files

exe file.zip

[shadowwar]

can u please update and recheck. i think i have this fixed.

[jkeegan]

when I run the update it says I have the latest version....

[shadowwar]

should be in v2013.12.06.08 db and later.

[jkeegan]

I ran an update on another machine that had a definite older version and it only updated to the one currently on the "infected" machine. 

 

Version 913120508

[jkeegan]

I don't see the db version anywhere, where do I check for that?

[jkeegan]

correction, I don't see it in the format you gave

[jkeegan]

since I am on bmrt vs mbab do I get updates from Barracuda or directly from you?

[shadowwar]

Whoa part of the problem is you are using a REALLY old version.

 

You may have to contact barracuda to get the latest

 

Barracuda Malware Removal Tool 1.46

 

Latest version should be 1.75. 1.75 will show the database info correctly like this v2013.12.06.08

 

1.46 shows it as you see it. And according to that you are still a day behind or about 12 databases.

 

 

 

1.46 is not officially supported anymore. Its over 3 years old and doesnt have any of the latest tech to detect the latest threats.

 

The updates do come from our servers i believe.

 

Not sure how the barracuda stuff works though if the appliance pulls and sends out to clients.

 

Would really have to contact support on this i just dont have the experience being in research to know.