Question

[Androson]

Hello i just learned about malwarebytes from good people and sources and decided to download the program and sign up because i like how exact it was. anyways Malwarebytes found and got rid of the adware and trojans i had BUT i was just curious as to what these certain trojans are exactly.

Im a fast learner and know quite abit about computers but didn't realize how dangerous some trojans can be. anyways heres the two im extremely concerned about...

c:\Users\*****\AppData\Local\Temp\0.3651057569845019.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

c:\Users\*****\AppData\Local\Temp\0.3823985096076553.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

Are these documented anywhere and there source/effect on the computer? Thank you in Advance to anyone who can help.

[Androson]

Hello i just learned about malwarebytes from good people and sources and decided to download the program and sign up because i like how exact it was. anyways Malwarebytes found and got rid of the adware and trojans i had BUT i was just curious as to what these certain trojans are exactly.

Im a fast learner and know quite abit about computers but didn't realize how dangerous some trojans can be. anyways heres the two im extremely concerned about...

c:\Users\*****\AppData\Local\Temp\0.3651057569845019.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

c:\Users\*****\AppData\Local\Temp\0.3823985096076553.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

Are these documented anywhere and there source/effect on the computer? Thank you in Advance to anyone who can help.

Oh and also for further info, these two were infected from a random update called Jucheck.exe, i know this is Java related however it's publisher was unknown and the location was in my \AppData\Local\Temp\ area, and i know thats NOT where its suppose to be. also i let it install and run by mistake for a good 2 minutes before looking for help after my Norton Anti-Virus Internet Security 2011 FAILED to find it.

[DarkSnakeKobra]

Seems like a generic name. Generic malware isn't really documented so it's really difficult to say what that exact sample does. I'll have to let a staff member chime in to be sure.

[Androson]

Thank you for the welcome.

Ah so its generic is it? well, okay then, does it sound like something nasty those or is it just random code?

[DarkSnakeKobra]

You're welcome.

Yes. Exploit's are infections that take advantage of known bugs or vulnerabilities in applications or the operating system itself. Most of the time they plant backdoors which allow remote access to the computer it infected to gain control over it.

[nosirrah]

Outdated web facing software (likely acrobat reader and/or JRE) was exploited and the detections in your log are the initial executable files dropped and executed as a result of this successful exploit.

[AdvancedSetup]

If you really want to learn more please consider being trained to help others.

The following are websites who host training facilities: United Network of Instructors and Trained Eliminators

• Bleeping Computer
  
  
• Geeks to Go
  
  
• SpywareHammer
  
  
• Malware Removal
  
  
• What the Tech
  
  
• Spyware Info Forum
  
  
• That Computer Guy
  
  
• Tech Support Forum

[nosirrah]

BTW, I would love to get my hands on these samples. If possible zip and attach them (password 'infected') and attach them to a post over here:

http://forums.malwarebytes.org/index.php?showforum=51

[Androson]

You're welcome.:)Yes. Exploit's are infections that take advantage of known bugs or vulnerabilities in applications or the operating system itself. Most of the time they plant backdoors which allow remote access to the computer it infected to gain control over it.

Ah i see, so does that mean for those 2 minutes i foolishly let it run, any of my info was in trouble? I read about backdoors and understand the basics about it, but didn't read enough into it to understand everything. was there any danger?

Outdated web facing software (likely acrobat reader and/or JRE) was exploited and the detections in your log are the initial executable files dropped and executed as a result of this successful exploit.

Oh, lol im gonna sound like a complete noob, but could you dumb that down for me? i just started learning about this kinda stuff literally yesterday some am rather fresh.

If you really want to learn more please consider being trained to help others.The following are websites who host training facilities: United Network of Instructors and Trained Eliminators

• Bleeping Computer
• Geeks to Go
• SpywareHammer
• Malware Removal
• What the Tech
• Spyware Info Forum
• That Computer Guy
• Tech Support Forum

Thank you very much sir! i'll look this up when i have time, i would love to learn more and help others if possible.

[nosirrah]

Oh, lol im gonna sound like a complete noob, but could you dumb that down for me? i just started learning about this kinda stuff literally yesterday some am rather fresh.

Adobe acrobat reader and Java Runtime Environment are common applications installed on most systems. They are very common and since by design they interact with web content they are very common targets for exploitation. More or less you feed these applications data constructed in just the right way and you can trick them into downloading and directly executing malware from the web. As these loopholes are discovered patches are issued to plug these holes. The majority of people never update these applications and as a result simply surfing a safe site that has been hacked and contains an exploit kit can infect your system, no clicking required.

[Androson]

Adobe acrobat reader and Java Runtime Environment are common applications installed on most systems. They are very common and since by design they interact with web content they are very common targets for exploitation. More or less you feed these applications data constructed in just the right way and you can trick them into downloading and directly executing malware from the web. As these loopholes are discovered patches are issued to plug these holes. The majority of people never update these applications and as a result simply surfing a safe site that has been hacked and contains an exploit kit can infect your system, no clicking required.

Ah i understand clearly now, thank you very much nosirrah. but jeez that is dirty a safe site can still be corrupt even if you don't click on anything strange or out of place, i think i'll learn a lot here from you guys.

Thanks for putting up with me once again.