Avast Doesn't Block XP Defender malware (ave.exe)
in [Spyware]
|
From: Beauregard T. Shagnasty on 3 Apr 2010 23:57 Beauregard T. Shagnasty wrote: Mine: > Date: Sat, 3 Apr 2010 23:54:21 -0400 > Injection-Date: Sun, 4 Apr 2010 03:54:22 +0000 (UTC) > David Kaye wrote: >> Date: Sun, 04 Apr 2010 04:40:04 GMT >> Injection-Date: Sun, 4 Apr 2010 03:40:04 +0000 (UTC) > >> "gufus" <stop.nospam.gbbsg(a)shaw.ca> wrote: >> >>> BTW, check your setup, your clock is wrong. >> >> For the 4th or 5th time, my clock is perfectly fine. It's the clock >> on my news server at Eternal September. >> >> Presently my clock says 8:40::03pm; that's Pacific Daylight Time. > > Let's see .. I'm using eternal-september as well. What's mine say? Ah. It seems I've posted "nearly an hour before you." How do you explain that everyone else sees your clock an hour in the future? Currently 11:57pm Eastern Daylight Time -- -bts -Four wheels carry the body; two wheels move the soul
From: Heather on 4 Apr 2010 00:06 "Beauregard T. Shagnasty" <a.nony.mous(a)example.invalid> wrote in message news:hp92np$phe$1(a)news.eternal-september.org... > Beauregard T. Shagnasty wrote: > > Mine: >> Date: Sat, 3 Apr 2010 23:54:21 -0400 >> Injection-Date: Sun, 4 Apr 2010 03:54:22 +0000 (UTC) > >> David Kaye wrote: >>> Date: Sun, 04 Apr 2010 04:40:04 GMT >>> Injection-Date: Sun, 4 Apr 2010 03:40:04 +0000 (UTC) >> >>> "gufus" <stop.nospam.gbbsg(a)shaw.ca> wrote: >>> >>>> BTW, check your setup, your clock is wrong. >>> >>> For the 4th or 5th time, my clock is perfectly fine. It's the clock >>> on my news server at Eternal September. >>> >>> Presently my clock says 8:40::03pm; that's Pacific Daylight Time. >> >> Let's see .. I'm using eternal-september as well. What's mine say? > > Ah. It seems I've posted "nearly an hour before you." How do you explain > that everyone else sees your clock an hour in the future? > > Currently 11:57pm Eastern Daylight Time > OK Shaggy......I will add to this cuz I have an obsession re correct time. He has his Time Zone set wrongly.......right? As it is now Daylight SAVING Time (which he may not have checked off), it is only 4 hours different to GMT........not 5. Da Blonde.......at 12:05 am Sunday, April 4, Eastern Standard Time, 4 hours behind Greenwich Mean Time (aka Zero or Zulu time)
From: David Kaye on 4 Apr 2010 01:23 "Beauregard T. Shagnasty" <a.nony.mous(a)example.invalid> wrote: >Ah. It seems I've posted "nearly an hour before you." How do you explain >that everyone else sees your clock an hour in the future? > >Currently 11:57pm Eastern Daylight Time I'm not sure. There is no setting on the user account at ES to adjust the time. My computer's clock is set to Pacific (US & Canada) with allowance made for DST. It adjusted correctly at the beginning of daylight time. Lemme see. I have a program that calls an API routine for system time. Let's see if it shows GMT correctly... Okay, the routine calls the GetTimeZoneInformation and GetSystemTime functions from the kernel32 library. The routines return an offset from GMT as 7 hours, which is correct. Normally it would be 8 hours, but we're on DST here in North America. Since Bush signed into law the advanced daylight time law several years ago, starting DST 3 weeks ahead of the way it used to be (and ending it 1 week later) it just might be that Eternal September is assuming that we're not on DST here yet. This would account for their server thinking GMT (UTC) is 8 hours ahead.
From: David Kaye on 4 Apr 2010 01:28 "Heather" <fergie(a)canada.invalid> wrote: >OK Shaggy......I will add to this cuz I have an obsession re correct time. >He has his Time Zone set wrongly.......right? As it is now Daylight SAVING >Time (which he may not have checked off), it is only 4 hours different to >GMT........not 5. My time zone and my DST offset are NOT set wrong. I'm also a time geek and I'm aware that the U.S. now advances DST time 3 weeks ahead of when it used to start. To quote Wikipedia: "....Starting in 2007, most of the United States and Canada observe DST from the second Sunday in March to the first Sunday in November, almost two-thirds of the year.[30] The 2007 U.S. change was part of the Energy Policy Act of 2005; previously, from 1987 through 2006, the start and end dates were the first Sunday in April and the last Sunday in October, and Congress retains the right to go back to the previous dates now that an energy-consumption study has been done.[31] ...." In fact, not only am I a time geek, but I've changed the registry entry to sync my computer's clock with NIST every 6 hours instead of the default once a week.
From: David Kaye on 4 Apr 2010 01:31
"FromTheRafters" <erratic(a)nomail.afraid.org> wrote: >It is possible for a trojan to drop a file named ave.exe that is for all >practical purposes unique to that system. The filename means nothing. >The thing that should be detected is the dropper itself - if you don't >install it, you don't have to identify and remove it. This may be the case given that the name displayed apparently adjusts itself to the system in use. Thus for XP it's called something like "XP Defender" and for Vista it's called "Vista Defender", etc. Also, whether it's called Defender or any number of other names also seems to change. Regardless, I should think that Avast's heuristics should have picked up some of the telltale signs of the infection even if it didn't have the exact definition in place. I'm thiking of going back to ZoneAlarm since Windows firewall was so easy to disable. |