XP AntiVirus 2008/2009

[jfilson]

I have two customers with Untangle boxes and they have workstations that have gotten infected with the infamous "XP AntiVirus 2009" spyware. Anyone know of anyway to block this with Untangle?

[sky-knight]

Welcome to the forums..

The installers are detected on download.

That does nothing for an active infection, so you still have to clean the boxes.

[jfilson]

We placed Untangle in this customer environment two weeks ago and a workstation became infected today.....

[oztec]

I've found the best removal tool for this is malwarebytes anti malware.
Works every time for this particular threat.

It's very possible that the virus has come in via someones usb flash drive or the like?

[securityguy]

We placed Untangle in this customer environment two weeks ago and a workstation became infected today.....

Are you running Clam or Kaspersky? I would run Kaspersky locally on the infected machines to clean them. A gateway AV is a great idea, but you still need local AV.

For Windows, Kaspersky is arguably the best AV. There is another good one out there, but ones like Norton, McAfee etc.. are total garbage.

[mdh]

Agreed. You know the cooties got there, but you don't know how. It could always have come in with a USB drive.

[bratsadtar]

Actually, there is a new form of this injection, hitting emails. The emails are saying in the subject, something like Milan cannot afford Ronaldinho, with a link to a news report.
However, if the victim clicks on the link they will be taken to a page with a message encouraging them to install a Flash Player to watch a video with the information. And, that is what loads XP Antivirus 2008. Does Untangle stop this new form yet???
Not certain.
But, now you have more information to look for to see if this is how the infection came in.

[Evil_Bert]

I got the same "XP Antivirus 2009" infection about a month ago by drive-by download (I followed a Google link and *zap* there she was ...). Luckily this was only in a VM - but still behind UT (a stable config I've had for many months now). It definitely came from the web, through UT. This VM is "reset to snapshot" after every use, so the infection could only arrive during a session and there's nothing else this VM communicates with - it's a "browser appliance".

[securityguy]

Since you know you got it from the web this means UT failed to detect and remove it. Quite disappointing.

[datdamnmachine]

Not really disappointing. That's just the nature of security appliances and applications. The malicious code writers are almost always one step ahead in coming out with new ways to infect computers. One way to combat that is to submit samples of new infections as well as the links they came from. This allows the security application developers narrow the time frame of new, undetected threat to new, detected threat.

Send the information to the Untangle crew as well so they can close the holes.