PWsteal.Firum trojan.

[Derek F]

Each time I run Ad-aware 6.0, Norton Anti Virus 2003 pops up with a virus
alert for PWsteal.Firum. It says that it unable to repair the file and at
that point Ad-aware stops working. If I disable auto protect ad run Ad-aware
again it finds a few files that I can delete but the Trojan does not seem to
be among them. When I run a virus scan with Norton it does not find the
Trojan. Norton is up to date and their web site shows a date in October when
that Trojan was included in their updates.
What should I do?
Derek.

 

[null]

Each time I run Ad-aware 6.0, Norton Anti Virus 2003 pops up with a virus
alert for PWsteal.Firum. It says that it unable to repair the file and at
that point Ad-aware stops working. If I disable auto protect ad run Ad-aware
again it finds a few files that I can delete but the Trojan does not seem to
be among them. When I run a virus scan with Norton it does not find the
Trojan. Norton is up to date and their web site shows a date in October when
that Trojan was included in their updates.
What should I do?
Derek.

If you followed the directions here:

http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.firum.html

(scanned in Safe mode and deleted the files NAV found, if any) then it
seems NAV is false alarming on some AdAware process in memory. So do
what you did. Leave the the auto protect off when using AdAware. If it
would make you feel better, see my web site for Sysclean and Antidote
av scanners. See if they find anything.


Art
http://www.epix.net/~artnpeg

 

[Nick FitzGerald]

Each time I run Ad-aware 6.0, Norton Anti Virus 2003 pops up with a virus
alert for PWsteal.Firum. It says that it unable to repair the file and at
that point Ad-aware stops working. If I disable auto protect ad run Ad-aware
again it finds a few files that I can delete but the Trojan does not seem to
be among them. When I run a virus scan with Norton it does not find the
Trojan. Norton is up to date and their web site shows a date in October when
that Trojan was included in their updates.
What should I do?

You should report the problem to the Ad-aware folk.

The odds are _very high_ that they have a "plain-text signature" problem.
This used to be a bad problem in the AV industry more than a decade ago -- I
guess the "Johnny-cum-lately" anti-adware, anti-spyware, etc folk have a few
lessons they seem to prefer to learn the hard way...

 

[Derek F]

You should report the problem to the Ad-aware folk.

The odds are _very high_ that they have a "plain-text signature" problem.
This used to be a bad problem in the AV industry more than a decade ago -- I
guess the "Johnny-cum-lately" anti-adware, anti-spyware, etc folk have a few
lessons they seem to prefer to learn the hard way...

I have sent an E-Mail to them but doubtful if I will get a reply.
Derek.

 

[Derek F]

If you followed the directions here:

http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.firum.html

(scanned in Safe mode and deleted the files NAV found, if any) then it
seems NAV is false alarming on some AdAware process in memory. So do
what you did. Leave the the auto protect off when using AdAware. If it
would make you feel better, see my web site for Sysclean and Antidote
av scanners. See if they find anything.


Art
http://www.epix.net/~artnpeg

I scanned in safe mode and it was clear. Right after I ran Ad-aware with
Norton active and again I had the warning for the PWsteal trojan.
Derek.

 

[Derek F]

You should report the problem to the Ad-aware folk.

The odds are _very high_ that they have a "plain-text signature" problem.
This used to be a bad problem in the AV industry more than a decade ago -- I
guess the "Johnny-cum-lately" anti-adware, anti-spyware, etc folk have a few
lessons they seem to prefer to learn the hard way...

I reported it to Ad-aware and they replied:
Derek.

Hello ,
While performing a scan with Ad-aware, a background antivirus monitor may
issue an alert, stating that a virus has been found in a subfolder of the
Ad-aware folder.



During a scan, Ad-aware will temporarily decompress files to scan their
contents. Some antivirus applications include an option to quarantine
infected files, and when Ad-aware decompresses these quarantined files, the
antivirus background scanner detects the virus moving outside the quarantine
area.



Either remove the quarantined files via your antivirus application, or have
Ad-aware ignore the antivirus program's quarantine folders/files during a
scan.



Official Lavasoft Support Forums:
http://www.lavasoftsupport.com/

Ad-aware Knowledge base:
http://www.lavahelp.com

With kind regards,