IE7 Phishing Filter vulnerability question

[J Manderley]

Hello there,

I got a real wierd situation for you here and I am humbly asking for a
bit of advice if possible please.

I am reasonably competent when it comes to pc's and Windows operating
systems, I build and maintain pc's and I know my way around the usual
areas of the operating system, so I am not entirely green ;-)

However, I am not too proud to ask for help when I am stuck, which I
am of course

I have recently been asked to try and get some spyware/adware off a
friend's recently purchased Dell pc, and upon closer inspection found
the culprit to be a variation of SpywareQuake (fake anti-spyware
pop-ups, fake scans etc...) which I THOUGHT I had removed using AVG
Anti-Virus and Adaware SE 2007. However...

I have downloaded the SpywareQuake remover (and other variations of
said remover), I have run both Adaware SE 2007 and the removal tools
in safe mode and I have run numerous anti-virus scans but I am STILL
getting pop-ups and forced "fake-scan" pages popping up when Internet
Explorer accesses the internet. Anti=Spyware adn removal tools found a
big fat NOTHING :-(

Using Sysinternals Process Explorer I traced the activity down to a
registry key which was labelled "AntiPhishing" in the HKCU hive:

HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F

Comparing this with a clean version I noticed a value in the last
sub-key labelled "user" which, when compared with the clean version,
should not have been there, so I blanked it and... it came back.

Finally I disabled the Phishing Filter in IE7 completely (using the
Internet Options Advanced tab) and it has stopped the pop-ups and fake
anti-spyware messages dead (registry key still will not stay blank so
obviously there is still something running on the system.) If I
re-activate the Phishing filter then obviously the pop-ups return.

Bingo! Problem side-stepped but not solved. Now, my question is, how
do I remove this little booger so I can reactivate the Phishing Filter
again if I can't get any anti-spyware software to detect it? Is this a
vulnerability involving the MS Phishing Filter? Has anybody else
suffered this problem and can they kindly offer a solution?

I am trying to resist performing a system restore unless I really have
to. ANY help at this stage would be most gratefully received and most
definitely welcome.

By the way, I also backed everything up before I started out on this
so his data is safe... just thought I'd mention that ;-)

Sorry for the ramble, hope I provided enough info. Thanks in advance

J

 

[Mark L. Ferguson]

Have you tried Autoruns?

AutoRuns for Windows v8.61:
http://www.microsoft.com/technet/sysinternals/SystemInformation/Autoruns.mspx

Another possibility might be the Windows Defender "Software Explorer"

Software Explorer Windows Defender:
http://www.microsoft.com/athome/security/spyware/software/support/howto/softwareexplorer.mspx

 

[J Manderley]

Thank you, no I haven't tried these yet, I will download them and try
them.

Will let you know how I get on.

 

[J Manderley]

Hello again

I have downloaded Autoruns and Windows Defender as you suggested, and
I have installed both on the target computer. Autoruns found a couple
of BHOs that were hidden but nothing else that I didn't recognise.

Windows Defender claimed not to have found anything at all that was
malicious (full system scan with unused tsr's closed down) and yet, as
soon as I re-activate Windows Phishing filter the fake pop-ups return.

I have extracted the [HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Security\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F]
registry key that I mentioned in my previous post, and I can attach or
post a TEXT ONLY version here if it will be of any use (I won't send
it as .reg or .zip unless asked to do so just in case...) It refers to
something called Smart Screen Cache, which I cannot find on the target
computer anywhere. As mentioned previously this registry value is
completely blank on the clean pc I used for comparison, and I think
this may be causing the pop-ups when the Phishing Filter is activated
(I may be wrong, advice always welcome.)

I'm getting closer to a full system restore here I think

Over to you again...

J

 

[J Manderley]

Just to update y'all on this problem, I have found out what is going
on. The SpywareQuake-Like behaviour is due to a particularly
persistent rootkit called Navipromo Rootkit, and it uses some kind of
stealth technology to hide itself. MUCH more information and the
removal tool(s) can be found at:

http://wiki.castlecops.com/Using_Navilog1_to_detect_and_remove_Navipromo_rootkit

Please note that I could not detect this with any proprietary (and
quite expensive) anti-spyware or anti-rootkit software but I can
assure you that the infection is very much alive and present on the pc
in question.

Which leads me back to my original question, could there be a
vulnerability or, dare I suggest it, a "security hole" in Microsoft's
Phishing Filter? Disabling the Phishing Filter seems to disable 99.9%
of the rootkit activity which indicates that it has been compromised
by the aforementioned rootkit!

Your thoughts?

J

My original post should anybody have missed it: