0Day Attack – Adobe Reader

Topic

New Reply

Earlier today a new PDF icon appeared on my desktop.
Hovering brought up the following:

Nine Free Programs Ebook-2E
Type: Adobe Acrobat Reader
Date Modified: 26/11/2009
Size: 2.45 MB

I have no idea how the icon got there but I had recently
updated my Adobe reader, and may have clicked on it
and downloaded what I thought was a further update.
I don’t remember.

Only afterwards did I read the warning on Woody’s website
about the 0Day attack – Adobe Reader.

If this icon represents that threat, how do I get rid of it, as well as
get rid of whatever I may have downloaded?

Has anyone else had a run-in with this?

Addendum: I just noticed that my AVG email protection is marked
NOT ACTIVE and I can’t seem to download an update.

Reply | Quote

Replies

Usually, a new attack vector is used to install well known malware, so your usual anti-malware scans are the first step.

== Edit ==

If AVG is not working, try using the online HouseCall scanner (use IE if possible):

http://housecall.trendmicro.com/

Also grab: Malwarebytes Anti-malware.

Reply | Quote

Usually, a new attack vector is used to install well known malware, so your usual anti-malware scans are the first step.

== Edit ==

If AVG is not working, try using the online HouseCall scanner (use IE if possible):

http://housecall.trendmicro.com/

Also grab: Malwarebytes Anti-malware.

Thank you, jscher2000. I was assuming it was something new but rereading Woody’s
warning, I see it’s been around before.

AVG was working, but for some reason the email component had disappeared — which
I finally managed to get back. A total drive AVG scan found nothing.

I’m not familiar with the online HouseCall scanner. Does that mean that they do
the scan on your computer directly from their site?

I’ll also look into malwarebytes. Is it a separate AV program or can it run in
concert with AVG?

Thanks again for your input.

Reply | Quote

I’m not familiar with the online HouseCall scanner. Does that mean that they do the scan on your computer directly from their site?

The site uses an ActiveX control (IE) or Java applet (other browsers), so you don’t need to pre-install any software. However, your hard drive is not uploaded to the site.

I’ll also look into malwarebytes. Is it a separate AV program or can it run in
concert with AVG?

It is an on-demand scanner, so it does not conflict with real-time scanners.

Reply | Quote

The site uses an ActiveX control (IE) or Java applet (other browsers), so you don’t need to pre-install any software. However, your hard drive is not uploaded to the site.

It is an on-demand scanner, so it does not conflict with real-time scanners.

I’ll check both of these out. Thanks for the info.

Reply | Quote

Are you sure you didn’t download that one from Windows Secrets? I’m sure several people have a similar file from around that date.

But of course, do scan everything you download and use.

Reply | Quote

Are you sure you didn’t download that one from Windows Secrets?
I’m sure several people have a similar file from around that date.

But of course, do scan everything you download and use.

Good question. I recall Windows Secrets offering something or other
but I’m almost certain I didn’t download anything because I was strapped
for time and there were 3 or 4 other unread Windows Secrets issues, only
one of which I looked at. They are still unread. I’ll check the one
I did look at.

=== UPDATE: You have a good memory for dates. I checked the 26 November
issue of Windows Secrets — the same date on the PDF icon on my desktop —
and the download offer was for excerpts from a book on Windows-7. I’m
XP so I certainly didn’t download it. ===

There’s another anomaly. On the net yesterday, almost every site I went to
had a pop-up that said something like:

This website would like you to download Adobe flash reader.

===EDIT=== That should be: “Adobe Flash Player Installer”

I would say that this happened at least 10 times. Even more unusual since I have
all pop-ups blocked.

I’m still confused. Exactly what is the 0day attack anyway?

Reply | Quote

Earlier today a new PDF… snip

As Argus pointed out, this is in all probability a download from the Windows Secrets site. Here is a graphic from Windows Secrets from that time period:

Reply | Quote

Thanks, Paul, for putting it so graphically, and bad on me for not paying more attention
to my very own post — which does exactly quote the image.

Mystery solved. At least the mystery of what it is. The mystery
of how it got there is still up in the air, because I very rarely download anything without
checking it out first. However, one can never negate the factor of a little
early holiday cheer.

Apologies to Argus, who got it right the first time round, and holiday cheers to all.

Reply | Quote