AplusWebMaster
Topic Starter
FYI…
- http://isc.sans.org/diary.php?storyid=1799
Last Updated: 2006-10-24 10:22:58 UTC
"…We received a report that Symantec Antivirus was detecting a virus on sfc.dll, which is a component of Windows File Protection. At first, we were a little worried that a trojan was disabling the protection features, which would be a bad thing. However, it looks like this was a false positive and new signatures released today seems to have fixed the problem. This was occuring on Windows 2000 SP4 machines without the Security Rollup applied…
UPDATE:
…Basically, the sfc.dll file provides Windows 2000 and XP operating systems with a feature called System File Checker (SFC), which is part of Windows File Protection. Windows File Protection prevents programs from replacing critical Windows system files (you can find more information about WFP at http://support.microsoft.com/kb/222193 ). As you can see, WFP makes it a bit more difficult for malware to replace Windows system files. The bad guys, however, found a way to circumvent SFC – all they have to do is to "patch" the sfc.dll file (the patch actually only modifies 2 bytes!) and add an undocumented registry key.
According to Symantec, a lot of Infostealer Trojans modify the sfc.dll file, so they added detection for it. However, it looks like there might be some other, legitimate, reasons for this, so some people might have been caught with this false positive detection (when the system actually wasn't infected).
Symantec posted a knowledge base article about this, so if you were affected visit http://service1.symantec.com/SUPPORT/ent-s…006102011570548 …"
- http://isc.sans.org/diary.php?storyid=1799
Last Updated: 2006-10-24 10:22:58 UTC
"…We received a report that Symantec Antivirus was detecting a virus on sfc.dll, which is a component of Windows File Protection. At first, we were a little worried that a trojan was disabling the protection features, which would be a bad thing. However, it looks like this was a false positive and new signatures released today seems to have fixed the problem. This was occuring on Windows 2000 SP4 machines without the Security Rollup applied…
UPDATE:
…Basically, the sfc.dll file provides Windows 2000 and XP operating systems with a feature called System File Checker (SFC), which is part of Windows File Protection. Windows File Protection prevents programs from replacing critical Windows system files (you can find more information about WFP at http://support.microsoft.com/kb/222193 ). As you can see, WFP makes it a bit more difficult for malware to replace Windows system files. The bad guys, however, found a way to circumvent SFC – all they have to do is to "patch" the sfc.dll file (the patch actually only modifies 2 bytes!) and add an undocumented registry key.
According to Symantec, a lot of Infostealer Trojans modify the sfc.dll file, so they added detection for it. However, it looks like there might be some other, legitimate, reasons for this, so some people might have been caught with this false positive detection (when the system actually wasn't infected).
Symantec posted a knowledge base article about this, so if you were affected visit http://service1.symantec.com/SUPPORT/ent-s…006102011570548 …"