Downloader.MSCache

Norton Antivirus found this trojan on my computer after installing SpywareGuard and SpywareBlaster. This happened on two machines in my home network. Both machines are XP Pro and were patched, with antivirus and spybot. I carry my spyware tools on a flash drive (which scans clean by Norton) and have installed these same app's at work to protect about a half doz. computers. Not getting the same problem at work. I suppose something else could be downloading this trojan, but it's detected almost immediately after installing these two app's and running their updates.
Anyone have any insight on this?

 

Hi whodat,

Welcome at Wilders.

Downloader.MSCache is a collection of spywareinstallers, where items get added for detection regularly.

Do you have the scan reports of those two computers?
If so, let us know the full path and filenames that were found by NAV.
We should be able to tell you some more about where they came from then.

Regards,

Pieter

 

LOL. 3 seconds apart, Paul.
We should practice some more.

Pieter

 

I'm impressed.
I don't have any log files and have since cleaned both computers from the infection. The file name and location were the same on each machine.
c:\windows\downloaded program files\hnkmugzv.dll

 

Oh bugger, random looking filename in the DPF folder.

I dare to claim 90% accuracy that it was Searchbarcash. Stealth-installs using ActiveX.
Which indeed belongs to that "family" of malware: http://www.doxdesk.com/parasite/ISTbar.html

Oh, hang on. Make that almost 100%

{56269A74-91CC-F76B-2DDA-B355F51CCCFD}
Class file: hnkmugzv.dll
Attributes: archive
Date: 10/22/2003 7:40:10 PM
MD5: 0D5A5884B8D17BC2C1CC107B3A884A03
Path: C:\WINDOWS\Downloaded Program Files\
Short name:
Size: 36864 bytes
Version: 0.1.0.0
Class name: DownloadUL Class
Contains file: hnkmugzv.dll
Attributes: archive
Date: 10/22/2003 7:40:10 PM
MD5: 0D5A5884B8D17BC2C1CC107B3A884A03
Path: C:\WINDOWS\Downloaded Program Files\
Short name:
Size: 36864 bytes
Version: 0.1.0.0
Download location: hxxp://public.searchbarcash.com/cab/034/hnkmugzv.cab
Last modified: Sun, 21 Dec 2003 03:09:54 GMT
Version: 1,0,0,1

Well, since you installed SpywareBlaster. It won't bother you again. In the database as SearchBarCash (26)

Regards,

Pieter

 

Thank you

 

My pleasure.

Or actually, thank Javacool for adding over 50 different CLSID's for this pest.

Regards,

Pieter