Forums General Discussion Virus in 6.16 installer ?

AVP reports the virus TrojanDownloader.Win32.Small.na
in data0002

Did you get it from one of the links from the download page or with a script that included the mirc.exe file? if so, which link did you get it from?

I got it in mirc.com from the CA link. After I ran the exe
I found a process LSAS32.EXE in the windows folder
and in the start-up list inmsconfig, altho avp didn't recognise
this file as a virus.

found this in lsas32.exe with an hex editor:

e:\bobo\projects\trapp\Release\trapp.pdb

no info about it in google, maybe a varian of the virus ?

Used this link for download

http://mirc.xeol.net/mirc616.exe

(california)

I can verify that since running the mirc installer from the california mirror, there is a lsas32 process running and indeed, a startup entry is in msconfig for it. I cannot, however, confirm if this is actually the result of running this version of the mIRC installer.

Norton doesn't find anything unusual with lsas32.exe. I have noticed, however, that the exe does not contain any version information, unlike most other Microsoft-created executables.

I tried another link (australia) and it had no virus. So I
tried downloading the CA one again just to recheck and
avp found the virus again.

I did some more testing, and launched the 'infected' installer with taskmanager running and sure enough, lsas32.exe appeared in the process table.

Dubious.

Fortunately, you are able to kill the process with no repercussions. I tried to find the startup registry entry for the program that is listed in msconfig, but it's not there. This does not bode well.

Confirmed that the California link is suspect.

Quick cross-check:
Georgia:
CRC: 2AFD6A5E
MD5: 875a57102ad6bec1ed9bb6861b016c74

California:
CRC: 233A03B1
MD5: 518c3d2e9cd5a04f18662414db7f6d1c

Illinois (1)
CRC: 2AFD6A5E
MD5: 875a57102ad6bec1ed9bb6861b016c74

Illinois (2)
CRC: 2AFD6A5E
MD5: 875a57102ad6bec1ed9bb6861b016c74

Edit:
All the other links I could get through to had the correct file.

Othe mirror issues:
I couldn't resolve http://mirc.purehostings.net (4th Singapore link).

The following links didn't work:
http://mirc.globalwiz.com.sg/mirc616.exe (5th Singapore link)
http://mirror.pacific.net.au/mirc/mirc616.exe (2nd Australia link)
http://www.mirc-help.de/mirc/mirc616.exe (3rd Germany link)

Also http://mirc.vodien.com (1st Singapore link) redirected to an intermediary (mostly IRC related) page.

Will this do any harm, or nothing bad, though I don't have the lsass32.exe running I would like to inform people if this is harmful.

This was posted yesterday and the California download link
is still there .. I wonder how many have downloaded from
that link in the last 12 hours. Crazy.

Anyway this is what I got when I scanned it using AVP ..
c:\temp\mirc616.exe/data0002 infected: TrojanDownloader.Win32.Small.na
c:\temp\mirc616.exe/data0004/data0001.bin corrupted.
c:\temp\mirc616.exe/data0004 mIRC: unknown format.
c:\temp\mirc616.exe/data0004 corrupted.
c:\temp\mirc616.exe corrupted.

Well, i'm going to inform people about this just to be on the safe side of things, and so I can give a reference of a antivirus to use, what does AVP stand for?

/edit\: or maybe this could be a fault on AVP's side?

Thanks

Could someone just tell me for definite the precise name of the process and where it's located? The problem is that there are about 2 dozen viruses that use lsass.exe and variants of that name, and just a single legitimate Windows process that uses it too. Pay special attention to the filenames and the number of s'es being used.

LSAS.EXE & LSAS32.EXE
I'm reasonably certain that lsas.exe and lsas32.exe are both viruses.

LSASS.EXE
Apparently there's also several viruses which use a process called lsass.exe located in your root Windows directory (ie. C:\windows or c:\winnt) and possibly some other directories also. However, be careful because there's a legitimate Windows process which is located in the System directory (ie. c:\windows\system32 or c:\winnt\system32) called lsass.exe. I'm not sure what versions of Windows it's used on; it's definitely on WinXP Home, I can't find a trace of it on Win98SE, I'd guess it's only used on NT/XP/2000 and later.

LSASS32.EXE
There are several viruses using lsass32.exe.

LSASSS.EXE
There's at least one variant of the Sasser worm that uses a process by this name.

I can't tell you for sure what to do about any processes that using that installer might run. All I can say is that you certainly shouldn't use that mirror to download. The fact that the installer is different but still works correctly strongly suggests that it's caused by intentional tampering and is most likely malicious in intent (virus, spyware, adware, etc.).

AVG detects this as Downloader.Small.8.AK in a file C:\WINDOWS\mssli32.exe on Windows XP Home.

This has happened before with a Swedish and Singaporian mirror, they were removed swiftly. This mirror will most likely be removed (although I can give no official word) as soon as Krejt or Khaled sees this post (or the email I've sent).

Regards,

I found mssli32.exe as well and removed it, well avp did.
To check for the process validity if you are unsure on
your own, try this program:

Process Explorer ( free )

from www.sysinternals.com

then double click the process and check for the box
"command line". It also has detailed information about
all the threads from the process, even stack info for
every thread, and services in use by it. Make sure you
get a firewall on as well so you can check with the PIDs
etc.

lsas32.exe is the name of the apparent virus and it resides in C:\Windows (in XP, anyway).

"This was posted yesterday and the California download link
is still there .. I wonder how many have downloaded from
that link in the last 12 hours. Crazy."

Wasn't 6.16 released like a month ago ?

Norton Anti-Virus can't find any virus, but I agree there's one as I also got the lsas32.exe running which file was created on august 8th, and the mirc.exe packager didn't have any info when we check in the properties.

I think mIRC should be on it's own servers, and not hosted by some other people who offers to. It costs money I know... but at least it will be safe to download so people won't "fear" to get the last version released.