2 Replies Latest reply on Sep 4, 2012 11:35 PM by RickCP

    Please help - trojan/rootkit in my auto update of latest flash player?




      I would be very grateful if anyone is able to advise me about what to do.


      My problem is that yesterday, after starting my computer, I was prompted to update my flash player version on startup (like is usual). I told it to do so and it opened my web browser to the following web page: https://get3.adobe.com/flashplayer/update/plugin/. Is the security certificate for this website a bit suspect or is that normal for Adobe? Legitimate site?


      From there I clicked to download the latest version and got a file with this name: install_flashplayer11x32_mssd_au_aih.exe (please note the "au" - which shouldn't be there?).


      Unfortunately, I went ahead and ran it, not noticing anything out of the ordinary, until after the installation. Straight away I was bombarded with about 20 program is not responding messages, which kept on reappearing even after I'd tried to close flashplayer down.


      This made me look into things and I've discovered a couple of things which are of concern to me:


      (1). These people are talking about how the file is a rootkit: http://www.novahq.net/forum/showthread.php?p=378847

      (2). Virustotal found a trojan when I uploaded the file: https://www.virustotal.com/file/8833e31c04dfd19fc2f80edac481119ed0f3c7251a6619d40c223557e0 c68b22/analysis/


      So.... what do I do now? I've scanned with AVG, Malwarebytes, Super Anti-adware, Trend Micro Housecall and TDSSkiller, all of which basically found nothing, apart from a locked sptd file. Apart from these scans, I have done nothing else to my computer yet, like trying to uninstall it, etc. I thought I'd best wait to hear what people have to say before taking action because I'm not sure what I should do next...


      Thank you for taking your time to read this, and again, if you can help I'd be relieved!


      Browser is the latest version of Firefox and I am running Windows 7. I apologise for any mistakes or rushed typing, I'm just trying to get this sorted, heh :/