Trojan Dropper found in notepad.exe

Recently I helped an elderly in-law update her NAV def files on an XP
home box. < was last updated last part of 2003 just before
expiration>...> Most of the box's use come from grandchildren < and
that's appears to be ICQ, chat, and MS IE w/ weak security settings>
After updating her definitions, I ran a full system scan and found a
*Trojan Dropper* < forget the name now> in
windows\system32\notepad.exe
Norton auto deleted it and I reset the path to the windows directory
and notepad works fine again.
Anyone had anything like this happen to them...I mean a bogus
notepad.exe as a trojan ?
bLB

buzz Light Beer

"buzz Light Beer" <> wrote in message
news:...
> Recently I helped an elderly in-law update her NAV def files on an XP
> home box. < was last updated last part of 2003 just before
> expiration>...> Most of the box's use come from grandchildren < and
> that's appears to be ICQ, chat, and MS IE w/ weak security settings>
> After updating her definitions, I ran a full system scan and found a
> *Trojan Dropper* < forget the name now> in
> windows\system32\notepad.exe
> Norton auto deleted it and I reset the path to the windows directory
> and notepad works fine again.
> Anyone had anything like this happen to them...I mean a bogus
> notepad.exe as a trojan ?
> bLB
>
>

Yep, it happened to me. Norton Personal Firewall was reporting that
Notepad.exe was trying to access the internet. Looked at the notepad.exe
file and determined it was not the original. Also my mstask.exe somehow got
replaced. I had Windows 2000 Pro and IE 5.5. Have since upgraded to IE 6.

Andy

Andy Smith

On Mon, 2 Aug 2004 12:38:30 -0400, "Andy Smith"
<> wrote:

>
>"buzz Light Beer" <> wrote in message
>news:.. .
>> Recently I helped an elderly in-law update her NAV def files on an XP
>> home box. < was last updated last part of 2003 just before
>> expiration>...> Most of the box's use come from grandchildren < and
>> that's appears to be ICQ, chat, and MS IE w/ weak security settings>
>> After updating her definitions, I ran a full system scan and found a
>> *Trojan Dropper* < forget the name now> in
>> windows\system32\notepad.exe
>> Norton auto deleted it and I reset the path to the windows directory
>> and notepad works fine again.
>> Anyone had anything like this happen to them...I mean a bogus
>> notepad.exe as a trojan ?
>> bLB
>>
>>
>
>Yep, it happened to me. Norton Personal Firewall was reporting that
>Notepad.exe was trying to access the internet. Looked at the notepad.exe
>file and determined it was not the original. Also my mstask.exe somehow got
>replaced. I had Windows 2000 Pro and IE 5.5. Have since upgraded to IE 6.
>
>Andy
>
You should have your firewall set to allow only the exe's of certain
applications the right to access the internet. Block all other exe's
after that rule.

I'm guessing Norton is pretty much the same as other firewalls.

marty12@hotmail.com