Win32/Glenwiry.P : The Final Chapter

Well, this is the conclusion to my epic glenwiry.P trilogy (in case you missed it, the first two posts were a roller coaster of emotion, drama and raw excitement). I noticed that my latest anti-virus definitions were downloaded when I fired up the computer this morning (8:20am PDT). So I tried the following:

1. Disconnected my router from the Internet.
2. Went to the "Tools" tab of the CA antivirus software.
3. Clicked "Quarantined Items."
4. Restored the three "wextract.exe" files that were quarantined Thursday night.
5. Ran a virus scan of the WINDOWS/system32 folder.
6. Did a happy dance.
   

With those files rightly restored, the new antivirus definitions didn't think wextract was a bad apple. This more or less confirms that CA blew it, and then they fixed it rather quickly. I guess they decided to hold off on releasing the fix for glenwiry.p until they actually release that trojan into the wild! Ha! Just kidding. Or am I? Maybe? No, really, I am not even sure anymore.

So chances are, if you never had the glenwiry.p problem, you aren't going to see it anytime soon because the current definitions don't produce a false positive, and if you did have the glenwiry.p problem, you can probably go ahead an restore those files. Again, this is just based on my own experience: do whatever you want to do at your own risk. I am not a security expert, I just play one on the web.

Win32/Glenwiry.P follow-up

Just thought I'd post a little follow-up to my post from yesterday. I am still not completely comfortable saying I'm 100% certain that the Computer Associates quarantine of wextract.exe is a false positive, but based on everything I have read and know, it seems like a false positive is most likely. I'll probably leave those files quarantined until either CA issues a fix or my system suffers for not having it available.

I've seen some folks saying it likely ISN'T a false positive (how's that for a weird double negative) because ZoneAlarm has been noted as flagging these files too. Well, turns out that ZA uses the CA anti-virus engine. At least that's what CNET said last summer. If that is still true, I think it provides even more evidence that we are just looking at a bad definition in the CA tools. If I'm wrong about the ZA-CA connection, I hope someone lets me know.

What is really bothering me now is that CA released a fix for a presumable trojan before it was even known to exist in the wild. This is evidenced by the complete lack of any Google hits on Glenwiry.P before this antivirus definition update last night by CA. Even CA's own website doesn't have any information on the Glenwiry.P threat as of the time of this posting. If that's the case, how is it being caught by their antvirus tools? Perhaps they released the fix There has always been speculation and conspiracy theories that antivirus companies may actually create viruses/threats. An interesting business model, indeed. Though, it is a neat trick to catch a "threat" before anyone has ever heard of it, even yourself. But, hey, what the heck do I know? I'm just a once-in-a-while blogger.

win32/Glenwiry.p fiasco

So I think the most recent update of Computer Associate's virus scan definitions is giving false positives on wextract.exe. If you have real-time scan activated you'll probably get C:/WINDOWS/system32/wextract.exe and C:/WINDOWS/system32/dllcache/wextract.exe quarantined by your anti-virus software. This might prompt Windows to put up a red flag and demand that you insert your operating system install disk. Not sure yet what the best fix is, so I am going to wait out til the next update from CA which should fix the problem. If that doesn't happen soon or my system has problems due to the quarantined/missing wextract.exe, I will probably restore the quarantined item using CA's tools that come with the anti-virus software.

This all did give me quite a scare though since I pride myself on keeping as secure a system as I can considering I am running Windows. Anyway, I hope this post helps somebody not feel as freaked out as I was initially. There isn't much info online as of now.

Oh, as a side note, I would be careful about going to sites you might find by searching for glenwiry. I think many of them are bogus. If you do go to one by mistake, don't try and click any videos posted there. And if you browser goes into a pop-up hell, you should ctrl-alt-del and kill the browser process. That should get you out of the pop-up carousel.

If I learn anything new tomorrow I'll try and update here, but as you can see by my post history, I am not the most prolific blogger.