Windows Defender - Trojan Dropper Malware

Malwarebytes discovered the Trojan Dropper in rundlll.32exe file. Windows Defender (WD) did not detect in a scan performed immediately before. I removed with Malwaebytes and did a follow-up scan with Norton Power Eraser which was negative. I do not have Malwarebytes installed but download periodically to do a scan.

Posting this to illustrate the importance of supplementing WD with another AV.

If you are not familiar with Trojan Dropper it is a type of Trojan whose purpose is to deliver an enclosed payload onto a destination host computer.

just looked at your post again and see that the file Mbam found is: rundlll.32exe
There's an extra l id .dlll and the extension is not an executable .32exe

Typo on my part. Only one l, rundll32.exe. Is rundll.32exe an executable extension ?

If you have that file in Mbam quarantine, you might consider sending it to MS for analysis. It could help everyone

I removed from quarantine. Does Malwarebytes automatically collect, or does user have to send. I saw no option.

Hi:

In addition to @Slartybart's excellent advice.

MBAM does conduct anonymous telemetry about detected threats, but I am not sure how that works "under the hood".
I do not think there is currently an in-app file submission process from the GUI (I think it has been a requested feature).

If you think that the detection might be a False Positive detection by MBAM, then I suggest having a look at this forum sticky and then submitting to their F/P forum AT LEAST the MBAM scan log that shows the detection. This KB article explains how to locate and export the log files.
The Research/QA teams will evaluate the data and advise you accordingly.

Also, as @Slartybart pointed out, MBAM Free is only a manual, on-demand scanner. For layered real-time protection targeting zero-hour and zero-day, mostly non-viral malware threats, you need the paid, Premium version alongside your AV.

Cheers,
MM

MoxieMomma said:

Hi:


Also, as @Slartybart pointed out, MBAM Free is only a manual, on-demand scanner. For layered real-time protection targeting zero-hour and zero-day, mostly non-viral malware threats, you need the paid, Premium version alongside your AV.

Thanks for the reply. I am familiar with Malwarebytes and use the free, on-demand scanner as a supplement to WD.

From my research, the rundll.32exe Trojan Dropper seems to a common threat. While there is always a possibility of a false positive, I chose to err on the side of caution and remove the reported virus.

My post was not intended to degrade WD, but to illustrate the importance of a secondary scan by another AV as is also stated on the numerous forum posts on "what is the best av."

Hi;

Thanks for the clarification.

If you had been running MBAM Premium in real-time alongside your AV, it's possible that MBAM might have prevented the infection in the first place.
In my book, at least, it seems preferable to try to PREVENT infection, rather than to try to CLEAN-UP after it.
With certain types of malware these days (e.g. ransomware), after-the-fact cleanup can be too late.

Cheers,:)
MM

Can you point me to what you found?

The below is an example from a google search. Google

Trojan.Dropper Description

A Trojan.Dropper is designed to deliver a payload onto the victim's computer system. However, a Trojan.Dropper will usually lead a large-scale attack, usually not the end infection itself. Typically, one of the main goals of computer criminals is to find ways to install malware onto their victim's computer without alerting the victim of the intrusion. A Trojan.Dropper is a typical method that is quite common.

Typically, a Trojan.Dropper contains a malware infection within itself which is designed to deliver the infection by copying it onto the victim's computer's file system. A Trojan.Dropper will usually install and execute the malware installed and then will often delete itself or simply remain harmless on the victim's computer system.

A Trojan.Dropper will usually be confusing to the victim, and designed to cause no symptoms. A typical example of a Trojan.Dropper is a fake screen saver which, when opened, will simply display an error message. However, even though the error message may look genuine, it will actually have been part of the Trojan.Dropper's tactics to install its payload without the user being aware of the problem. Many Trojan.Dropper infections will include an encrypting algorithm of some kind of obfuscator or packing algorithm to make their detection and removal much more difficult than normal.

Usually, a Trojan.Dropper is created as a way to distribute malware, since a Trojan.Dropper is relatively cheap and easy to distribute. A Trojan.Dropper is also low risk for the criminals that create it, since it is easy for them to cover their tracks when there are several steps to an infection. However, one of the features of Trojan.Dropper infections that make them attractive to criminals is that they can be easily disguised by simply changing their icon and file name.

The payload of a typical Trojan.Dropper will vary from one case to the next. Typically, they will drop executable files, which can then infect the victim's computer system or download malware from a remote location.

There are few symptoms associated with a Trojan.Dropper. Some kinds of Trojan.Dropper infections will display a fake error message while dropping their payload. However, most of the time a Trojan.Dropper will display no signs of infection at all. Usually, the symptoms on an infected computer system will have been caused by the Trojan.Dropper's payload rather than by the dropper. Some examples of Trojan.Dropper infections will be associated with rootkits that hide the Trojan.Dropper's payload and may also make changes to the System's settings and the Windows Registry

Trojan.Dropper or Application.E.Surveiller.D Removal Report


.

.

.