Spyware, viruses, &amp; security forum: VIRUS \ SPYWARE ALERTS - July 8, 2009

Trojan-Downloader:W32/Mebroot.gen!B

by Marianna Schmudlach - 7/8/09 7:24 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Name : Trojan-Downloader:W32/Mebroot.gen!B
Category: Malware
Type: Trojan-Downloader
Platform: W32

Summary
This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

Additional Details
Trojan-Downloader:W32/Mebroot.gen!B is a Generic Detection that identifies the downloader program responsible for fetching the Mebroot installer.

The downloader is known to be distributed to users via a malicious website (driveby download) or via an exploit.

When active, the downloader downloads an encrypted file on port 443 or 80 from:

http://bcoxgcgxes.com (encrypted file)

where (encrypted file) is a defined string. This string is unique in every sample.

Once downloaded, the encrypted file is first saved in an allocated memory where it will be decrypted, then saved to a file in a temporary folder. The file will then be executed.

The encrypted file is encrypted with an RC2 encryption algorithm. The Cipher Hash that is used in the decryption is based on a defined string that is also unique in every sample.

http://www.f-secure.com/v-descs/trojan-downloader_w32_mebroot_gen!b.shtml

Was this reply helpful? (0) (0)

Staff pick

Activity Monitor

by Marianna Schmudlach - 7/8/09 7:26 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Adware or PUA

Type

* System Monitor

Affected operating systems Windows

"Activity Monitor" is a system monitoring application from www.softactivity.com.

The default installation location is:

<Program Files>\SoftActivity

The following files and folders will also be typically created:

<Start Menu\Programs>\\Activity Monitor
<Start Menu\Programs>\\Activity Monitor\Activity Monitor.lnk
<Start Menu\Programs>\\Activity Monitor\Activity Monitor Help.lnk
<Start Menu\Programs>\\Activity Monitor\Activity Monitor website.lnk
<Start Menu\Programs>\\Activity Monitor\Purchase Activity Monitor.lnk
<Start Menu\Programs>\\Activity Monitor\Uninstall Activity Monitor.lnk
<Start Menu\Programs>\\Activity Monitor\SoftActivity Log Viewer.lnk
<Desktop>\Activity Monitor.lnk
<User>\Application Data\Softativity
<User>\Application Data\Softativity\alist.dat

Registry entries are created under:

HKCR\SoftActivity Log
HKCR\.salog
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{142E758E-2AC3-443A-A549-7E6A036285A2}_is1
HKCU\Software\Softactivity
HKCU\Toolbars state\BCGPBaseControlBar-157
HKCU\Toolbars state\BCGPControlBar-157

Activity Monitor provides an uninstall option which can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as "Activity Monitor 4.4".

http://www.sophos.com/security/analyses/adware-and-puas/activitymonitor.html

Was this reply helpful? (0) (0)

Staff pick

CasOnline!5c5a907e332c

by Marianna Schmudlach - 7/8/09 7:32 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Type
Program
SubType
-
Discovery Date
07/08/2009

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files were analyzed:

# %USERPROFILE%\local settings\temp\5c5a907e332cd4bfeb00dbf47c31a1f1.exe

http://vil.nai.com/vil/content/v_175413.htm

Was this reply helpful? (0) (0)

Staff pick

Adware-TryMedia!b4abfb6c52a1

by Marianna Schmudlach - 7/8/09 7:33 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Type
Program
SubType
Adware
Discovery Date
07/08/2009

This software is not a virus or a Trojan. It is detected as a "potentially unwanted program" (PUP). PUPs are any piece of software that a reasonably security- or privacy-minded computer user may want to be informed of and, in some cases, remove. PUPs are often made by a legitimate corporate entity for some beneficial purpose, but they alter the security state of the computer on which they are installed, or the privacy posture of the user of the system, such that most users will want to be aware of them.

System Changes

These are general defaults for typical path variables. (Although they may differ, these examples are common.):
%WinDir% = \WINDOWS (Windows 9x/ME/XP/Vista), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM (Windows 98/ME), \WINDOWS\SYSTEM32 (Windows XP/Vista), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

The following files were analyzed:

# %USERPROFILE%\local settings\temp\b4abfb6c52a168a1d00feef03e47384d.exe

http://vil.nai.com/vil/content/v_175377.htm

Was this reply helpful? (0) (0)

Staff pick

Trojan.Dozer

by Marianna Schmudlach - 7/8/09 9:23 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Discovered: July 8, 2009
Updated: July 8, 2009 3:05:27 PM
Type: Trojan
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

Trojan.Dozer is a Trojan horse that performs distributed denial of service (DDoS) attacks.

Symantec Security Response is currently investigating this threat and will post more information as it becomes available.

http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-070814-5311-99

Was this reply helpful? (0) (0)

Staff pick

Troj/Inject-ID

by Marianna Schmudlach - 7/8/09 9:28 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojinjectid.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Iframe-CJ

by Marianna Schmudlach - 7/8/09 9:29 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

How it spreads

* Web browsing

Affected operating systems Windows
Characteristics

* Drops more malware

http://www.sophos.com/security/analyses/viruses-and-spyware/trojiframecj.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Dloadr-CPR

by Marianna Schmudlach - 7/8/09 9:30 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrcpr.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/BankPh-Gen

by Marianna Schmudlach - 7/8/09 9:30 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Aliases

* PWS-Bankpatch.gen trojan

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbankphgen.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Badsrc-F

by Marianna Schmudlach - 7/8/09 9:31 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

How it spreads

* Infected files

Affected operating systems Windows
Characteristics

* Drops more malware

http://www.sophos.com/security/analyses/viruses-and-spyware/trojbadsrcf.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLK

by Marianna Schmudlach - 7/8/09 9:32 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentklk.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLJ

by Marianna Schmudlach - 7/8/09 9:33 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentklj.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLI

by Marianna Schmudlach - 7/8/09 9:33 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentkli.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLH

by Marianna Schmudlach - 7/8/09 9:35 AM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentklh.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Dloadr-CPM

by Marianna Schmudlach - 7/8/09 12:53 PM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdloadrcpm.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLQ

by Marianna Schmudlach - 7/8/09 1:02 PM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentklq.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLP

by Marianna Schmudlach - 7/8/09 1:03 PM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentklp.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLN

by Marianna Schmudlach - 7/8/09 1:04 PM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentkln.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick

Troj/Agent-KLM

by Marianna Schmudlach - 7/8/09 1:05 PM

In Reply to: VIRUS \ SPYWARE ALERTS - July 8, 2009 by Marianna Schmudlach

Category

* Viruses and Spyware

Type

* Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentklm.html?_log_from=rss

Was this reply helpful? (0) (0)

Staff pick