|
Welcome to
mickyj.com
|
Malware Blog
This blog is by no means the first or last place
to look for Malware alerts. This is where I post about the Malware I have
seen or the really big infections. I would not have enough time to list them
all so this is my experience and hopefully, you have found this page
because you have found something similar and need some help with it.
My best source of information about websites to avoid and what
malvertisements are out there, is Sandi's blog. Sandi
Hardmeier is also a Microsoft MVP (In Internet
Explorer) and has her own blog at
SpywareSucks
Some of her blogs include some of the more recent nasties that infect Mac
machines (June 24 2008)and also SQL injections.
It is also interesting to see the Malware she has found on Disney websites
(June 12 2008) and other sites you would normally trust.
Firstly, to survive the net, my recommendations.
Install
the latest updates from Microsoft. Run a good antivirus. Check for Malware
with Spybot and Hijackthis once a week. Run the latest version of Windows
and Internet Explorer. Clean your temporary folders weekly and update all
your programs. This includes updating Directx, .Net, Java, Adobe reader, flash, QuickTime, real player and
media player. These can all be exploited by those annoying ads you see
popping up (Especially flash).
|
 | |
September 5
2009 - Mickyj.com
Mpeg Video Vulnerability
Keywords: Code, Exploit, ActiveX, Mpeg
Security Advisory: Vulnerability in Microsoft Video ActiveX Control Could
Allow Remote Code Execution
September 5
2009
- Mickyj.com |
|
| |
July 5 2009
Torrents and Peer-Peer (p2p)
Keywords:
Frostwire, Gnutella, Morpheus, Ares Destiny, mp3 rocket,
eMule, Bearshare, iMesh, Shareaza, bearshare, kazaa, limewire, emule,
Grokster, edonkey, WarezP2P, WinMX, Bittorrent, uTorrent,BitComet, ABC,
BitLord, TurboBT and Azureus, Vuze
Parents, I implore you. Stop your kids
illegally downloading music and movies. Free is not free. They are infecting
your PC's with goodness knows what and your banking and passwords are at
risk.
Use iTunes, pay for what you want. If you use
Torrents and Peer-peer tools, you will likely get hacked. (As seen by me
when I come to clean up peoples computers).
Don't risk it !!!
while P2P file sharing
technology is completely legal, many of the files traded through P2P are
copyrighted. Those that upload pirated files, usually include viruses and
tojans.
No more Bittorrent,
uTorrent,BitComet, ABC, BitLord, TurboBT and Azureus or Vuze (or other
torrent tools).
No more Frostwire, Gnutella,
Morpheus, Ares Destiny, mp3 rocket, eMule, Bearshare, iMesh, Shareaza,
bearshare, kazaa, limewire, emule, Grokster, edonkey, WarezP2P, WinMX (Or
other Peer-Peer tools)
July
5 2009
- Mickyj.com |
|
| |
December 7 2008
MSN, it's not evil
Keywords: MSN, Virus
Here I am telling a parent that their little girl infected the one PC in the house, which they use for banking, with a keylogger and virus. I am explaining that technology is their friend, but it is up to them how they use it. I can prove, in this instance, that the virus came through using MSN messenger. A "Friend" sent the child an image. The child accepted not realising it was "XXXXX.jpg.exe" and ran it. They thought only their friends would popup in MSN and trusted the download was an image of a friend. MSN messenger is not evil. Some of the users are and it can easily be exploited.
Parents be wary.
December
7 2008
- Mickyj.com |
|
| |
December 6 2008
AVI's and MP3's are vulnerable
Keywords: AVI, MP3, Limewire, virus
Yesterday I was dismayed that clients could be so easily duped into downloading a virus and yet had very little concept of what was happening. Today I have to report on a client who was using Limewire.
They were downloading AVI movie files and Music MP3 files.
The client came to my attention as they mentioned how slow their PC was and how they were getting popups. I ran the Trend Micro command line scanner across their Pc and found to my horror, 373 viruses in AVI and MP3 files.
The movies apparently worked well in Media player and the music played however, in real life, the downloads were heavily infected with viruses. People need to remember, downloading these items, free movies and music, will cost you in the long term.
December
6 2008
- Mickyj.com |
|
| |
December 5 2008
Attack of the Gif file
Keywords: Virus, Gif File
Today is a sad day. Today I have witnessed a very dangerous virus in a Gif file. The Gif file contained an image as expected, and a virus. It looked like a normal image on a website however, it attacked the Pc that downloaded it and rendered the client and their network useless for 2 days. This means normal computer users, unsuspecting people, will now get infected more and more.
The virus dropped an executable file, MarioForever.exe. The file placed itself onto every open network share, including Linux boxes. It dragged the network to it's knees and proved very hard to remove. What makes today sadder than any other virus attack is the trusting nature we all have around image files. We get them on websites and in our email. We don't think about them containing malicious code. Think about your average PC user, they unknowingly are getting themselves attacked.
December
5 2008
- Mickyj.com |
|
| |
September 25 2008
_qbotinj.exeI have a client who
had suspected that they had a virus for some time. They did not deem it
important to let me know. When they logged into their PC, after everything
had settled and finished loading, Explorer would crash and want to send
information off to Microsoft. From that point onwards, popup ads would start
appearing. I ran Hijackthis, rootkit revealer, Trend Micro Sysclean, Spybot
1.6 (with Rootkit plugin) and Malware bytes. Nothing found the cause of the
popup ads. I manually checked through the running processes and dll files
with process explorer. There were no clues. On reboot, I happened to start
up task manager and watch processes as they loaded. There was this
"_qbotinj.exe" file starting up. Nothing I ran could find it on the hard
disk. It seems to be a rootkit of some kind. I found information regarding
this, it is a virus and easily removed using Prevx. In this case, Prevx CSI
could not find it.
http://spywarefiles.prevx.com/RRFBGJ29452751/_QBOTINJ.EXE.html
I looked in C:\Documents and settings\all
users\_qbothome\ as suggested in various documentation, the path did not
exist. Then I ran regrun reanimator and it found it but could not remove it.
It did stop it running. When the rootkit was removed from memory I could see
C:\Documents and settings\all users\_qbothome\ folder and renamed
_qbotinj.exe to _qbotinj.old and created a folder called "_qbotinj.exe".
As it turns out, on reboot, something tried
to place the file _qbotinj.exe back into the file system but could not, as I
had a folder there by the same name. Then I saw all the text log files. All
websites, Internet explorer autocomplate, passwords, usernames and
Visa/Banking details had been captured through keylogging and placed into
this log file. Not nice. When you see popups ... tell someone. Get it
checked.
September 25 2008
- Mickyj.com |
|
| |
August
28 2008
It is estimated in 2009, new Malware will appear at a a rate of 4,500 per
hour. So much for hourly pattern updates :(
28 August
2008
- Mickyj.com |
|
| |
August
10 2008
Can't open Executable files anymore, they will not run.
A while back, a virus injected itself into the registry in
the following key
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
This key dictates how executable files should run. The data was:
(default) =
%system%\drivers\spools.exe "%1" %*
When you clean the virus
off the system, it is gone but you
still can not run Executables.
Open the key up in Regedit and change it back to
(default) = "%1" %*
And everything should now work as normal.
10 August
2008
- Mickyj.com |
|
| |
August
5 2008
Emails that can kill
After the UPS email, more have followed. Popular emails have included "CNN.com
Daily Top 10", Microsoft announcing a new internet browser and "New
PDF Version for Windows". There have also been emails with subjects relating
to recent news events or events we would all consider exciting. All this is
aimed at tricking you into downloading something or viewing something.
Unless you subscribe to CNN or a specific news service, don't even bother to
open them. Adobe and Microsoft do not advertise in this way and the news
headlines.... To good to be true.
Reader be
aware !!
5 August
2008
- Mickyj.com |
 | |
July 28 2008
New Malware killer
In case of infection, break glass
I have a new Tool for you. Especially good at cleaning up the UPS Malware. It is called Malware Bytes. Learn to love it as this tool actually works. If you like it, buy it. This tool has certainly helped my clients today. Thanks to Jerome for putting me onto it.
28
July 2008
- Mickyj.com |
|
| |
July 15 2008
UPS
A series of emails used to spread
the Agent.JEN Trojan has appeared. The messages purport to come from the
package delivery company UPS.
The message body, with subjects such as “UPS packet N3621583925”, informs
the recipient that it was impossible to deliver a postal package sent by
them and advises to print out a copy of the attached invoice.
The invoice is included in an attached “.zip” file that contains an
executable file disguised as a Microsoft Word document with names like “UPS_invoice”.
However, if the targeted user runs the file, they will be introducing a copy
of the Trojan into their computer. (And Rootkit and Virus).
The malicious code copies itself to the system, replacing the
Userinit.exe file in the Windows operating system. This file runs the
Internet Explorer browser, the system interface and other essential
processes. The Trojan then copies the system file to another location under
the name userini.exe not interfering with the computer’s work and without
raising any suspicion of the infection.
Agent.JEN connects to a Russian domain (already used by other banker
Trojans) and uses it to send a request to a German domain to download a
rootkit and an Adware detected. This further increases the risk of
infection.
I have had several clients infected with this Malware and it is very
nasty. I have a work around to remove the Malware however, running the
latest Antivirus and Antivirus patterns is the best solution (and not double
clicking strange attachments from people you do not know).
One of the side effects of this Malware is that Spybot and Hijackthis
will not work. You can double click them but they do not start.
If this is a networked PC, My solution is to have the user log off. This
releases various executables from memory and leaves the PC ready to be
logged on to. From another PC with local Administrator rights over the PC, I
connect remotely (using \\workstationname\c$) and then proceed to replace
and remove certain files.
I extract an original file from i386 in the windows installer files, userinit.ex_.
(Use Expand.exe Userinit.ex_ Userinit.exe)
and place the file
over the top of the infected one in C:\Windows\System32.
I locate C:\Windows\buritos.exe and delete it, creating a
folder called
C:\Windows\buritos.exe.
I locate C:\Windows\karina.dat and delete it, creating a folder called
C:\Windows\karina.dat.
Some
infections also produce
- braviax.exe
- beep.sys
- XPSecurityCenter.exe
15
July 2008
- Mickyj.com |
|
| |
June
28 2008
Did you
know?
The number of poisoned web sites is increasing. 1 in 1000 web pages are infected
with malicious drive-by downloads (source IDG News).
28 June 2008
- Mickyj.com
|
|
| |
June 16 2008
And today was meant to be a good day !
On the 16th we had Wayne Small (MVP) In town to talk about SBS 2008, WooHoo!
Starting the evening of the
15th, I had a client infected with Malware after surfing the web. I suspected a
particular website after reviewing ISA logs and Trend Micro Alerts.
I got to the
point where I needed some advice so I contacted
Sandi
Hardmeier.
We isolated a number of links hidden in
Flash advertisements that were downloading flash.exe and
system936193ow.dll onto systems and infecting
them.
Most of my clients infected were legal practitioners so it was obviously a
website they all used.
On the 16th, SQL injections increased dramatically and
the Website MVP's use to blog with (http://msmvps.com)
was hit badly. Blogs were dying left right and centre and Microsoft were telling
us to wipe the servers and start again. No one could get the alert out. Most notably was
Susan Badleys (MVP)
blog where she showed the server running unknown software after being attacked.
It looked like the 16th was going to be a terrible day.
First to my immediate issue, I blocked the
following websites to stop the new Malware.
users are
likely being attacked through an embedded iframe that is being
used to exploit a security vulnerability in something like RealPlayer, or
flash, or
QuickTime or something like that.
Onto Susan's findings with the MVP blog server (SQL
injection target)
There is no such Microsoft
program or service !
In Susan's words
In getting
ready for the upgrade to CS 2008 I was trying to make some special backups...
that wouldn't work. Well in digging into the matter more, that' service that is
missing some files which is causing the peer to peer backups between Brianna and
Yoda to fail.. isn't a real service at all.
http://www.sophos.com/security/analyses/viruses-and-spyware/w32rbotgos.html
We have backups so first thing tomorrow morning I'll be calling PSS Security to,
more than anything else find out the "how" this happened.
Bottom line we got a critter on the box and I didn't (intentially anyway) put it
there.
And to check to see if Yoda should be quarantened (aka web server turned off) to
protect web visitors as well. So if the blog goes off the air a bit we're just
doing it to better protect viewers.
Yoda etc are the names of the servers used to look after
MVP blogs. PSS is a Microsoft support team and they recommended wiping the
server blank as this was a serious infection.
16 June 2008
- Mickyj.com
|
| |
June 12 2008
Sandi joins Truste.
Well done Sandi, you deserve everything that
comes your way for your tireless efforts in keeping Malware at bay.
Noted Malware Researcher
and Microsoft MVP, Sandi Hardmeier Joins TRUSTe
Compliance and Network Monitoring Team
June 12, 2008 (San
Francisco, Ca) - TRUSTe, the recognized authority
on privacy best practices on the Internet, today announced
Sandi Hardmeier will join TRUSTe as an Online Compliance
Researcher. Ms. Hardmeier is a recognized and widely sought
after industry expert in the field of malware and
malvertizing and their impact on consumer privacy and
security. She will play a key role in TRUSTe's development
of improved network monitoring strategies while providing
customers with expert insight and recommendations to combat
existing and emerging Web threats such as spyware, computer
viruses, and other types of malware.
"Sandi has been studying
malware since 2000, and has watched its metamorphosis from
simplistic, easy to remove adware into the sophisticated
crime-motivated products we see today," said Fran Maier,
executive director of TRUSTe. "Sandi will help us build our
expertise in the important intersection between online
trust, privacy and security."
Sandi has been a Microsoft
Most Valued Professional (MVP) since 1999, specializing in
Internet Explorer and Internet Security as it pertains to
business and consumers. She also has an array of published
work and is the author of
www.msmvps.com/spywaresucks (a Web site dedicated to
teaching Internet users about the latest risks to their
online safety and how to stay safe when surfing the Web);
www.ie-vista.com (dedicated to providing technical
support to users of IE7 and IE8); and
http://inetexplorer.mvps.org (dedicated to providing
technical support to users of IE6 and earlier).
About TRUSTe
TRUSTe helps millions of consumers identify trustworthy
online organizations through its Web Privacy Seal, Email
Privacy Seal and Trusted Download Programs. TRUSTe ensures
online privacy and protects confidential user information on
more than 2,400 Web sites and many of the most highly
trafficked, including Yahoo, AOL, Microsoft, Disney, eBay,
Intuit, and Facebook. Independent research shows that when a
TRUSTe web seal is present, visitors and customers are more
likely to share personal information, register at higher
rates and spend more money. To learn more about internet
privacy visit
www.truste.org.
Media Contact:
Carolyn Hodge
TRUSTe
(415) 520-3415
chodge@truste.org
|
|
12 June 2008
- Mickyj.com
|
( )
|
|
