A Web of (Mis)Trust?

At our international press tour held in Moscow in early February, we spoke about the dissolution of trust on the internet and discussed the possibility of Certificate Authority subversion and the impact of abused digital certificates.

Our speculation was partly driven by the abuse of trust that Kaspersky Lab monitored and prevented by the stolen Stuxnet digital certificates.

spyware adware malware removal

Japan Quake Spam leads to Malware

Kaspersky Lab has detected a malicious spam campaign using the recent earthquake in Japan to infect users. These emails contain malicious URLs:

anti spyware software antimalware how to remove spyware

Another round of bots for MSRT

This month we add another bot to the MSRT family list – Win32/Cycbot. Cycbot was discovered in August 2010 and has quickly become prevalent.

It seems that Cycbot’s creators called it “Gbot”, as it used this name as an identifier in the reports it would send back to its controllers. Recent variants of the malware have stopped using this identifier, possibly in an attempt to make detection more difficult, but the functionality hasn’t changed much. All of Cycbot’s communications are done using HTTP, including the retrieval of backdoor commands. As a backdoor, it’s functionality is limited to capabilities like updating itself and downloading and running other malware; we’ve seen it download Rogue:Win32/FakePAV in the past. Its main purpose, however, is more subtle.

Cycbot sets itself up as an HTTP proxy for any machine it affects. It does this by listening on a TCP port such as 54141 (this number varies), and then changing the browser’s proxy settings to point to this port on the local host. It can do this for Internet Explorer, Firefox and Opera.

By acting as proxy, Cycbot can intercept all HTTP traffic to and from the browser, which enables it to direct your browser wherever it wants. For example, it will take a search term you enter into your search engine and pass it to what is effectively an imitation search site - a site that directs you to anywhere that will pay them money for the referral. At best, this will lead to an advertisement that is unrelated to what you were searching for; however, often it leads to more malware. Right now, several of the “search” results that Cycbot loads attempt to install malware, including one page that looks quite familiar.

Spending as much time as I do looking at rogues, I am all too familiar with this kind of sham. This one is currently pushing Rogue:Win32/Winwebsec.

Cycbot is a type of “intermediate” malware – a means to an end, in many ways reminiscent of Win32/Renos. Controlling the browser can provide its creators with diverse ways of exploiting an affected user, while causing the user various kinds of pain.

-- Hamish O'Dea

fixing pc errors fix windows errors fix error

Trojan downloader Chepvil on the UPSwing

A new spam campaign using UPS (United Parcel Service) as a social-engineering draw was initiated this week.  The spammed message contains an attachment, detected as TrojanDownloader:Win32/Chepvil.I. The spam campaign actually started around March 16th 2011. The threat was originally detected as Backdoor:Win32/Hostil.gen!A (was Backdoor:Win32/Hostil.F). More specific signatures (TrojanDownloader:Win32/Chepvil.I and TrojanDownloader:Win32/Chepvil.J) were added on March 22nd 2011.

Win32/Chepvil is a trojan that downloads other malware such as Rogue:Win32/Winwebsec, Rogue:Win32/FakeRean, Backdoor:Win32/Cycbot.B and VirTool:Win32/Injector.gen!BG. The retrieved malware is saved to the %TEMP% folder and then executed. Microsoft Malware Protection Center has noticed that detections over the past few days have gone from a handful to around 400k per day.

The majority of these detections are coming from the antimalware technology protecting our Hotmail customers, clearly indicating the vector – spam. At the time of this blog writing, we received a few reports of other online email service account holders receiving this trojan via spam email as well.

Below is a chart indicating observed telemetry of this trojan over a short period of time:

Image 1 – Chepvil telemetry

 

Nearly all of the attached files are named “United Parcel Service document.zip”.

The most prevalent SHA1s for the .ZIP attachment are:
0610CE22DF47B3D9C69DC63387705FD666C7205A
151755454A9D443A8A60996F3F1DC4E0C68A9B5D
2C25B6B2764E4DA5EC0A7D57017DFA5FF2A10873

The most prevalent SHA1s for the .EXE trojan within the .ZIP archive are:
0FB63DFF83DB643C9EE42EFE617BDD539A5FFB8F
142E8b00AA24954f9A4AA2271B8A49C445B87587
DA65B7B277540B88918076949A28E8307AD7E41A

Our geographical data from our endpoint protection products show a heavy focus on the United States:

Image 2 – Chepvil telemetry by geography

 

Below is one example of a spammed message containing the Chepvil trojan.

 

Image 3 – Sample of Chepvil trojan attachment

 

MMPC customers have detection for this issue through the signature TrojanDownloader:Win32/Chepvil.I.

 

- Holly Stewart, Joe Faulhaber, Jaime Wong & Patrick Nolan

antimalware how to remove spyware malware blocker

Spam Campaign on Twitter Leads to Adware

Kaspersky Lab recently discovered a new ongoing spam campaign on Twitter. A Twitter account is actively sending tweets to random people with links to a video. Here’s one of the messages:

fix error free how to fix registry errors fixing errors

"Help us escape Japan" scam mail

how to fix system errors fixing windows errors fix pc

Definition file update for Ad-Aware.

149.649 is now available, new definition file for Ad-Aware 8.2.

150.334 is now available, new definition file for Ad-Aware 9.x, 8.3.

New definitions:
====================


Updated definitions:
====================
MSIL.Backdoor.Agent
MSIL.Trojan.Agent
MSIL.TrojanDropper.Agent
MSIL.TrojanDropper.StubRC
MSIL.TrojanPWS.Agent
MSIL.TrojanSpy.Agent
MSIL.TrojanSpy.KeyLogger
MSIL.TrojanSpy.Zbot
NSIS.TrojanDownloader.Agent
NSIS.TrojanDropper.Agent
VBS.TrojanClicker.Agent
Win32.Adware.Adnur
Win32.Adware.BHO
Win32.Adware.Cinmus
Win32.Adware.EzuLa
Win32.Adware.Gaba
Win32.Adware.Ksg
Win32.Adware.PurityScan
Win32.Adware.RON
Win32.Backdoor.Agent
Win32.Backdoor.Bifrose
Win32.Backdoor.BlackHole
Win32.Backdoor.Bredolab
Win32.Backdoor.Clemag
Win32.Backdoor.Dusta
Win32.Backdoor.Floder
Win32.Backdoor.Gbot
Win32.Backdoor.Hupigon
Win32.Backdoor.IRCBot
Win32.Backdoor.Krafcot
Win32.Backdoor.Nbdd
Win32.Backdoor.Papras
Win32.Backdoor.Poison
Win32.Backdoor.Prorat
Win32.Backdoor.Prosti
Win32.Backdoor.RBot
Win32.Backdoor.Ripinip
Win32.Backdoor.SDBot
Win32.Backdoor.Turkojan
Win32.Backdoor.VB
Win32.Backdoor.Yobdam
Win32.Backdoor.Yoddos
Win32.Dialer.Megadial
Win32.Hoax.ArchSMS
Win32.Monitor.Ardamax
Win32.Monitor.EliteKeylogger
Win32.Monitor.FreeKeylogger
Win32.Monitor.Perflogger
Win32.Monitor.PowerSpy
Win32.P2PWorm.Bacteraloh
Win32.P2PWorm.Palevo
Win32.P2PWorm.Polip
Win32.Rootkit.Agent
Win32.Rootkit.TDSS
Win32.Trojan.Agent
Win32.Trojan.Agent2
Win32.Trojan.AntiAV
Win32.Trojan.AutoIT
Win32.Trojan.BHO
Win32.Trojan.Buzus
Win32.Trojan.Chifrax
Win32.Trojan.Chydo
Win32.Trojan.Cosmu
Win32.Trojan.Cospet
Win32.Trojan.Cossta
Win32.Trojan.Delf
Win32.Trojan.Delfinject
Win32.Trojan.Diple
Win32.Trojan.FakeAV
Win32.Trojan.Fakewarn
Win32.Trojan.Fraudpack
Win32.Trojan.Gabba
Win32.Trojan.Genome
Win32.Trojan.Inject
Win32.Trojan.Jorik
Win32.Trojan.Krament
Win32.Trojan.Llac
Win32.Trojan.Logoninvader
Win32.Trojan.Mahato
Win32.Trojan.Menti
Win32.Trojan.Midgare
Win32.Trojan.Monder
Win32.Trojan.Oner
Win32.Trojan.Pasmu
Win32.Trojan.Pasta
Win32.Trojan.Pincav
Win32.Trojan.Pirminay
Win32.Trojan.Refroso
Win32.Trojan.Regie
Win32.Trojan.Sasfis
Win32.Trojan.Scar
Win32.Trojan.Searches
Win32.Trojan.Sefnit
Win32.Trojan.Siscos
Win32.Trojan.Small
Win32.Trojan.Swisyn
Win32.Trojan.Tdss
Win32.Trojan.VB
Win32.Trojan.Vaklik
Win32.Trojan.Vbkrypt
Win32.Trojan.Vilsel
Win32.Trojan.Webprefix
Win32.Trojan.Zapchast
Win32.Trojan.Zmunik
Win32.TrojanClicker.Cycler
Win32.TrojanClicker.VB
Win32.TrojanClicker.VBiframe
Win32.TrojanDownloader.Agent
Win32.TrojanDownloader.Autoit
Win32.TrojanDownloader.Banload
Win32.TrojanDownloader.CodecPack
Win32.TrojanDownloader.Dadobra
Win32.TrojanDownloader.Delf
Win32.TrojanDownloader.Exchanger
Win32.TrojanDownloader.Fraudload
Win32.TrojanDownloader.Genome
Win32.TrojanDownloader.Geral
Win32.TrojanDownloader.Kido
Win32.TrojanDownloader.Lipler
Win32.TrojanDownloader.Mufanom
Win32.TrojanDownloader.Murlo
Win32.TrojanDownloader.Pher
Win32.TrojanDownloader.Qhost
Win32.TrojanDownloader.Small
Win32.TrojanDownloader.VB
Win32.TrojanDropper.Agent
Win32.TrojanDropper.Cadro
Win32.TrojanDropper.Clons
Win32.TrojanDropper.HeliosBinder
Win32.TrojanDropper.Microjoin
Win32.TrojanDropper.MuDrop
Win32.TrojanDropper.Renum
Win32.TrojanDropper.SennaOneMaker
Win32.TrojanDropper.Small
Win32.TrojanDropper.TDSS
Win32.TrojanDropper.VB
Win32.TrojanDropper.Vedio
Win32.TrojanMailfinder.Delf
Win32.TrojanPWS.Alipay
Win32.TrojanPWS.Bjlog
Win32.TrojanPWS.Kykymber
Win32.TrojanPWS.Lmir
Win32.TrojanPWS.Magania
Win32.TrojanPWS.Nilage
Win32.TrojanPWS.Novlog
Win32.TrojanPWS.OnlineGames
Win32.TrojanPWS.Papras
Win32.TrojanPWS.QQPass
Win32.TrojanPWS.Qbot
Win32.TrojanPWS.Ruftar
Win32.TrojanPWS.VB
Win32.TrojanProxy.Slaper
Win32.TrojanRansom.Fakeinstaller
Win32.TrojanRansom.HmBlocker
Win32.TrojanRansom.PornoBlocker
Win32.TrojanSpy.Agent
Win32.TrojanSpy.Banbra
Win32.TrojanSpy.Bancos
Win32.TrojanSpy.Banker
Win32.TrojanSpy.Flystudio
Win32.TrojanSpy.Qhost
Win32.TrojanSpy.SpyEyes
Win32.TrojanSpy.Zbot
Win32.Worm.Agent
Win32.Worm.Allaple
Win32.Worm.Aspxor
Win32.Worm.AutoIt
Win32.Worm.AutoTsifiri
Win32.Worm.Autorun
Win32.Worm.Ckbface
Win32.Worm.Fearso
Win32.Worm.Fujack
Win32.Worm.Joleee
Win32.Worm.Kido
Win32.Worm.Kolab
Win32.Worm.Mabezat
Win32.Worm.Mydoom
Win32.Worm.Mytob
Win32.Worm.Vbna


MD5 checksum for Ad-Aware core.aawdef is 0998e331649d0dafd028f7d139a7545b

fix error free how to fix registry errors fixing errors