Scam email lead to Keylogger. Beware!

Among a lot of various scam emails about “post express“, we found one email that is unfamiliar, and pretty sure this is a different malware, with subject “Available for pickup“, and included an executable attachment file, “Sent.exe“. Dear Sir I have just returned and received your message — it is 2:25 am in Vancouver. I [...]

spyware and malware removal spyware malware remover remove spyware malware

Network World retraction

free spyware malware malware scanner ewido

MSRT April ?11: Win32/Afcore

This month, the MSRT team added the Win32/Afcore family of trojans to its detections. This malware is also known as Coreflood.

It has evolved over time, first breaking onto the scene in 2003. At the time, it was encountered when visiting a malicious web page containing obfuscated VBScript and detected as TrojanDropper:VBS/Inor.B. Using hexadecimal encoding, the VBScript dropper would create an executable, detected as Backdoor:Win32/Apdoor.C. Its main functionality was somewhat simple then and the malware referred to itself as ?AICORE? in its debug messages.

The threat family dropped off in telemetry in 2009 and also during this time, it became part of a command & control network, or botnet. The sophistication of the malware increased, by spawning multiple processes and through the use of obfuscation and anti-emulation methodology.

During the evolution and changes to what is now known as Afcore, the communication sent by the malware to the C&C server remains technically the same. The malware makes use of debug messages for version tracking purposes. Some of the debug strings include the following:

• AFCORE
• COM2PLUS_MessageWindowClass
• Version 3.1-test22(tv7) built on 06/11/08 at 15:32:57
• Basename: %s, PID: %d (%s)
• Octopus PID: %d(%i)
• Shutting down AF . . .
• Restarting AF . . .
• Respawning AF . . .
• User is logging off (%h)
• AF has exited (%d): %s
• Windows day %d has elapsed
• AF 3.1-test22 has caused exception %h at %s+%h (%h)

Win32/Afcore comprises two components, a dropper and installed malware that runs as a backdoor. The backdoor component is injected into running processes and connects to a remote server to retrieve commands that are executed on the affected system. Commands could include instructions to steal passwords, attack other computers and so on. When the dropper is executed, it creates randomly named executable and data files, such as the following:

%TEMP%\gnfl.dll ? Win32/Afcore
C:\Windows\System32\iaspojcy.dil - Win32/Afcore
C:\Windows\System32\iaspojcy.dat ? data file
C:\Windows\System32\comrspl.dat ? data file
C:\Windows\System32\kbdmlv47.dat  ? data file

The registry is modified to execute Win32/Afcore at Windows start, as indicated below in these examples of modified registry data:

In subkey: HKLM\Software\Classes\CLSID\{B22FE457-E4C9-7E85-2AE3-0AF0B4E3A03C}
Sets value: "(default)"
With data: "iaspojcy"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{B22FE457-E4C9-7E85-2AE3-0AF0B4E3A03C}\InprocServer32
Sets value: "(default)"
With data: "C:\Windows\System32\iaspojcy.dil"
 
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\iaspojcy
Adds value: "(default)"
With data: "{B22FE457-E4C9-7E85-2AE3-0AF0B4E3A03C}"

The registry changes allow Win32/Afcore to execute when Windows Explorer runs and when Internet Explorer is launched.

Win32/Afcore injects code from a utility ?jb.dll?, known as ?jailbreak tool?, to export certificates marked as non-exportable from the Windows certificate store. The certs could then be used by an attacker to access online banking sites in an unauthorized manner. The malware could also perform the following actions:

• modify the registry to run at Windows start
• steal private certificates
• restart or shutdown its currently running process
• monitor window sockets
• make connections to a remote host to transmit data

Additionally, Win32/Afcore could monitor network traffic to steal credentials associated with performing online mobile payments. The malware contains the following strings that it uses when monitoring traffic:

• telegraphic
• swift
• remittance
• foreign
• s.w.i.f.t
• cross-border

Win32/Afcore contains code that assist in capturing traffic and stealing information communicated when visiting websites containing the following strings, two of which are associated with National Health Service sites:

• *.nhs.net/*
• *.nhs.uk/*
• *.hilton.*
• *.yahoo.*
• *.google.*

The trojan monitors communication sent via secure hypertext transfer protocol (HTTPS) as well. Win32/Afcore has been known to communicate with servers named ?joy4host.com? and ?antrexhost.com?. The IP addresses reported for these servers were located in Germany.

The addition of Win32/Afcore to MSRT this month comes at the request of the FBI and the Department of Justice to support a takedown operation which is discussed here:  http://www.justice.gov/opa/pr/2011/April/11-crm-466.html.

Microsoft is pleased to work with law enforcement, industry and academia when it leads to a safer computing environment for all of us. It is gratifying to see law enforcement agencies around the world taking aggressive steps to curb criminality on the Internet. Kudos to all of those involved.

 

-- Jaime Wong & Jeff Williams, MMPC

malware download free virus protection malware virus

Definition file update for Ad-Aware.

149.682 is now available, new definition file for Ad-Aware 8.2.

150.367 is now available, new definition file for Ad-Aware 9.x, 8.3.

New definitions:
====================


Updated definitions:
====================
BAT.Trojan.Shutdown
BAT.TrojanPWS.Labt
JS.Trojan.StartPage
MSIL.Backdoor.Agent
MSIL.Backdoor.Vkont
MSIL.Trojan.Agent
MSIL.Trojan.Inject
MSIL.TrojanDownloader.Vkont
MSIL.TrojanDropper.Agent
MSIL.TrojanDropper.StubRC
MSIL.TrojanPWS.Agent
MSIL.TrojanSpy.Agent
MSIL.TrojanSpy.KeyLogger
MSIL.TrojanSpy.Zbot
MSIL.Worm.Autorun
NSIS.TrojanDownloader.Agent
VBS.Trojan.Agent
VBS.TrojanClicker.Agent
VBS.TrojanDownloader.Agent
Win32.Adware.Admoke
Win32.Adware.Agent
Win32.Adware.Dap
Win32.Adware.Delf
Win32.Adware.EzuLa
Win32.Adware.Gaba
Win32.Adware.Gamevance
Win32.Adware.Ksg
Win32.Adware.MyCashBag
Win32.Adware.RON
Win32.Adware.SideTab
Win32.Adware.SuperJuan
Win32.Adware.TMAagent
Win32.Adware.Zwangi
Win32.Backdoor.Agent
Win32.Backdoor.BO2k
Win32.Backdoor.Banito
Win32.Backdoor.Bifrose
Win32.Backdoor.BlackHole
Win32.Backdoor.Bredolab
Win32.Backdoor.Cakl
Win32.Backdoor.Cetorp
Win32.Backdoor.Curioso
Win32.Backdoor.Dealfa
Win32.Backdoor.Delf
Win32.Backdoor.DragonBot
Win32.Backdoor.DsBot
Win32.Backdoor.Floder
Win32.Backdoor.Gbot
Win32.Backdoor.HttpBot
Win32.Backdoor.Hupigon
Win32.Backdoor.IRCBot
Win32.Backdoor.Kbot
Win32.Backdoor.Koutodoor
Win32.Backdoor.Lolbot
Win32.Backdoor.MoSucker
Win32.Backdoor.Oserdi
Win32.Backdoor.Papras
Win32.Backdoor.Poison
Win32.Backdoor.Prorat
Win32.Backdoor.Protector
Win32.Backdoor.RBot
Win32.Backdoor.Ripinip
Win32.Backdoor.Runagry
Win32.Backdoor.Shiz
Win32.Backdoor.Skun
Win32.Backdoor.Spammy
Win32.Backdoor.Torr
Win32.Backdoor.Turkojan
Win32.Backdoor.VB
Win32.Backdoor.VanBot
Win32.Backdoor.Whimoo
Win32.Backdoor.Wuca
Win32.Backdoor.Yobdam
Win32.Backdoor.Zzslash
Win32.Backdoor.mIRC-based
Win32.Flooder.UDP
Win32.FraudTool.AntiMalwareDoctor
Win32.FraudTool.MSRemovalTool
Win32.Hoax.ArchSMS
Win32.IMFlooder.VB
Win32.IRCWorm.IrcBot
Win32.Monitor.Ardamax
Win32.Monitor.FamilyKeylogger
Win32.Monitor.HomeKeylogger
Win32.Monitor.NeoSpy
Win32.Monitor.Perflogger
Win32.P2PWorm.Palevo
Win32.P2PWorm.Polip
Win32.P2PWorm.Small
Win32.Rootkit.Agent
Win32.Rootkit.Small
Win32.Rootkit.TDSS
Win32.Trojan.Agent
Win32.Trojan.Agent2
Win32.Trojan.Antavmu
Win32.Trojan.AutoIT
Win32.Trojan.BHO
Win32.Trojan.Buzus
Win32.Trojan.Chifrax
Win32.Trojan.Chydo
Win32.Trojan.Cosmu
Win32.Trojan.Cospet
Win32.Trojan.Cossta
Win32.Trojan.Delf
Win32.Trojan.Diple
Win32.Trojan.FakeAV
Win32.Trojan.Fraudpack
Win32.Trojan.Gabba
Win32.Trojan.Genome
Win32.Trojan.Gipneox
Win32.Trojan.Hrup
Win32.Trojan.Inject
Win32.Trojan.Jorik
Win32.Trojan.KillAV
Win32.Trojan.Llac
Win32.Trojan.Lunam
Win32.Trojan.Mahato
Win32.Trojan.Menti
Win32.Trojan.Midgare
Win32.Trojan.Migotrup
Win32.Trojan.Miser
Win32.Trojan.Monder
Win32.Trojan.Nedovb
Win32.Trojan.Oficla
Win32.Trojan.Pakes
Win32.Trojan.Pasta
Win32.Trojan.Pincav
Win32.Trojan.Pirminay
Win32.Trojan.Powp
Win32.Trojan.Qhost
Win32.Trojan.Refroso
Win32.Trojan.Regrun
Win32.Trojan.Sasfis
Win32.Trojan.Scar
Win32.Trojan.Searches
Win32.Trojan.Sefnit
Win32.Trojan.Siscos
Win32.Trojan.Skillis
Win32.Trojan.Small
Win32.Trojan.Smardf
Win32.Trojan.Staget
Win32.Trojan.StartPage
Win32.Trojan.Starter
Win32.Trojan.Swisyn
Win32.Trojan.Tdss
Win32.Trojan.VB
Win32.Trojan.Vapsup
Win32.Trojan.Vbkrypt
Win32.Trojan.Vilsel
Win32.Trojan.Webprefix
Win32.TrojanClicker.Agent
Win32.TrojanClicker.AutoIT
Win32.TrojanClicker.BHO
Win32.TrojanClicker.Casu
Win32.TrojanClicker.VB
Win32.TrojanDDoS.Agent
Win32.TrojanDownloader.Agent
Win32.TrojanDownloader.Banload
Win32.TrojanDownloader.Braz
Win32.TrojanDownloader.Bulilit
Win32.TrojanDownloader.Calipr
Win32.TrojanDownloader.CodecPack
Win32.TrojanDownloader.DNSKrab
Win32.TrojanDownloader.Delf
Win32.TrojanDownloader.Diehard
Win32.TrojanDownloader.Dluca
Win32.TrojanDownloader.Fosniw
Win32.TrojanDownloader.Fraudload
Win32.TrojanDownloader.Genome
Win32.TrojanDownloader.Geral
Win32.TrojanDownloader.Goo
Win32.TrojanDownloader.Homa
Win32.TrojanDownloader.Injecter
Win32.TrojanDownloader.Kido
Win32.TrojanDownloader.Mufanom
Win32.TrojanDownloader.Myxa
Win32.TrojanDownloader.Nekill
Win32.TrojanDownloader.Pakes
Win32.TrojanDownloader.Pher
Win32.TrojanDownloader.Radonl
Win32.TrojanDownloader.Roucdera
Win32.TrojanDownloader.Small
Win32.TrojanDownloader.Tiny
Win32.TrojanDownloader.VB
Win32.TrojanDownloader.Zlob
Win32.TrojanDropper.Agent
Win32.TrojanDropper.Cadro
Win32.TrojanDropper.Clons
Win32.TrojanDropper.Delf
Win32.TrojanDropper.Drooptroop
Win32.TrojanDropper.EESbinder
Win32.TrojanDropper.FC
Win32.TrojanDropper.Flystud
Win32.TrojanDropper.Fraudrop
Win32.TrojanDropper.Joiner
Win32.TrojanDropper.KGen
Win32.TrojanDropper.Meci
Win32.TrojanDropper.MuDrop
Win32.TrojanDropper.NSIS
Win32.TrojanDropper.Pakes
Win32.TrojanDropper.ParaDrop
Win32.TrojanDropper.Pincher
Win32.TrojanDropper.Renum
Win32.TrojanDropper.Small
Win32.TrojanDropper.Stabs
Win32.TrojanDropper.Startpage
Win32.TrojanDropper.TDSS
Win32.TrojanDropper.Typic
Win32.TrojanDropper.VB
Win32.TrojanDropper.Vedio
Win32.TrojanDropper.ZomJoiner
Win32.TrojanPWS.Agent
Win32.TrojanPWS.Autoit
Win32.TrojanPWS.Bjlog
Win32.TrojanPWS.Delf
Win32.TrojanPWS.Dybalom
Win32.TrojanPWS.Emelent
Win32.TrojanPWS.Frethoq
Win32.TrojanPWS.Kapod
Win32.TrojanPWS.Kates
Win32.TrojanPWS.Kykymber
Win32.TrojanPWS.LdPinch
Win32.TrojanPWS.Lmir
Win32.TrojanPWS.Magania
Win32.TrojanPWS.Meger
Win32.TrojanPWS.Nilage
Win32.TrojanPWS.OnlineGames
Win32.TrojanPWS.Papras
Win32.TrojanPWS.QQPass
Win32.TrojanPWS.QQRob
Win32.TrojanPWS.Rebnip
Win32.TrojanPWS.Ruftar
Win32.TrojanPWS.Taworm
Win32.TrojanPWS.Tibia
Win32.TrojanPWS.WOW
Win32.TrojanProxy.Agent
Win32.TrojanRansom.Digitala
Win32.TrojanRansom.Fakeinstaller
Win32.TrojanRansom.HmBlocker
Win32.TrojanRansom.PornoBlocker
Win32.TrojanRansom.Xorist
Win32.TrojanSpy.Agent
Win32.TrojanSpy.Amber
Win32.TrojanSpy.BHO
Win32.TrojanSpy.BZub
Win32.TrojanSpy.Banbra
Win32.TrojanSpy.Bancos
Win32.TrojanSpy.Banker
Win32.TrojanSpy.Banker2
Win32.TrojanSpy.Banz
Win32.TrojanSpy.Delf
Win32.TrojanSpy.Lydra
Win32.TrojanSpy.Montp
Win32.TrojanSpy.Spenir
Win32.TrojanSpy.SpyEyes
Win32.TrojanSpy.VB
Win32.TrojanSpy.Wemon
Win32.TrojanSpy.Zbot
Win32.Worm.Agent
Win32.Worm.Allaple
Win32.Worm.AutoIt
Win32.Worm.Autorun
Win32.Worm.Carrier
Win32.Worm.Ckbface
Win32.Worm.Fearso
Win32.Worm.Kido
Win32.Worm.Kolab
Win32.Worm.Koobface
Win32.Worm.Mabezat
Win32.Worm.Mydoom
Win32.Worm.Mytob
Win32.Worm.Netsky
Win32.Worm.Qvod
Win32.Worm.Rokut
Win32.Worm.Socks
Win32.Worm.Sohanad
Win32.Worm.Trojandownloader
Win32.Worm.VB
Win32.Worm.Vbna
Win32.Worm.Viking
Win32.Worm.Wbna
Win32.Worm.Yahos


MD5 checksum for Ad-Aware core.aawdef is 3402ad540bab2a82edfaf6231f9e3c78

anti malware software virus removal malware detection

Battling the Zbot Threat (with MSRT)

Hello Internet!

As you may recall, last October we updated MSRT to include the well-known malware Zbot (aka Zeus), one of the more prolific bots we see in the wild today. Today, we released a special-edition Security Intelligence Report, entitled “Battling the Zbot Threat,” that documents the background, functionality, prevalence, and geographical distribution of Zbot malware. The paper also shows how Microsoft has had a measurable effect on the Zbot ecosystem since broadening its attack efforts to include the Malicious Software Removal Tool (MSRT) in October 2010.

 

As always, we continue to update MSRT with the result of ongoing research by the MMPC, all the while improving our detections. This is necessary because, as with most malware, Zbot itself is continually evolving, having undergone many changes in the last year or so, ‘updates’ to the file-based obfuscation, anti-AV defensive techniques, information stealing capabilities, configuration file protection, API hooking, pseudo-random domain generation, process injection and file infection. We’ll not go into details of many of these here, but we can show the telemetry we’ve gathered from the MSRT and Microsoft Security Essentials over the last four months documenting the percentage of Zbot detections exhibiting these new features, shown as Zbot 2.x in the chart below:

 

 

 

Of all the changes that Zbot has undergone however, the most significant from an MSRT perspective is the move towards file infection. Since its inception, Zbot has employed process injection targeting multiple processes on the system, the extent of which is governed by the privilege level of the user who unwittingly triggers the infection. (TIP: If you’re going to run an attachment you got from an email or a link, or via Facebook, don’t elevate it to admin via UAC.)

 

In some newer variants of Zbot in the wild, for each infected process it will hook several Windows APIs, modify and infect binary files, and infect files shared in the network. One interesting behavior to note is that the infected process thread will continually monitor and infect other processes.

 

The diagram below shows the simple way to visualize the code injection and hooking process cycle:

 

 

In its original form, Zbot hooked around 15 APIs. But newer versions, dubbed Zbot 2.x, hook upwards of 30 APIs. The API that we are most interested in however is NtCreateFile(), which is invoked upon opening files. As we see in the first diagram, Zbot can infect both directly and upon opening files. This provides a severe hindrance for attempts to manually clean the system. However, if a tedious manual cleaning process doesn’t sound all that palatable, you can sleep well knowing MSRT handles cleaning of an infected system properly. 

 

As always, we recommend using a reputable Anti-Virus product to help ensure you don’t get infected in the first place, like one of the products listed here. You may also consider using Microsoft’s no cost Anti-Virus product, Microsoft Security Essentials. 

 

These patched/infected files are detected as Virus:Win32/Zbot.B, and Virus:Win32/Zbot.C. For detailed information on the more recent malicious behavior of Zbot, please refer to the description on our Encyclopedia: PWS:Win32/Zbot.gen!Y. 

 

Rodel Finones, Holly Stewart, Joe Faulhaber and Matt McCormack

free malware protection spyware malware removal software free anti spyware

Fake MSE updated. Did your real MSE updates too?

Recently, AVG caught a new variant of Fake MSE, which was more sophisticated and confusing. As usually, it will pop up to warn you that you have been infected. If you apply ?recommened? actions, the UI announces that the malware...

malware download free virus protection malware virus

Win32/Renocide, the aftermath

On March 8th, we announced the release of our latest Malicious Software Removal Tool (MSRT), version that included detection and cleaning capabilities for a backdoor enabled worm we are calling Win32/Renocide. If you are not familiar with this threat, we recommend reading our encyclopedia entry here.

According to our telemetry, this new addition was among the top 5 detected threats (in the first week of release), both when when classified based on number of detected files and number of infected machines.

Rank	Family Name	Threat Count
1	Sality	248,250
2	Rimecud	209,208
3	Taterf	178,421
4	Renocide	167,826
5	Frethog	125,781
6	Bubnix	116,772
7	Vobfus	114,850
8	Conficker	88,636
9	Zbot	78,304
10	FakeSpypro	64,904

Chart 1 - Win32/Renocide, detected files

 

Rank	Family Name	Machine Count
1	Rimecud	200,267
2	Taterf	160,632
3	Sality	160,579
4	Renocide	123,413
5	Vobfus	107,866
6	Frethog	104,121
7	Bubnix	88,858
8	Conficker	82,192
9	Zbot	72,669
10	FakeSpypro	62,943

Chart 2 - Win32/Renocide, infected machines

The high tally of affected machines reflects Renocide's relative age; the botnet has been around since 2008 and has slowly but steadily increased its prevalence. Our first detection dates back to the first half of 2008.

If you look at the ranking for machine count you'll notice that the first 2 families are also worms. Rimecud is a backdoor-enabled worm (just like Renocide), while Taterf is an account stealer. Although only third when it comes to machine count ranking, Sality leads in the threat count ranking due to the fact that it is a file infector.

You can read more about all malware families present in this blog from our encyclopedia. We thank you for using MSRT.

Marian Radu,
MMPC Dublin

security tool virus removal adware spyware malware freeware