Spywarebox: A blog about online (in)security.

RED ALERT!!

2008-05-30T13:31:00.000-07:00

Nice wallpaper pushing a rogue.

AdultFriendFinder account suspended

2008-05-13T15:15:00.001-07:00

Some spyware pushed AdultFriendFinder... but apparently they got blocked ;-)

Buffer overflow attempt?

2008-05-13T15:14:00.000-07:00

BraveSentry joke

2008-05-01T14:53:00.000-07:00

What? You must be kidding!

Spot the mistake courtesy of TrustedAntivirus

2008-04-07T19:35:00.001-07:00

Hint: achtung!

Winsoftware localisations

2008-04-01T10:47:00.000-07:00

Having fun with different versions of WinAntivirusPro... French, German, Italian.... you name it.

TrustedAntivirus Scam

2008-03-31T15:06:00.000-07:00

Ah... it will never change...

Scam again

2008-03-31T13:26:00.000-07:00

Don't buy this rogue stuff. It's a S.C.A.M.!!!!

Malware tampers with verclsid

2008-03-19T09:09:00.000-07:00

Verclsid.exe is used to verify a COM object before it is instantiated by Windows Explorer.

This threat attempts to delete verclsid.exe. I guess the idea is to execute a non verified nasty COM object regardless ;-)

AVSystemcare, 5 star rating?

2008-03-03T15:48:00.001-08:00

My PC gets infected with a Trojan which pushes the famous AVSystemCare rogue:

Very nice install screen!

Lots of happy customers:

It's MY DECISION!!!

Verdict:
A very good looking product with very bad intentions (your money).

When a picture hides an executable

2008-02-28T15:58:00.000-08:00

A GIF file is harmless, right?

Wait, maybe not!

It turns out it's an EXE renamed just for the fun of it.

VirusTotal sneak preview:

Fake Zlob Trojan codec site down? or not....

2008-02-28T09:15:00.001-08:00

Apparently a goner....

Hmm.... maybe not:

Trojans from China: exposed!

2008-02-27T15:53:00.000-08:00

A nice collection of Trojans being pushed massively stored at:
down[hidden].china-s0ft.cn/downlist.txt

and more from another domain:

Zlob Trojan: fake error, real infection

2008-02-25T12:44:00.000-08:00

I found a fake video codec while doing some Google searches. It is very well crafted, with a bit of social engineering. At first I thought this one was VMware aware because of the error message. However, some deeper analysis revealed it was not. Some interesting things came up. Below is a summary.

Upon executing the sample, the following message shows up:

However, in the background things are taking place:

An Internet Explorer toolbar is created:

Only the following security vendors are detecting this threat at the time of posting:

Porn YouTube impersonation leads to malware

2008-02-21T13:21:00.000-08:00

"Show Yourself"?

Once you pick a video, you are prompted to download a codec.

The site is totally bogus and the comments posted are fake (of course). Though kudos to whoever wrote them.

Installs a rogue app (VirusHeat) as well as a bunch of other bad stuff.

RogueFest

2008-02-20T14:38:00.000-08:00

Stay away from those scams!

Malware Crush:

Filter Program:

Advanced Cleaner

Search2Find installs rogue SystemDefender

2008-02-18T12:41:00.000-08:00

Rogue infestation

2008-02-18T11:19:00.000-08:00

A VM image infected with several rogue anti spyware apps. Note the antivirus.exe process (in Process Explorer). Although you see the process, the file is invisible to the system. Rootkit technique....
Also, one of the rogue is VM aware....

Rootkit + Rbot Worm

2008-02-15T12:27:00.000-08:00

I found something interesting while analyzing a malware sample.
A process called "taskmaneger.exe" was running (I can see it in Process Explorer). However it was not visible on the hard disk under its location System32.
I therefore rebooted under Linux (dual boot drive) and mounted the XP disk. I browsed it from Linux and this time I found the cuplrit classified as the Rbot Worm.

It is using Rootkit techniques to hide itself from Explorer, however, the process is still visible....

Most hacked AppInit_DLLs ever

2008-02-05T14:25:00.000-08:00

Storm Worm: Love Edition

2008-01-21T12:23:00.000-08:00

Malware AutoIt error

2008-01-17T13:34:00.000-08:00

AutoIt is a program to write Windows scripts. This malware author didn't smoke test it well enough... it crashed on my machine as it was trying to do its payload.

MSN Worm

2008-01-10T15:54:00.000-08:00

The worm propagates from System to System by downloading an infected Zip file and sending it to all your contacts in MSN.

Stay away from pictures sent to you in a zip file!

A Happy New Year from Storm Worm

2008-01-04T13:52:00.000-08:00

Email from Storm Botnet:

Infected page with obfuscated JavaScript:

Installs a rootkit on the PC

Facebook Phishing Scam

2008-01-04T09:39:00.000-08:00

This domain is hosted in China and pretends to be the Facebook login page.

Fiddler transcript below. It captures your email address and password and sends it over. After that, it redirects you to the legit Facebook page where you are prompted again to enter your credentials.

DioCleaner Rogue

2007-12-11T13:05:00.001-08:00

Typical Rogue infection.

IE Defender infection + hijacked search results

2007-11-28T16:36:00.000-08:00

Broken exploit

2007-11-09T09:25:00.000-08:00

Nice little function... but it is broken now. Too bad.

Rogue uses System Shutdown ploy

2007-11-05T12:59:00.000-08:00

If you let the timer go all the way, nothing happens.. of course...

Fake 404 contains an iframe

2007-11-02T10:12:00.001-07:00

YES!!!!!!!

My Google homepage hacked

2007-10-29T15:34:00.001-07:00

Weird Error Message

2007-10-29T15:33:00.001-07:00

Rogue with Knowledge base: are you serious?

2007-10-26T11:35:00.001-07:00

Oh, a security toolbar?

2007-10-18T15:29:00.000-07:00

Welcome back to AVSystemCare's deceptive security toolbar.

PrivacyProtector's provocative ad

2007-10-18T15:26:00.000-07:00

How far are rogue programs going to go to convince you?

This is shocking, showing you real porn pictures that you may have on your computer.

PestTrap goes X

2007-10-15T13:09:00.000-07:00

Their new domain: xpesttrap.com

AVSystemCare: from fake alert to rogue

2007-10-15T12:26:00.000-07:00

Fake alert #1:

Fake alert#2:

Webpage:

Rogue:

Storm Worm rootkit

2007-10-12T11:48:00.001-07:00

I know this is kind of old news but here is a little sample of what it does.

Upon execution the file ecard.exe will run its payload, which is installing a rootkit and then will forcefully reboot the machine.

A screenshot of a scan done with RootkitRevealer below shows the file hidden from Windows, but yet still very active.

Part of a Botnet

2007-09-25T15:49:00.001-07:00

After running a Trojan, I checked the network traffic for communications with the outside.

The Trojan was reporting the name of my computer and other info to a web server... The kind of stats a bot herder might use...

Live Messenger infection

2007-09-25T15:40:00.001-07:00

Running Live Messenger with a lot of (unknown) contacts can be a dangerous thing:

First a window pops up. It's not a good sign when I haven't touched my browser:

A quick glance at Process Explorer confirms the infection:

RogueFest in the UK

2007-09-20T16:35:00.000-07:00

behappysyst.com hosts a large number of rogues. It is hosted in the UK

Fake gaming site installs Trojan

2007-09-18T13:03:00.001-07:00

This site installs a variant of the Newar Trojan.

Worm tries to propagate using MySpace posts

2007-09-18T12:58:00.000-07:00

Dangerous URL posted on a MySpace web page.

PornTube... dangerous fake codec

2007-09-05T11:26:00.000-07:00

Watch out for this YouTube imitation... Nasty Trojan when you download a video.

New Zlob fake codec site: hxxp://zero-codec.com

Scam or not?

2007-09-05T08:46:00.000-07:00

It may work... but come on, 100% legal???? What's the point in having a license plate then?

Porn pop up leads to Zango's website

2007-09-04T12:12:00.000-07:00

Ran a Trojan that created a pop-up designed to ressemble Youtube videos. On click, you are redirected to Zango's website.

Well crafted IM Worm

2007-08-30T15:24:00.000-07:00

I came across an interesting IM Worm today:

First, I get this IM with a link to follow:

It brings me to this website, that, for some reason ;-), needs me to install the Flash player:

Surprisingly, this "Flash Player" is infected!!!

In case, I didn't download the file, the webpage itself has a malicious and obfuscated code that pushes the installer down my throat:

And to finish the loop, it sends out Instant Messages in my name to all the people on my contact list (to spread the word I suppose).

The culprits:

Fake Google site

2007-08-29T10:43:00.000-07:00

Drive-by exploit launches when you visit this site. If you use Firefox they trick you into downloading an add-on.

Another point of interest, clicking on the Sign in link will open the AdultFriendFinder website. Oops..

To avoid this, check out the URL in the address bar. It is not Google's. Also, Google will never ask you to download additional software to do a search. At least, not right now.
Also, drag your mouse onto the links on the page, and you may see in IE's status bar, that they point to a totally different site.

Rogue program makes spelling mistake

2007-08-22T13:53:00.000-07:00

Malware - not "Malaware". TrustedAntivirus is a rogue anti-spyware program.

New file name for fake ecard

2007-08-20T13:13:00.000-07:00

Interesting MSN stuff

2007-08-20T10:11:00.000-07:00

This user's display name is "DO NOT ACCEPT FILES FROM ME".... Well, it makes sense since it is trying to send me some infected files... But still, rather odd.

This one likes to send pictures and other stuff... even after the first No, they continued... Of course, these files are dangerous to open.

More fake ecard material

2007-08-16T14:34:00.001-07:00

The malware author is taking on Kaspersky... As you can see in the JavaScript exploit. (Html source code)

Warning! foul language

Ecard changes name, same threat

2007-08-15T10:40:00.001-07:00

If you get one of these emails, stay away from the link as it contains a variant of the Nuwar Trojan.

The ecard.exe file has now been replaced by msdataaccess.exe

UN-obfuscated website

2007-08-14T14:20:00.000-07:00

Whoever hacked this site could have been more discreet... They left a big footprint with their JavaScript exploit appearing top page.

Adult website hacked?

2007-08-14T14:08:00.000-07:00

True or not, thanks for letting users know ;-)

Malware websites backend

2007-08-13T15:51:00.000-07:00

Not sure exactly what all the parameters stand for, but those were found on malware host domains. It seems they dynamically update the malware files and also keep stats.
(Click on the pic to enlarge)

Fake ecard tries to lure you using real Greeting cards signature

2007-08-10T11:29:00.000-07:00

The custom link is malicious, whereas the second one is a legitimate ecard website.

Malware from China

2007-08-09T14:39:00.000-07:00

VirusTotal scan of one of the items... not widely detected yet.

Peculiar Trojan

2007-08-07T17:04:00.000-07:00

This Trojan is quite harsh on system resources... It spawns an insane amount of cmd.exe processes.... I like the cascade effect...

Scan from VirusTotal:

I must have a lot of friends?!?!!

2007-08-07T11:30:00.001-07:00

Below are the domains the fake ecards point to:

YouTube Spam

2007-08-07T10:41:00.001-07:00

C'est la Java-naise in my taskbar

2007-07-31T09:30:00.000-07:00

Fake warning pop up from Ultimate Defender

2007-07-27T14:09:00.001-07:00

URL:
hxxp://209.9.170.171/MTgyOjUxMjo=/ucleaner_setup.exe

I thought "I" was the Admin

2007-07-26T16:29:00.001-07:00

Funny.zip Trojan

2007-07-26T09:57:00.000-07:00

This file comes as an attachment to a social engineering type of email.

Exploit Server lists its malware

2007-07-23T16:12:00.000-07:00

This malicious host has a nice little list of malware items that it lists in an "update.txt" file.

Web exploit

2007-07-23T15:22:00.001-07:00

Internet Explorer didn't like visiting that website ;-)

Privacy Protector Gallery

2007-07-19T14:58:00.000-07:00

Stumbled upon a fake codec... and it displayed all these lovely screens on my PC.
This is hilarious.... trying to push a rogue product with, I must say, really nice graphics (do these people hire an art director???)

Click on the picture to enlarge and have a good laugh (remember though that this is a big scam and a lot of people fall for it).

Fake greeting cards identified on several different domains

2007-07-18T11:25:00.000-07:00

I keep receiving emails daily about a supposed Greeting Card waiting for me. Of course no one would send me a card on the email address I made up. So, it is by nature very suspicious.

I have started collecting the IPs where the malware is hosted and I realize it is on several networks across the US.

Yahoo! Mail protects you from dangerous links

2007-07-12T13:27:00.001-07:00

Another instance of the fake ecard....
But interesting thing, Yahoo! Mail warns me beforing visiting the bad site.

The porn connection

2007-07-12T12:10:00.000-07:00

That's a funny one... I had a fake email address subscribed to a porn newsletter...
I decided to go back to being a good boy and unsubscribed...
Well, first thing I see is a big promotion for a privacy software to delete all my porn pictures. Ah, everything is good to make money these days... (sigh)

$79.95!!!!??? Wow

I think I'll pass on that offer.

Malware creates service using VMware name

2007-07-12T10:43:00.000-07:00

Filename: 1.exe

It copies itself to the Windows folder under the name vmware (no extension). It also creates a service.
Upon execution the file melts.

Detected as BackDoor Hupigon...

Fake postcard links to malware

2007-07-11T16:43:00.000-07:00

Another spam email that lures you... The link is bad, of course.

Spammers use Acrobat Reader to circumvent spam blockers

2007-07-10T09:26:00.000-07:00

I get lots of spam lately coming in the form of a PDF attached to the email. Let's not get fooled... it's just as bad and annoying.

Fake Worm alert pushes malware

2007-07-09T11:08:00.001-07:00

Exploit iframe example

2007-07-04T09:54:00.001-07:00

How a malicious ifrane is inserted into a legit webpage source code and infects your computer:

Click on the images to enlarge

Fake MSN Messenger window

2007-07-03T14:49:00.001-07:00

Don't get fooled by those fake MSN Messenger windows that are part of a website... They tease you in order for you to click on them.... But they are just a redirection to another page... that can contain malicious content...

Social engineering again, and always...

Pops media toolbar comes bundled with DriveCleaner

2007-06-14T14:10:00.000-07:00

When installing DriveCleaner, a rogue anti-spyware application, you get prompted for the PopsMedia toolbar install.

This toolbar sits above your taskbar and harbours the DriveCleaner logo.

Malware borrows Kaspersky's icon

2007-06-08T14:21:00.000-07:00

This piece of malware uses the famous Kaspersky Antivirus's icon to disguise itself. VirusTotal scan follows. It doesn't seem to be very known at all. If you PM me, I can send you a sample.

Porn madness

2007-06-07T17:51:00.000-07:00

A video explains things a lot better ;-)

Trojan downloads a spectacular amount of porn pics

2007-06-07T17:12:00.000-07:00

It started with a nasty Trojan that I monitor using Process Explorer. No IE window is open but the network traffic seems to be on the high... even the CPU is chugging. The Trojan checks for the following domain at regular intervals, which is hosted by ESTDOMAINS.

MSN Malware Spreading fast

2007-06-01T11:46:00.000-07:00

This piece of malware spreads through MSN. One of your contacts will send you an IM, with a zip file, supposedly of photos...
The file turns out to be a nasty piece of malware, not yet very detected by AV companies. Moreover, it won't run under Vmware... making it harder to analyze.

Screenshot of the Instant Message:

The file has been packed with Themida and will not run in VM:

A view with Filealyzer confirms the presence of Themida in the binary:

A VirusTotal scan:

Same exploit won't work twice

2007-05-29T11:16:00.000-07:00

From Movie Codec to Rogue

2007-05-28T16:34:00.001-07:00

It starts with a fake movie codec... that you may download from a porn site in order to watch a video... But what you don't know is that your machine is in danger from now on.

Pop-ups "magically" appear... Funny enough, it's as if they know you have been naughty...

And all of that for a rogue app. to cleanse the machine...

Of course, you must buy this software to remove those violations...

It's a well oiled machine that seems to work :-S

Bad Service...

2007-05-24T11:06:00.000-07:00

At second glance, this ought to be bad...

Media Codec Zlob Screenshots

2007-05-08T09:13:00.000-07:00

That Trojan really tries to scare you... and they're good at it too. I can't help but laugh at it though ;-)
Nice graphics as always... and a touch of humour.

DriveCleaner adds a toolbar

2007-05-01T10:45:00.001-07:00

A friendly EULA

2007-04-23T15:03:00.000-07:00

Just can't shutdown...

2007-04-17T15:18:00.001-07:00

Trojan disables download from Firefox

2007-04-17T15:18:00.000-07:00

The regular Firefox download page:

The corrupted Firefox download page (see how the link has been removed):

At least, they're polite ;-)

2007-04-12T14:35:00.000-07:00

ANI Exploit

2007-04-03T15:25:00.000-07:00

A zero day exploit using the animated cursor... Here is a Javascript code that's at the source.

MSN Worm pushing exploits

2007-03-30T10:12:00.000-07:00

There is a new worm being sent in spam emails... upon execution it will (amongst other things) send out a message to all your MSN contacts with a web link that leads to a Trojan.

Do not open the attachment of course, and always double check before opening a link sent to you by one of your contacts.

Trojan that corrupts the Windows license key

2007-03-22T13:46:00.000-07:00

After running a file called fijnjkie.exe, I had the surprise to see that my Windows copy was not genuine. How nasty is that?!?

"Windows system servise" "Microsoft Corparation"

2007-03-20T13:21:00.000-07:00

Check out the spelling... makes you wonder if its a legit one? ;-)

Mirar Toolbar "INSTALL COMPLEATE", COMPLEATE??

2007-03-09T15:31:00.000-08:00

You know when it's been hacked

2007-02-26T13:52:00.000-08:00

Whoever hacked my machine, made a spelling mistake... or maybe couldn't duplicate the original Admin account... Cheap...

PrivacyProtector: DriveCleaner Variant

2007-02-22T14:43:00.000-08:00

Obviously, you can stay away from those.

A trusted dialer??

2007-02-16T14:43:00.000-08:00

Looks a little suspicious after reading the text...

New rogue... SpyCrush

2007-02-09T09:37:00.000-08:00