Yet another new variant is rising out of the smitfraud infection class. ExpertAntivirus is a fake anti-virus program that tries to trick users into purchasing the full version of their software, when in fact it is the problem to begin with.
I recommend that you do not spend the money on this software. Rather than buying it, simply remove ExpertAntivirus manually.
Computer repair in Lincoln Nebraska rules at Schrock Innovations! Thanks Thor for having such great service and thanks to your technicians for getting the job done right the first time. I would recommend these guys anytime!
We have been seeing an increase in customers getting infected with the spylocked spyware infection. I blogged about it at the time.
I have found a complete set of remove spylocked instructions. Let me know if you need help with them.
If you are into technology news visit my new blog at http://www.thorschrock.com. Have a good one!
A new spyware infection cameacross my bench today. It is a variant of the SpywareQuake infection called Brave Sentry 2.0. You can view complete Brave Sentry removal instructions at http://www.schrockinnovations.com/removebravesentry.php
Trojan.PPDropper.B may arrive as a Powerpoint attachment in the following email:
From:
[REMOVED]@gmail.com
To:
Undisclosed-Recipient:;
Subject:
[CHINESE CHARS]
Attachment:
[CHINESE CHARS].ppt
When Trojan.PPDropper.B is executed, it performs the following actions:
%System%\regvrt.exe
Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
When Backdoor.Haxdoor.N is executed, it performs the following actions:
Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dvb03a
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dvb06a
The Trojan creates the following registry subkey on computers running Windows XP/2000/NT so that it is executed every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\
Minimal\dvb06a.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\
Network\dvb06a.sys
Download files
Execute programs
Control the device driver of the rootkit
Steal passwords stored in Protected Storage
Steal cached passwords by calling the WNetEnumCachedPasswords API
Steal the Miranda IM password
Gather dialup connection information
Check if webmoney application is installed on the compromised computer
Steal ICQ passwords
Log keystrokes
https://www.e-gold.com/acct/[REMOVED]
When W32.Looked.P is executed, it performs the following actions:
Note:
"auto" = "1"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Soft\DownloadWWW
and either creates the infection marker or exits if it is found.
"load" = "%Windir%\rundl132.exe"
to the registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
so that it runs every time Windows starts.
Kingsoft AntiVirus Service
[http://]www.wowchian.com/dl[2 LETTERS[REMOVED]
W32.Banwarum@mm is a mass-mailing worm that uses its own SMTP engine to send an email to addresses that it gathers from the compromised computer. The worm also spreads through the network by exploiting the Microsoft Windows ASN.1 Library Bit String Processing Variant Heap Corruption Vulnerability (as described in Microsoft Security Bulletin MS04-007). The worm also opens a back door via HTTP access.
When W32.Banwarum@mm is executed, it performs the following actions:
%System%\mszsrn32.dll
Note: %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
winlogon.exe.
"DllName" = "%System%\mszsrn32.dll"
"Startup" = "Startup"
"Asynchronous" = "1"
"Impersonate" = "0"
"Type" = "2"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mszsrn32
From: Spoofed
Subject:
One of the following
Message body:
One of the following
where the variable [PASSWORD] represents randomly generated passwords.
Attachment:
One of the following
Note: The attachment contains the worm with randomly generated passwords.
