<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: avg]]></title>
    <link>http://securityratty.com/tag/avg</link>
    <description></description>
    <pubDate>Wed, 26 Dec 2007 20:43:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Texas National Guard Website Remains Unavailable After Malware Infection]]></title>
      <link>http://securityratty.com/article/ff1cd4cce86e77a5cdcaca3b0f22f3c8</link>
      <guid>http://securityratty.com/article/ff1cd4cce86e77a5cdcaca3b0f22f3c8</guid>
      <description><![CDATA[The website for the Texas National Guard remained unreachable on Friday, two days after security researchers said it had been hacked by miscreants who were using it to install malware on visitors PCs....]]></description>
      <content:encoded><![CDATA[The website for the Texas National Guard remained unreachable on Friday, two days after security researchers said it had been hacked by miscreants who were using it to install malware on visitors PCs. Some pages on the website were probably SQL injected.
On Wednesday, Roger Thompson, chief research officer of anti-virus provider AVG, reported that selected [...]]]></content:encoded>
      <pubDate>Fri, 19 Sep 2008 20:08:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/texas national guard">texas national guard</category>
      <category domain="http://securityratty.com/tag/website">website</category>
      <category domain="http://securityratty.com/tag/chief research officer">chief research officer</category>
      <category domain="http://securityratty.com/tag/anti-virus provider avg">anti-virus provider avg</category>
      <category domain="http://securityratty.com/tag/roger thompson">roger thompson</category>
      <category domain="http://securityratty.com/tag/install malware">install malware</category>
      <category domain="http://securityratty.com/tag/security researchers">security researchers</category>
      <category domain="http://securityratty.com/tag/visitors pcs">visitors pcs</category>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <source url="http://cyberinsecure.com/texas-national-guard-website-remains-unavailable-after-malware-infection/">Texas National Guard Website Remains Unavailable After Malware Infection</source>
    </item>
    <item>
      <title><![CDATA[VMWare is Better Than Microsoft]]></title>
      <link>http://securityratty.com/article/a030161b183f83f292761020fb04b7d9</link>
      <guid>http://securityratty.com/article/a030161b183f83f292761020fb04b7d9</guid>
      <description><![CDATA[After barely surviving the VMworld registration process, my first session was From Hypervisors to VMware Infrastructure What Matters? or as I would have called it why VMware is so much better than...]]></description>
      <content:encoded><![CDATA[<p>After barely surviving the <a href="http://www.vmworld.com/conferences/2008/" target="_blank">VMworld</a> registration process, my <a href="https://vmworld2008.wingateweb.com/scheduler/eventguide/publicScheduleByType.jsp?ts=1221517325133" target="_blank">first session</a> was “From Hypervisors to VMware Infrastructure – What Matters?” – or as I would have called it “why VMware is so much better than Microsoft…and if you don’t believe that we can help you make even more money on top of your already successful Microsoft business.” (I know, that title is way too long but quite descriptive.)</p>
<p>The session took place at the beginning of Partner Day. The “regular” conference sessions actually begin tomorrow. Today is spent focusing on partner issues and enablement.</p>
<p>The panel for this session included:</p>
<ul>
<li>Mark Chuang <small>Group Manager, Product Marketing, </small>VMware, Inc.</li>
<li>Kenon Owens <small>Staff Systems Engineer, </small>VMware, Inc.</li>
</ul>
<p>You have to remember that <a href="http://www.virtualization.info/2008/09/more-than-20-partners-announces-support.html" target="_blank">most of the Partners here</a> are not vendors like ScienceLogic, but big and small shops that are selling IT, networking and now virtualization solutions into end-customer environments. For these guys, understanding what virtualization partner programs and tools are at NetApp, for example, is very useful. And many of these companies are already selling Microsoft software and surrounding services for Microsoft products. So if you’re VMware, what’s the message to these partners in the face of the Microsoft juggernaut?</p>
<blockquote><p>Microsoft to partners: “You may not like to admit it, but you’re probably already in bed with us.”</p>
<p>VMware to partners: &#8220;Our hypervisor technology outperforms Hyper-V and Xen, especially at scale. And anyway, it’s not about the battle at the hypervisor. It’s about the V-services on top of the hypervisor – VMotion, Storage VMotion, DRS, etc.&#8221;</p></blockquote>
<p>Interesting and what we all already know, or think we know. The scale issue is an interesting one – too soon for <a href="http://blogs.technet.com/virtualization/archive/2008/09/12/pre-vmworld-check-out-hyper-v-server-and-live-migration-demos.aspx" target="_blank">Hyper-V</a> and who uses Xen? But also interestingly enough, no announcement or even talk about extending VMware management tools to other hypervisors. The point, as the VMware product marketing guy made a point of saying, is that the question they needed to answer used to be “Why Virtualization?” and now it’s “Why VMware?&#8221;.</p>
<p>One more tidbit – this survey run by VMware asking their customers:</p>
<p><strong>What are the top 6 apps you are running on VMware today</strong></p>
<ul>
<li>IIS</li>
<li><em>Apache</em></li>
<li>Active Directory</li>
<li>SQL Server</li>
<li>Sharepoint</li>
<li>Exchange</li>
<p><em></em></ul>
<p><strong>That means, 5 of 6 are Microsoft applications. </strong>Certainly it makes it even more challenging for VMware to navigate a path here.</p>
<p>The change since 2004 – would have talked about why virtualize. And now why VMware. (Duh.)</p>
<p>Talking to partners – many of which already have a successful Microsoft business. How VMware <a href="http://gigaom.com/2008/09/14/for-vmware-an-uncertain-future/" target="_blank">enhances your existing Microsoft business</a>.</p>
<p><strong>Top 6 apps running on VMware today (5 of 6 are Microsoft applications)</strong></p>
<ul>
<li>IIS</li>
<li><em>Apache</em></li>
<li>AD</li>
<li>Sql server</li>
<li>Sharepoint</li>
<li>Exchange</li>
</ul>
<p><em>Source: VMware survey</em></p>
<p>Esxi - VMware – true thin hypervisor; maximizes resources utilization (over 100% memory commitment – allows avg of 2:1 memory overcommit) – host system memory is usually the resource bottleneck – plus Advanced Scheduler runs VMs better under load and to a greater capacity (hard to show this part); performance acceleration – using binary translation (32bit), para-virtualization and Hardware Assist (for 64-bit)</p>
<p>(rvi – rapid virtualization indexing)</p>
<p>No parent partition that all hypervisors have to go through</p>
<p>Vs ms/xen</p>
<p>Parent partition – dom 0 =&gt; potentially problem at scale; i/o that could be a bottleneck</p>
<p>Hyper-v SPECjbb comparison</p>
<p>= 9 vms on VMware and hyper-v hypervisors</p>
<p>Outperform (CPU) by 50% - general purpose scheduler isn’t able to keep up? “got to be”</p>
<p>(cpu only test)</p>
<p>Also used VMmark – to demonstrate again that VMware is performance tuned and designed to run at scale vs Hyper-V</p>
<p>Size Does Matter:</p>
<p>Vmware ESXi: 32MB</p>
<p>Hyper-v – 2.6 GB</p>
<p>Xen – 1.2 GB</p>
<p>Hyper-V uses Microsoft Server Core – so the last two Patch Tuesdays had to make changes to Server Core (nothing to do with Hyper-V) but service interruption for Hyper-V.</p>
<p>VMware VMsafe – “Provides an unprecedented level of security” “virtual is more secure than Real” (uh oh – clearly didn’t read about the</p>
<p>*****************</p>
<p>VMware TEST:512 mb vms on server w/ 4gb ram –</p>
<p>7 vms - xensource (w/no memory overcommit)</p>
<p>6vms – hyper-v before error (w/no memory overcommit)</p>
<p>14vms - w/memory overcommit and management</p>
<p>Running sql io sim – heavy workloads</p>
<p>TCO – not just license; now ESXi is free – so hardware</p>
<p>809 - ESXi</p>
<p>871 – vi3 foundation ($995)</p>
<p>1168- vi3 enterprise ($5750)</p>
<p>1621 – hyper-v – 2x cost because of hw</p>
<p>Xen – 1618</p>
<p>Memory overcommit (89% in production vs. test/dev)</p>
<p>Survey – 37% of respondents at 2:1 RATIO OR HIGHER; real average is around 1.8: 1</p>
<p>*********************</p>
<p>This guy Mark sounds like a used car salesman:</p>
<p>“Always On, On Demand Data Center”</p>
<blockquote><p>Hypervisor is very important but what is more important are the v-services on top of this. Manage shared, pooled resources. “Value Above the Hypervisor”</p></blockquote>
<p>How does all this save “your customers” $$?</p>
<p><strong>VMotion – saves cost on planned maintenance: no more overtime, no more time scheduling maintenance windows (see cost framework below)</strong></p>
<p>10 (# of servers) x 6 (@ of updates) x [ (overtime cost 2hrs x $150/hr) + (scheduling downtime # of apps per server 15 x time spend scheduling per app 0.75 hr x $50/hr)] = $58,500</p>
<p>Same thing with using VMware Storage VMotion</p>
<p>Overtime cost + scheduling downtime + planning move + alternative tool cost - $68,750 (2.5 TeraBytes)</p>
<p><strong>The Value of High Availability</strong></p>
<p>- cost of lost business, lost work</p>
<p>- cost of lost productive time</p>
<p>4 hours of downtime x # of users per vm 10 x number of vms per host 15 x cost of user productive time $50/hr x failures per year in 10-host cluster 2 = $60K</p>
<p>(10 servers, 150 vms)</p>
<p><strong>SAVINGS (using enterprise version)</strong></p>
<p>Update management 149,760</p>
<p>HA 60K</p>
<p>DRS, VMotion Storage VMotion 187,250</p>
<p>808,259 – hw, power cooling, etc.</p>
]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 19:00:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/survey">survey</category>
      <category domain="http://securityratty.com/tag/vmware survey">vmware survey</category>
      <category domain="http://securityratty.com/tag/vmware enhances">vmware enhances</category>
      <category domain="http://securityratty.com/tag/vmware infrastructure">vmware infrastructure</category>
      <category domain="http://securityratty.com/tag/test">test</category>
      <category domain="http://securityratty.com/tag/vmware test">vmware test</category>
      <category domain="http://securityratty.com/tag/overtime cost 2hrs">overtime cost 2hrs</category>
      <source url="http://blog.sciencelogic.com/vmware-is-better-than-microsoft/09/2008">VMWare is Better Than Microsoft</source>
    </item>
    <item>
      <title><![CDATA[AVG fixes antivirus software skewing Web site statistics]]></title>
      <link>http://securityratty.com/article/e5a147b2a18929cb90795173c6e9b6c1</link>
      <guid>http://securityratty.com/article/e5a147b2a18929cb90795173c6e9b6c1</guid>
      <description><![CDATA[Security company AVG is upgrading a component of its antivirus software so as not to place an undue traffic load on the Web sites it...]]></description>
      <content:encoded><![CDATA[Security company AVG is upgrading a component of its antivirus software so as not to place an undue traffic load on the Web sites it scans.]]></content:encoded>
      <pubDate>Sun, 06 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/antivirus software">antivirus software</category>
      <category domain="http://securityratty.com/tag/security company avg">security company avg</category>
      <category domain="http://securityratty.com/tag/undue traffic load">undue traffic load</category>
      <category domain="http://securityratty.com/tag/web sites">web sites</category>
      <category domain="http://securityratty.com/tag/scans">scans</category>
      <category domain="http://securityratty.com/tag/component">component</category>
      <source url="http://www.networkworld.com/news/2008/070708-avg-fixes-antivirus-software-skewing.html?fsrc=rss-security">AVG fixes antivirus software skewing Web site statistics</source>
    </item>
    <item>
      <title><![CDATA[Quality and Assurance in Malware Attacks]]></title>
      <link>http://securityratty.com/article/d253c74d9365d9ea4af482851265b19e</link>
      <guid>http://securityratty.com/article/d253c74d9365d9ea4af482851265b19e</guid>
      <description><![CDATA[The rise of multiple antivirus scanners and sandboxes as a web service, did not only increase the productivity level of researchers and utilized the wisdom of crowds concept by sharing the infected...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/R_Oun1281MI/AAAAAAAABhw/RFtvHsP6svw/s1600-h/multiple_antivirus_offline_scanner.gif"><img id="BLOGGER_PHOTO_ID_5184679595529262274" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R_Oun1281MI/AAAAAAAABhw/RFtvHsP6svw/s200/multiple_antivirus_offline_scanner.gif" border="0" /></a>The rise of multiple antivirus scanners and sandboxes as a web service, did not only increase the productivity level of researchers and utilized the wisdom of crowds concept by sharing the infected samples among all the participants courstesy of the crowds submitting them, it also logically contributed to the use of these freely available services by malware authors themselves. In fact, the low detection rate is often pointed out as the quality of the crypting service by the authors themselves while advertising their malware or crypting services. And when a popular piece of malware known as<a href="http://ddanchev.blogspot.com/2007/08/rats-or-malware.html"> Shark introduced a built-in VirusTotal submission</a> to verify the low detecting rate of the newly generated server, something really had to change - like it did.<br /><br />At the beginning of 2008, VirusTotal which is among the most widely known and used such multiple antivirus scanner as a web service, decided to remove the "<a href="http://blog.hispasec.com/virustotal/28">Do not distribute the sample</a>" option, directly undermining the malware authors' logical option not to share their malware with anti virus vendors, but continue using the service. The multiple antivirus scanner as a web service is such a popular model, that there're several other such services available for free, with many other underground alternatives for internal Q&amp;A purposes. But now that each and every possible service that comes with the malware product is starting to get commercialized, it is logical to question how would quality and assurance obsessed malware authors disintermediate the intermediary to actually break-even out of their investment in a malware campaign? Would they continue <a href="http://ddanchev.blogspot.com/2007/08/malware-as-web-service.html">porting malware services to the Web</a>, or would they take some of their Q&amp;A activities offline?<br /><br />In the past, there've been numerous underground initiatives to come up with an offline multiple virus scanners, and <a href="http://pandalabs.pandasecurity.com/archive/Multi-AVs-Scanners.aspx">here are some examples</a> courtesy of PandaSecurity's Xabier Francisco, and as you can see in the attached screenshot, development in this area is continuing, with the following anti virus scanners included within this all-in-one offline malware scanner :<br /><br />"<em>A-Squared, AntiVir, Avast; AVG Anti-Virus Free Edition, BitDefender, Clam Win, Dr.Web, eTrust; F-Prot, Kaspersky Antivirus 7, McAfee, Nod32; Norman, Norton, Panda, QuickHeal, Sophos, TrendMicro, VBA32</em>"<br /><br />Talking about reactive security, the concept of doing this has always been there, and will continue to evolve despite that the most popular online multiple anti virus scanning services started sharing all the infected samples between the anti virus vendors themselves. And now that malware authors are also starting to understand what behavior-based malware detection is, and how a <a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">host based firewall can prevent their malware from phoning back home</a>, even though the host is already infected, the success rates of their malware campaigns is prone to improve even before they've launched the campaign.<br /><br />When malware authors start embracing the <a href="http://en.wikipedia.org/wiki/OODA_Loop">OODA loop concept</a> -- Observation, Orientation, Decision, Action -- things can get really ugly. Why haven't they done this yet? They Keep it Simple, and it seems to work just fine in terms of the ROI out of their actions. One thing's for sure - malware will start getting benchmarked against each and every antivirus solution and firewall before the campaign gets launched, in a much more efficient and Q&amp;A structured approach than it is for the time being.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Kc4m1aG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Kc4m1aG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2z367EG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2z367EG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Tp1FtDg"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Tp1FtDg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3PzTC2g"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3PzTC2g" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UHIKxnG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UHIKxnG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5uUd5FG"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5uUd5FG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=YeGdiMg"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=YeGdiMg" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/262778806" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 02 Apr 2008 07:49:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware authors start">malware authors start</category>
      <category domain="http://securityratty.com/tag/malware authors">malware authors</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/authors">authors</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/malware services">malware services</category>
      <category domain="http://securityratty.com/tag/start">start</category>
      <category domain="http://securityratty.com/tag/malware product">malware product</category>
      <category domain="http://securityratty.com/tag/malware campaign">malware campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/262778806/quality-and-assurance-in-malware.html">Quality and Assurance in Malware Attacks</source>
    </item>
    <item>
      <title><![CDATA[Cybersquatting Security Vendors for Fraudulent Purposes]]></title>
      <link>http://securityratty.com/article/a4979bd8a1b499a9e5cc7d4c5ea2ca25</link>
      <guid>http://securityratty.com/article/a4979bd8a1b499a9e5cc7d4c5ea2ca25</guid>
      <description><![CDATA[Just like the creative typosquatting coming up with domain names spoofing the structure of PayPal and Ebay's web applications I covered in a previous post, this most recent example of c ybersquatting...]]></description>
      <content:encoded><![CDATA[<a href="http://bp2.blogger.com/_wICHhTiQmrA/R-Lu_l2800I/AAAAAAAABew/U7LJiYAEO6Q/s1600-h/cybersquatting1.jpg"><img id="BLOGGER_PHOTO_ID_5179965297691251522" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R-Lu_l2800I/AAAAAAAABew/U7LJiYAEO6Q/s200/cybersquatting1.jpg" border="0" /></a>Just like the <a href="http://ddanchev.blogspot.com/2007/11/state-of-typosquatting-2007.html">creative typosquatting</a> coming up with domain names <a href="http://ddanchev.blogspot.com/2007/09/paypal-and-ebay-phishing-domains.html">spoofing the structure of PayPal and Ebay's web applications</a> I covered in a previous post, this most recent example of c<a href="http://en.wikipedia.org/wiki/Cybersquatting">ybersquatting</a> is yet another example of how impersonating known and trusted brands can not only damage their reputation if the campaign's not taken care of fast enough, but can also result in actual adware infection. Who's getting targeted in this campaign? <a href="http://pandalabs.pandasecurity.com/">PandaSecurity</a>, <a href="http://www.avertlabs.com/research/blog/">McAfee</a>, Adobe Acrobat, and several other third party applications. It seems that <strong>IBSOFTWARE CYPRUS</strong> is keeping the entire domains portfolio undercover for the time being, with a great deal of these domains returning 403 forbidden messages. However, there are several domains that are actually serving the fake E-shops. This minimalistic approach on behalf of the malicious parties may have proved valuable if the domains were hosted on different IPs, however, they're all hosted on a single IP. The type of "pay us and we'll point you to the download location" scheme applied here is a bit moronic, in fact the template nature of the E-shop does not know what healthy competition means as you can see in the screenshot above. Here are the domains themselves :<br /><div></div><br /><div><a href="http://bp2.blogger.com/_wICHhTiQmrA/R-L-kl2801I/AAAAAAAABe4/UGcZczpuCP8/s1600-h/cybersquatting2.jpg"><img id="BLOGGER_PHOTO_ID_5179982426020827986" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp2.blogger.com/_wICHhTiQmrA/R-L-kl2801I/AAAAAAAABe4/UGcZczpuCP8/s200/cybersquatting2.jpg" border="0" /></a>PandaSecurity -</div><div><strong>pandaantivirus2008.com</strong></div><div><strong>panda-antivirus-2008.com</strong></div><div><strong>pandasecurity2008.com</strong></div><div><strong>pandaantivirus-2008.com</strong></div><div><strong>panda-anti-virus.com</strong></div><div><strong>panda-2008.com</strong></div><div><strong>antivirus-panda-suite.com</strong></div><div><strong>panda-ib.com</strong></div><div><strong>panda-2008.com</strong></div><div><strong>panda-anti-virus.com</strong></div><div><strong>panda-antivirus-2007.com</strong></div><div><strong>panda-antivirus-2008.net</strong></div><div><strong>panda-bdl.com</strong></div><div><strong>panda-ib.com</strong></div><div><strong>panda-suite.com</strong></div><div><strong>pandaantivirus-2007.com</strong></div><div><strong>pandaantivirus-2008.com</strong></div><div><strong>pandaantivirus-ib.com</strong></div><div><strong>pandaantivirus2008.com</strong></div><div><strong>pandasecurity2008.com</strong></div><div><strong>pandashield.com</strong></div><div><strong>pandasuite2007.com</strong></div><div><strong>panda-bundle.com</strong></div><div><strong>pandabundle.com</strong></div><div><strong>pandasecuritysoftware.com</strong></div><div><strong>pandasecuritysoftware.net</strong></div><div> </div><div><br />McAfee -</div><div><strong>mcafeepack.com</strong></div><div><strong>download-mcafee.com</strong></div><div><strong>mcafeebundle.com</strong></div><div><strong>mcafee-antivirus-2007.com</strong></div><div><strong>mcafee-internetsecurity.com</strong></div><div><strong>mcafee-suite.com</strong></div><div><strong>mcafee-suite2007.com</strong></div><div><strong>mcafeeantivirus2007.com</strong></div><div><strong>mcafeesuite-2007.com</strong></div><div><strong>mcafeesuite2007.com</strong></div><div> </div><div><br />Adobe Acrobat -</div><div><strong>adobeacrobatreader-8.com</strong></div><div><strong>adobe-reader-it.com</strong></div><div><strong>acrobatdownload-ib.com</strong></div><div><strong>adobeacrobatpack.com</strong></div><div><strong>acrobat8download.com</strong></div><div> </div><div><br />Misc Cybersquatted software -</div><div><strong>virusscan2007.com</strong></div><div><strong>virusscan2k7.com</strong></div><div><strong>virusscan2k8.com</strong></div><div><strong>virusscanxp.com</strong></div><div><strong>xp-secure.com</strong></div><div><strong>netdetectiveservices.info</strong></div><div><strong>download-ad-aware.com</strong></div><div><strong>antispyware-2007.com</strong></div><div><strong>antivirus-2007.com</strong></div><div><strong>netspyprotector.com</strong></div><div><strong>adwarepro.com</strong></div><div><strong>antispyware007.com</strong></div><div><strong>anti-virus-free.net</strong></div><div><strong>antivirus2k7.com</strong></div><div><strong>antivirus2k8.com</strong></div><div><strong>avastantivirus-pro.com</strong></div><div><strong>avg-antivirus-ib.com</strong></div><div> </div><div><br />What is Interactive Brands Inc?</div><div> </div><div><br />"<em>Interactive Brands is a privately held corporation formed by a team of experienced professionals who strive to offer the “ultimate” interactive shopping experience to internet users around the world. In partnership with the best software publishers, Interactive Brands develops unique and high value offers for the benefit of all computer users. In the spirit of giving the best shopping experience possible, Interactive Brands offers their clients access to a customer support center available by toll free number, email and live chat that covers any inquiry including: downloading, installing, using and any other questions regarding our products.</em>"</div><div> </div><div><em><br />Interactive Brands Inc.</em></div><div><em>PO Box 178, St-Laurent, Quebec</em></div><div><em>H4L 4V5, Canada</em></div><div><em>Phone: : +1 (514) 733-2549</em></div><div><em>Fax: +1 514 733 2533</em></div><div> </div><div><br />The billing center is located at <strong>panda-ib.com</strong> which loads <strong>b-softwares.com</strong> and <strong>bundlesmembersarea.com</strong>. 90% of the domains are hosted on a single IP - <strong>63.243.188.82</strong>, however, the entire netblock is a scammy system by itself with several hundred more such cybersquatted domains. </div><div> </div><div><br />Don't be cheap, if you're to buy any kind of software, do so through the official site, and cut the fraudulent intermediaries like the ones in this case. Read more about Interactive Brands at the Ripoff Report : <a href="http://www.ripoffreport.com/reports/0/242/RipOff0242824.htm">Interactive Brands, Adaware-ib.com Rip-off</a>; <a href="http://www.ripoffreport.com/reports/0/309/RipOff0309942.htm">Report: Interactive Brands</a>; <a href="http://www.ripoffreport.com/reports/0/295/RipOff0295551.htm">Report: Interactive Brands</a>. <a href="http://www.lavasoft.com/company/blog/?m=200705">Lavasoft's</a> and <a href="http://www.virusbtn.com/news/2008/01_21.xml">Avira's</a> comments on the case as well.<br /></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=lpxaSbF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=lpxaSbF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zJXEOlF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zJXEOlF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=VuU2JNf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=VuU2JNf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BTLyPDf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BTLyPDf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=xjWqHAF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=xjWqHAF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=gXAVraF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=gXAVraF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BGOSYFf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BGOSYFf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/255232253" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 20 Mar 2008 17:03:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/interactive brands">interactive brands</category>
      <category domain="http://securityratty.com/tag/brands">brands</category>
      <category domain="http://securityratty.com/tag/interactive">interactive</category>
      <category domain="http://securityratty.com/tag/interactive brands offers">interactive brands offers</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/customer support center">customer support center</category>
      <category domain="http://securityratty.com/tag/ripoff report">ripoff report</category>
      <category domain="http://securityratty.com/tag/offers">offers</category>
      <category domain="http://securityratty.com/tag/adobe acrobat">adobe acrobat</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/255232253/cybersquatting-security-vendors-for.html">Cybersquatting Security Vendors for Fraudulent Purposes</source>
    </item>
    <item>
      <title><![CDATA[More CNET Sites Under IFRAME Attack]]></title>
      <link>http://securityratty.com/article/61e2c6b0ce33b5f59ce105fe2092ba00</link>
      <guid>http://securityratty.com/article/61e2c6b0ce33b5f59ce105fe2092ba00</guid>
      <description><![CDATA[News is spreading fast, appropriate credit is given , but not as fast as the IFRAME campaign targeting several more CNET Networks' web properties besides ZDNet Asia , namely, TV.com , News.com and...]]></description>
      <content:encoded><![CDATA[<a href="http://bp3.blogger.com/_wICHhTiQmrA/R8_5QMHWvLI/AAAAAAAABbg/CQIhd-i9vrA/s1600-h/TV_com_IFRAME.jpg"><img id="BLOGGER_PHOTO_ID_5174628553397288114" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/R8_5QMHWvLI/AAAAAAAABbg/CQIhd-i9vrA/s200/TV_com_IFRAME.jpg" border="0" /></a>News is <a href="http://www.theregister.co.uk/2008/03/06/googe_iframe_piggybacking/">spreading</a> fast, <a href="http://www.f-secure.com/weblog/archives/00001396.html">appropriate credit</a> is <a href="http://www.itwire.com/content/view/16981/53/">given</a>, but <a href="http://www.idg.se/2.1085/1.148922">not as</a> fast <a href="http://securite.reseaux-telecoms.net/actualites/lire-attaque-par-moteur-de-recherche-interpose-17788.html">as the</a> IFRAME <a href="http://www.securityfocus.com/brief/695">campaign targeting</a> several more <a href="http://www.cnetnetworks.com/company/brands.html">CNET Networks' web properties</a> besides <strong>ZDNet Asia</strong>, namely, <strong>TV.com</strong>, <strong>News.com</strong> and <strong>MySimon.com</strong> which I'll assess in this post. In the time of posting this, no other CNET sites are involved in the campaign, including ZDNet's international sites such as, ZDNet India, ZDNet U.K, and ZDNet Australia, but the abovementioned ones. And so, we have three more sites part of CNET Networks' portfolio, getting injected with more IFRAMEs, <a href="http://ddanchev.blogspot.com/2008/03/zdnet-asia-and-torrentreactor-iframe-ed.html">abusing their search engine's local caching, and storing of any keyword feature</a>, in a combination with a loadable IFRAME.<br /><br />What has changed for the past 24 hours, despite that the now over <strong>51,900 pages at zdnetasia.com</strong> continue to be indexed by search engines? The folks at ZDNet Asia have taken care of the IFRAME issue, so that such injection is no longer possible. However, the same IPs used in this IFRAME campaign, including two new domains introduced have been injected, and are loading at <strong>TV.com, News.com and MySimon.com</strong>, again <a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">pushing the rogue XP AntiVirus</a>, the rogue Spyshredderscanner, as well as another fake codec <strong>MediaTubeCodec.exe</strong>, hosted and distributed under two new domains.<br /><br /><a href="http://bp0.blogger.com/_wICHhTiQmrA/R9ANnMHWvMI/AAAAAAAABbo/MvOYgEYbUQ8/s1600-h/news_com_IFRAME.jpg"><img id="BLOGGER_PHOTO_ID_5174650938766834882" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/R9ANnMHWvMI/AAAAAAAABbo/MvOYgEYbUQ8/s200/news_com_IFRAME.jpg" border="0" /></a><strong>Which sites are currently targeted?</strong><br />ZDNet Asia - currently has 51,900 injected pages<br />TV.com - 49,600 locally hosted IFRAME injected pages<br />News.com - 167 locally hosted pages, injection is ongoing<br />MySimon.com - currently 4 pages, the campaign is ongoing<br /><br /><strong>Which domains and IPs are behind the IFRAMEs?</strong><br />do-t-h-e.com (69.50.167.166)<br />rx-pharmacy.cn (82.103.140.65)<br />m5b.info (124.217.253.6)<br />89.149.243.201<br />89.149.243.202<br />72.232.39.252<br />195.225.178.21<br /><br /><strong>Where's the malware?</strong><br />It's there, you just have to triple check different IFRAME-ed search results and finally you'll get to install XP AntiVirus 2008 and a fake codec, the only two pieces of malware currently served. What's important to note is that this is the current state of the campaign, and with the huge number of IFRAME-ed pages in such a way, targeted attacks on a per keyword basis are possible, and since they ensure you're served on the basis of where you're coming from, things can change pretty fast. These are all of the domains that follow after the IFRAME redirects for all the campaigns currently detected, and the detection rates for the malware from the last campaign :<br /><br />hotpornotube08.com (206.51.229.67)<br />hot-pornotube-2008.com (206.51.229.67)<br />hot-pornotube08.com (206.51.229.67)<br />adult-tubecodec2008.com (195.93.218.43)<br />adulttubecodec2008.com (195.93.218.43)<br />hot-tubecodec20.com (195.93.218.43)<br />media-tubecodec2008.com (195.93.218.43)<br />porn-tubecodec20.com (195.93.218.43)<br />scanner.spyshredderscanner.com (77.91.229.106)<br />xpantivirus2008.com (69.50.173.10)<br />xpantivirus.com (72.36.198.2)<br />bestsexworld.info (72.232.224.154)<br />requestedlinks.com (216.255.185.82)<br /><br />MediaTubeCodec.com<br /><strong>Scanner results</strong> : 11% Scanner(4/36) found malware!<br /><strong>Time</strong> : 2008/03/06 16:38:39 (EET)<br /><strong>File Size</strong> : 85520 byte<br /><strong>MD5</strong> : 25708e1168e0e5dae87851ec24c6e9f7<br /><strong>SHA1</strong> : 33b502b13cab7a34bb959d363ae4b7afd23919a6<br />AVG - I-Worm/Nuwar.P<br />Fortinet - Suspicious<br />Prevx - TROJAN.DOWNLOADER.GEN<br />Quick Heal - Suspicious - DNAScan<br /><br />Tries to connect to <strong>websoftcodecdriver.com</strong>; <strong>websoftcodecdriver2.com</strong> and <strong>77.91.227.179</strong>, in between listening on local port 1034. The downloader tries to drop <strong>Adware.Agent.BN</strong> - "<em>Adware.Agent.BN is an adware program that displays pop-up advertisements and adds a runkey to run at startup, and also modifies Windows system configuration in order to download more malwares on to infected computer.</em>" and <strong>RogueAntiSpyware.AntiVirusPro</strong> - "<em>RogueAntiSpyware.AntiVirusPro is a Rogue Anti-Spyware product which comes bundled along with a malicious downloader. It is downloaded and installed without the users consent.</em>"<br /><br />Spyshredderscanner.exe<br /><strong>Scanner results</strong> : 42% Scanner(15/36) found malware!<br /><strong>Time</strong> : 2008/03/06 17:02:23 (EET)<br /><strong>File Size</strong> : 33224 byte<br /><strong>MD5</strong> : bc232dbd6b75cc020af1fcf7cee5f018<br /><strong>SHA1</strong> : fc2f70fd9ce76fe2e1fe157c6d2d8ba015ad099f<br /><strong>Detected as</strong> : Win32.FraudTool.SpyShredder; Downloader.MisleadApp<br /><br />Again opening local port 1034 and tries to connect to <strong>69.50.168.51</strong>, ATRIVO = RBN's well known netblock.<br /><br /><strong>Who's behind it?</strong><br />It's all a matter of perspective, if you look at the IPs used in the IFRAMEs, these are the front-end to rogue anti virus and anti spyware tools that were using RBN's infrastructure before it went dark, and continue using some of the new netblocks acquired by the RBN. However as <a href="http://ddanchev.blogspot.com/2007/11/new-media-malware-gang.html">I've once</a> pointed out <a href="http://ddanchev.blogspot.com/2007/12/new-media-malware-gang-part-two.html">in respect</a> to the <a href="http://ddanchev.blogspot.com/2008/02/new-media-malware-gang-part-three.html">New Media Malware Gang</a> and its connection with the RBN and Storm Worm, for the time being it's unclear which one of these is the operational department if any, of the RBN is vertically integrating to provide more than the hosting infrastructure, and diversify to malware, or spyware installation on a revenue-sharing basis participating in an affiliate program.<br /><br />This malicious campaign will continue to be monitored, particularly the RBN connection, and whether or not they will start targeting CNET's other sites.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=KG97XiF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=KG97XiF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=VAUfO3F"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=VAUfO3F" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=pNjCArf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=pNjCArf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1s55Bnf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1s55Bnf" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Hi3WNPF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Hi3WNPF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=3at6HBF"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=3at6HBF" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=u4b2kkf"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=u4b2kkf" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/246820135" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 06 Mar 2008 07:50:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iframe">iframe</category>
      <category domain="http://securityratty.com/tag/cnet sites">cnet sites</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/iframe-ed pages">iframe-ed pages</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <category domain="http://securityratty.com/tag/cnet">cnet</category>
      <category domain="http://securityratty.com/tag/iframe redirects">iframe redirects</category>
      <category domain="http://securityratty.com/tag/iframe campaign">iframe campaign</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/246820135/more-cnet-sites-under-iframe-attack.html">More CNET Sites Under IFRAME Attack</source>
    </item>
    <item>
      <title><![CDATA[Grisoft changes name to AVG Technologies ]]></title>
      <link>http://securityratty.com/article/5a3811a8868692ed4d907a1f0eccaf60</link>
      <guid>http://securityratty.com/article/5a3811a8868692ed4d907a1f0eccaf60</guid>
      <description><![CDATA[Grisoft changes name to AVG...]]></description>
      <content:encoded><![CDATA[Grisoft changes name to AVG Technologies]]></content:encoded>
      <pubDate>Wed, 06 Feb 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/avg technologies">avg technologies</category>
      <category domain="http://securityratty.com/tag/grisoft">grisoft</category>
      <source url="http://www.networkworld.com/news/2008/020708-grisoft-avg-technologies.html?fsrc=rss-security">Grisoft changes name to AVG Technologies </source>
    </item>
    <item>
      <title><![CDATA[Storm keeps coming (4th variant)]]></title>
      <link>http://securityratty.com/article/57da5e3aa95b0d83d00fe820a926a246</link>
      <guid>http://securityratty.com/article/57da5e3aa95b0d83d00fe820a926a246</guid>
      <description><![CDATA[They just keep coming...this one is very similar to the 3rd variant we reviewed, but some changes are apparent
1) Hash: 1f362ad74d62262bff6bcb1d078cbf7d
2) Aside from yet again changing the domain and...]]></description>
      <content:encoded><![CDATA[They just keep coming...this one is very similar to the 3rd variant we reviewed, but some changes are apparent.<br />1) Hash: 1f362ad74d62262bff6bcb1d078cbf7d<br />2) Aside from yet again changing the domain and binary, the hidden files written upon execution are as follows:<br /><span style="font-style:italic;"><br />Helios Rootkit Detector<br />Scanning File System For Hidden Files<br /><br />[*] Scanning Drive C<br />1 C:\WINDOWS\system32\bldy.config Hidden From API<br />2 C:\WINDOWS\system32\bldy3a80-61.sys Hidden From API<br />Execute Duration (in seconds)=18<br /><br />Loaded Drivers:<br />Driver File Company Name Description <br />C:\WINDOWS\System32\bldy3a80-61.sys<br /><br />Kernel31 Api Log<br />***** Installing Hooks *****<br />4012d8     CreateFileA(C:\WINDOWS\System32\bldy.config) <br />40117f     CreateFileA(C:\WINDOWS\System32\bldy3a80-61.sys) <br /><br />DirwatchData<br />WatchDir Initilized OK <br />Watching C:\WINDOWS <br />Created: C:\WINDOWS\system32\bldy.config <br />Modifed: C:\WINDOWS\system32\bldy.config <br />Modifed: C:\WINDOWS\system32 <br />Created: C:\WINDOWS\system32\bldy3a80-61.sys <br />Modifed: C:\WINDOWS\system32\bldy3a80-61.sys<br /></span><br />Better AV coverage again:<br /><span style="font-style:italic;"><br />AntiVir - TR/Crypt.XDR.Gen<br />Authentium - W32/Dropper.gen6<br />Avast - Win32:Zhelatin-ASX<br />AVG - Dropper.Generic.TLX<br />BitDefender - Trojan.Peed.IRG<br />ClamAV - Trojan.Peed-66<br />DrWeb - Trojan.Spambot.2386<br />Fortinet - W32/Tibs.G@mm<br />F-Prot - W32/Dropper.gen6<br />F-Secure - Email-Worm.Win32.Zhelatin.pr<br />Kaspersky - Email-Worm.Win32.Zhelatin.pr<br />NOD32v2 - Win32/Nuwar.BA<br />Panda - Suspicious file<br />Prevx1 - Stormy:Worm-All Variants<br />Sophos - Mal/Dorf-H<br />Symantec - Trojan.Peacomm<br />VirusBuster - Trojan.DR.Zhelatin.AS<br />Webwasher-Gateway - Trojan.Crypt.XDR.Gen<br /></span><br />Aside from the inherent value of keeping an eye on the <a href="http://isc.sans.org/">ISC Diary</a>, please refer to the US-CERT <a href="http://www.us-cert.gov/current/index.html#storm_worm_activity_increases_during">alert</a>.<br />They'll keep coming, we'll keep watching.<br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2007/12/storm-keeps-coming-4th-variant.html&title=Storm%20keeps%20coming%204th%20variant" title="Storm keep coming (4th variant) del.icio.us"><img src="http://holisticinfosec.org/images/delicious.png" class="socialbkmark" border=0 alt="Storm keep coming (4th variant) at del.icio.us"></a><a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2007/12/storm-keeps-coming-4th-variant.html" title="Storm keep coming (4th variant) "> <img src="http://digg.com/img/badges/16x16-digg-guy.gif" border=0 class="socialbkmark" alt="Digg Storm keep coming (4th variant) "></a>]]></content:encoded>
      <pubDate>Thu, 27 Dec 2007 07:43:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/trojan">trojan</category>
      <category domain="http://securityratty.com/tag/sys">sys</category>
      <category domain="http://securityratty.com/tag/kernel31 api log">kernel31 api log</category>
      <category domain="http://securityratty.com/tag/api">api</category>
      <category domain="http://securityratty.com/tag/zhelatin-asx">zhelatin-asx</category>
      <category domain="http://securityratty.com/tag/zhelatin">zhelatin</category>
      <category domain="http://securityratty.com/tag/config">config</category>
      <category domain="http://securityratty.com/tag/helios rootkit detector">helios rootkit detector</category>
      <category domain="http://securityratty.com/tag/driver file company">driver file company</category>
      <source url="http://holisticinfosec.blogspot.com/2007/12/storm-keeps-coming-4th-variant.html">Storm keeps coming (4th variant)</source>
    </item>
    <item>
      <title><![CDATA[Holiday Storm Part 3]]></title>
      <link>http://securityratty.com/article/e6a27c1d60751f69f7d261f1397817fd</link>
      <guid>http://securityratty.com/article/e6a27c1d60751f69f7d261f1397817fd</guid>
      <description><![CDATA[I know, I know...enough already. But our Storm friends have changed the game a bit for the third round, as discussed on the ISC Diary , in particular Update 3. The changed domain and binary name led...]]></description>
      <content:encoded><![CDATA[I know, I know...enough already. But our Storm friends have changed the game a bit for the third round, as discussed on the <a href="http://isc.sans.org/diary.html?storyid=3784">ISC Diary</a>, in particular Update 3. The changed domain and binary name led me to ponder what else has changed. So...<br />1) New hash: BE22F894AC662C905C37CEFDE66DE065<br />2) Better hiding skills, no visible running processes, nastiness all hidden from the API (can you say rootkit?). No more hanging out in the open, easily seen.<br />The <a href="http://helios.miel-labs.com/">Helios Rootkit Detector</a>, now included in <a href="http://code.google.com/p/rapier/">RAPIER</a>, discovered darker voodoo than the last two versions:<br /><span style="font-style:italic;"><br />Scanning File System For Hidden Files<br />[*] Scanning Drive C<br />1 C:\WINDOWS\system32\cleanmgr.exe Hidden From API<br />2 C:\WINDOWS\system32\clean.config Hidden From API<br />3 C:\WINDOWS\system32\clean6c9-3320.sys Hidden From API<br />4 C:\WINDOWS\system32\dllcache\cleanmgr.exe Hidden From API<br /></span><br />SysAnalyzer says:<br /><span style="font-style:italic;"><br />Loaded Drivers:<br />Driver File Company Name Description <br />C:\WINDOWS\System32\clean6c9-3320.sys<br /><br />Kernel31 Api Log<br />***** Installing Hooks *****<br />4012c1     CreateFileA(C:\WINDOWS\System32\clean.config) <br />40117f     CreateFileA(C:\WINDOWS\System32\clean6c9-3320.sys)<br /><br />DirwatchData<br />WatchDir Initilized OK <br />Watching C:\WINDOWS <br />Created: C:\WINDOWS\system32\clean.config <br />Modifed: C:\WINDOWS\system32\clean.config <br />Modifed: C:\WINDOWS\system32\config\system.LOG <br />Modifed: C:\WINDOWS\system32 <br />Created: C:\WINDOWS\system32\clean6c9-3320.sys <br />Modifed: C:\WINDOWS\system32\clean6c9-3320.sys<br /></span><br />3) AV coverage is further improved for this version:<br /><span style="font-style:italic;"><br />AntiVir 7.6.0.46 - TR/Rootkit.Gen<br />Authentium - W32/StormWorm.R<br />Avast - Win32:Zhelatin-ASX<br />AVG - Dropper.Generic.TLF<br />BitDefender - DeepScan:Generic.Malware.FMH@mmign.55A134E9<br />ClamAV - Trojan.Zhelatin<br />DrWeb - Trojan.Spambot.2387<br />Fortinet - W32/Tibs.G@mm<br />F-Prot - W32/StormWorm.R<br />F-Secure - Email-Worm.Win32.Zhelatin.pl<br />Ikarus - Virus.Win32.Zhelatin.ASX<br />Kaspersky - Email-Worm.Win32.Zhelatin.pl<br />Microsoft - Backdoor:WinNT/Nuwar.B!sys<br />NOD32v2 - Win32/Fuclip.AW<br />Panda - Suspicious file<br />Prevx1 - Stormy:Worm-All Variants<br />Sophos - Mal/Dorf-H<br />Webwasher-Gateway - Trojan.Rootkit.Gen<br /></span><br />How perfectly unpleasant, making things more difficult to spot. Here's my New Years wish for the Storm lamers. Bugger off (kept pleasant for the kids).<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2007/12/holiday-storm-part-3.html&title=Holiday%20Storm%20Part%203" title="Holiday Storm Part 3 del.icio.us"><img src="http://holisticinfosec.org/images/delicious.png" class="socialbkmark" border=0 alt="Holiday Storm Part 3 at del.icio.us"></a><a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2007/12/holiday-storm-part-3.html" title="Holiday Storm Part 3 "> <img src="http://digg.com/img/badges/16x16-digg-guy.gif" border=0 class="socialbkmark" alt="Digg Holiday Storm Part 3 "></a>]]></content:encoded>
      <pubDate>Wed, 26 Dec 2007 20:43:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/kernel31 api log">kernel31 api log</category>
      <category domain="http://securityratty.com/tag/log">log</category>
      <category domain="http://securityratty.com/tag/api">api</category>
      <category domain="http://securityratty.com/tag/zhelatin-asx">zhelatin-asx</category>
      <category domain="http://securityratty.com/tag/sys">sys</category>
      <category domain="http://securityratty.com/tag/asx">asx</category>
      <category domain="http://securityratty.com/tag/rootkit">rootkit</category>
      <category domain="http://securityratty.com/tag/helios rootkit detector">helios rootkit detector</category>
      <category domain="http://securityratty.com/tag/zhelatin">zhelatin</category>
      <source url="http://holisticinfosec.blogspot.com/2007/12/holiday-storm-part-3.html">Holiday Storm Part 3</source>
    </item>
  </channel>
</rss>
