New rogue: IE-Security

IE-Security is new rogue software that belongs to IEDefender family. The IE-Security installer, ie.exe, is hosted at 216.240.151.112 and http://ie-security.com (216.240.151.135). The user-interface of IE-Security is a rip-off of Microsoft Windows Defender.

VirusTotal scan result of IE-Security installer can be found here. By the way, people at IE-Security provide 27x7 support ;)

Files dropped by IE-Security installer:

%PROGRAMFILES%\IE-Security\ies.s1

%PROGRAMFILES%\IE-Security\ies.s2

%PROGRAMFILES%\IE-Security\ies.s3

%PROGRAMFILES%\IE-Security\ies.s4

%PROGRAMFILES%\IE-Security\iescan.exe

%PROGRAMFILES%\IE-Security\uninstall.exe

%USERPROFILE%\Desktop\IE-Security.lnk

%USERPROFILE%\Start Menu\Programs\IE-Security.lnk

where,

%PROGRAMFILES% is \Program Files\ directory in root-drive,

%USERPROFILE% is \Documents and Settings\UserName\ directory in root-drive.

Registry keys created by IE-Security installer:

HKEY_CURRENT_USER\Software\IE-Security

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "IE-Security"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE-Security

AntiSpyware 2009 and AntiSpywareBOT: Neighbours in crime!

Well, 590-B Schillinger Rd. South, Mobile, Al, 36695 seems to be the John Doe of addresses. Recently ParetoLogic blog posted about the address of the makers of rogueware AntiSpyware 2009. It seems that the headquarters of 2Squared, makers of rogueware AntiSpywareBOT, is also located in the same street. Even these guys have got a high-tech, high-profile CGI office ;)

Fake Obama websites spreading malware

Similar to eCard spam mails, we are now seeing US president-elect Barack Obama themed mails which contain links to fake websites. These sites host a malicious executable and this malware belongs to the same old Storm/Waledac family. One such mail and a fake website (http://donate.superobamadirect.com) are shown in following screenshots:

These fake sites are hosted using fast flux DNS technique - a typical method used by Storm botnet. It can be seen from the following screenshot that the IP address keeps changing frequently:

VirusTotal scan result of the malware can be found here. An automated analysis by ThreatExpert can be found here.

Fake eCard updates

Fake eCard spam mails continue to circulate even after the new-year excitement is settled down. As usual, these mails contain links to downloadable fake greeting cards that are generally named "card.exe" or "postcard.exe".


When executed, these malicious executables turn your PC into a zombie machine that becomes a part of Storm/Waledac botnet (more information can be found here and here).


Newer variants of fake eCard executables (hosted at http://topgreetingsite.com - do NOT visit that site! ) are not detected by many AVs as of now (as seen in VirusTotal scan here). An automated analysis of this file is available at ThreatExpert here.

SysProt AntiRootkit v1.0.0.8 released

A few key improvements were made in driver detection and disabling mechanisms, and hence here's the latest version of SysProt AntiRootkit :) The SysProt AntiRootkit v1.0.0.8 successfully detects and removes Zlob rootkits (TDSServ or Alureon family).

Similar to the steps followed in the case of GMER (as mentioned in the previous post), SysProt AntiRootkit requires two reboots to completely remove rootkit driver and its Registry entry. Following screenshots show SysProt AntiRootkit detecting Zlob rootkit driver and injected DLL:

Steps to remove Zlob rootkit driver:

• Run SysProt AntiRootkit v1.0.0.8 and click "Kernel Modules" tab.
  
• SysProt AntiRootkit shows rootkit/hidden drivers in red color. Click on the rootkit driver's entry and the click "Disable"
  
• Reboot the PC
  
• Repeat steps 1 to 3 (SysProt AntiRootkit will detect the same rootkit driver again)
  

Now, all the malicious files dropped by Zlob should be unrooted and hence "visible" to standard anti-malware scanners.

More information, changelog and download link for SysProt AntiRootkit v1.0.0.8 can be found at following locations:
MajorGeeks
Softpedia
SysProt AntiRootkit primary download page

Feedbacks are welcome :)