tag:blogger.com,1999:blog-30288039087428662452011-12-08T13:23:59.812-08:00All about malware/virus research and related articles.Anand Ahttp://www.blogger.com/profile/01803961522571506034noreply@blogger.comBlogger21100tag:blogger.com,1999:blog-3028803908742866245.post-31551097412673323242008-02-14T06:50:00.000-08:002008-02-14T07:12:41.864-08:00Today, I got a zip file as an attachment (named as "<span style="font-weight: bold;">image014.zip</span> with saying "<span style="font-weight: bold;">have you seen the newest iphone? its so amazing check it out</span>") through MSN Messenger from one of my friend's email-ID. There it looks suspicious (later confirmed that he didn't send) to me and further downloaded the file for analysis. After extraction, there was a file named "<span style="font-weight: bold; font-style: italic;">image016.JPG-www.facebook.com</span>".<br /><br />Its actually a new variant of MSN worm which is in the wild (more similar to this <a href="http://isc.sans.org/diary.html?storyid=3961">one</a>) where as 3 AV's detected as per the <a href="http://www.virustotal.com/analisis/44a99df89c0579ccb614397e51ef752c"><span style="font-weight: bold;">virustotal</span></a> result. The detected worm's name looks like that AV's have created a generic (based on the behaviour) signature for it.<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/3028803908742866245-3155109741267332324?l=anandavgeek.blogspot.com' alt='' /></div>Anand Ahttp://www.blogger.com/profile/01803961522571506034noreply@blogger.com0tag:blogger.com,1999:blog-3028803908742866245.post-21930610139974843802008-02-11T23:19:00.001-08:002008-02-12T04:22:04.703-08:00<span style="font-weight: bold; color: rgb(255, 0, 0);">Update:</span><span style="color: rgb(255, 0, 0);"> After reporting this issue to their Technical support, now they have changed the infected binary file (removed exactly the Extradat section from the whouses.exe file) and below is the result shown by </span><a style="color: rgb(255, 0, 0);" href="http://www.virustotal.com/analisis/485ef7cc9341a54a839cec749ff4a44d">virustotal</a><span style="color: rgb(255, 0, 0);">.</span><br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_5jrZvTFkPvE/R7GJ_mD9ipI/AAAAAAAAAAk/KjiRf6Yvl-E/s1600-h/NetProtector2008_Virut_latest.JPG"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer;" src="http://3.bp.blogspot.com/_5jrZvTFkPvE/R7GJ_mD9ipI/AAAAAAAAAAk/KjiRf6Yvl-E/s400/NetProtector2008_Virut_latest.JPG" alt="" id="BLOGGER_PHOTO_ID_5166061973212596882" border="0" /></a><br />When I download <a href="http://www.indiaantivirus.com/downloadtrialversion.html">NetProtector 2008</a> trial version from Pune(INDIA) based <a href="http://www.indiaantivirus.com/">Antivirus</a> company's website, one of the file looks malicious to me. Then I picked that file "<span style="font-weight: bold;">whouses.exe</span>" and after analyzing I found that its infected by one of the VIRUT variant but not active, as its code is in the last section of the file (extradat section with no reference to it).<br /><br />Later, I uploaded to <a href="http://www.virustotal.com/analisis/d15bf08e6404686e111ec939ccc05963">VirusTotal</a> for further results from other antivirus products and result was scary.<br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_5jrZvTFkPvE/R7FUUWD9ioI/AAAAAAAAAAc/s4TfKss_htc/s1600-h/NetProtector2008_Virut.JPG"><img style="margin: 0px auto 10px; display: block; text-align: center; cursor: pointer;" src="http://2.bp.blogspot.com/_5jrZvTFkPvE/R7FUUWD9ioI/AAAAAAAAAAc/s4TfKss_htc/s400/NetProtector2008_Virut.JPG" alt="" id="BLOGGER_PHOTO_ID_5166002956066982530" border="0" /></a><br />Flagging virus onto one of the file of an antivirus product itself is scary and shows the carelessness from the security firm which is supposed to protect their users from the malicious programs.<br /><br />It shows that one of their development machine could have been infected by virus and finally the result is Antivirus product itself infected!!!<div class="blogger-post-footer"><img width='1' height='1' src='https://blogger.googleusercontent.com/tracker/3028803908742866245-2193061013997484380?l=anandavgeek.blogspot.com' alt='' /></div>Anand Ahttp://www.blogger.com/profile/01803961522571506034noreply@blogger.com1