AVG Blogs | Virus Lab

Swine Flu Madness

Media make a lot of noise about swine flu and vaccination against it. Today I got this spam (click to enlarge):

 

It looks like US Government Vaccination program, right? So let's go and register. But only what we can do is to clink on "H1N1 Vaccination Profile" to download 130Kb archive.

As I suppose it's not an archive but a trojan horse which copies itself into system32 directory, register under userinit registry key and inject code into winlogon process.

AVG catched this piece of malware.

Pavel Krcma

 

Share | |

 

Wondering how many users know about this already?

Recent scams evolution

A lot of scams were spammed last days, more than usual, and due to this fact we can easily monitor and show you the evolution of such threat.

The scams we receive everyday looks like this one:

But a week or so ago we've seen a scams attemping to fool our corporate sphere:

It took about 3 days when spammers changed their tactic and try to fool us with MS like scams:

And yesterday all got back to "normal" ebay, paypal, dhl, fedex, ups etc. etc. scams:

In conclusion we have to say that none of SW Vendors, System Administrators or Logistic Servicies uses a messages like these to contact their customers. These scams are cleverly devised to fool recipient so please be aware of this threat and avoid any interaction with links or attachments in scam messages. And of course keep your antivirus system updated.

Hynek Blinka

 

Share | |

 

Win32/Induc Removal Instructions for Delphi Developers

step 1
Find Delphi root folder
(usually C:\Program Files\Borland\Delphi7)

step 2
If exists %DELPHI%\Lib\SysConst.bak file rename it as SysConst.dcu and continue with step 5
If file %DELPHI%\Lib\SysConst.bak doesn't exists countinue with step 3

step 3
Find and copy file SysConst.pas from %DELPHI%\Source\Rtl\Sys folder to %DELPHI%\Lib folder

step 4
Compile SysConst.pas file to DCU using command line:
%DELPHI%\Bin\Dcc32.exe %DELPHI%\Lib\SysConst.pas
For example:
"C:\Program Files\Borland\Delphi7\Bin\Dcc32.exe" "C:\Program Files\Borland\Delphi7\Lib\SysConst.pas"

step 5
If exists %DELPHI%\Lib\SysConst.bak file remove it.
For "%DELPHI%\Lib" folder its subfolders and files set "Read only" permission for "Everyone" group.
This will protect Delphi installation against Win32/Induc infection.

step 6
Try to rename %DELPHI%\Lib\SysConst.dcu file as %DELPHI%\Lib\SysConst.pas.
If this fail your permissions are set correctly.

(Thanx to Lada Zezula)

 

Share | |

 

Win32/Induc

In last few days we've received a lot of questions about Win32/Induc infection.

This post here tryes to answer most of them.

Win32/Induc infects delphi files during compilation process.

When the file infected by Win32/Induc virus is executed malicious code searches for Delphi installation. If it finds Delphi on victim computer it writes its code into SysConst.pas which it then compiles as SysConst.dcu and saves it in Lib subfolder.
Result is, that every delphi application compiled on such infected system contains also malicious code from infected library.

Part of infection code:

How to heal detected file? If you use infected delphi application contact your software vendor, inform them about infection and ask for clean files. They (Delphi developers) have to restore SysConst.dcu (from SysConst.bak saved by virus or from back-up) and recompile their software.

Hynek Blinka

 

Share | |

 

Explosive SPAM

Today I got an unusual spam:

 

I believed for the first few seconds that it was a valid message so i checked what was at the link. My instinct told me to download it in a safe environment, which turned out to be a good idea. I saw this page:

I see a lot of scaremongering messages in my job, but this is special
because it speaks about the city where i live - Brno. This site check the IP address and change the message according to your location. Rest of the page is the usual stuff - the message says you need the latest Flash player and when you click on the picture or download link, you get a nasty trojan horse. On every refresh, you get a different link and trojan horse.

Of course it's not a real Reuters message. AVG protect from all trojans i saw on this page.

Pavel Krcma

 

Share | |

 

Win32/Virut

In the wild spreads a new variant of polymorphic file-infector Win32/Virut. Comparing to previous variants it contains a lot of improvements especially in polymorphic engine. I think that current wave of infection consists of few slightly different variants as author tests new code.

Virut infects very fast all executable files on computer and shared volumes. For infection use EPO technic so it's pretty hard to disinfect it. On very start injects own code into winlogon process so it seems as winlogon try to connect servers on internet. It serves as IRC backdoor which allow download and execute any file so author can put a new malware on computer. Virut contacts IRC server on irc.zief.pl and to allow outbound connection add a new exception to windows firewall for winlogon process. Also modify hosts file and search for HTML files on disc to add IFRAME pointing to zief.pl/rc where is a script downloading a malware.

Pavel Krcma

 

Share | |

 

Downadup/Conficker worm

We saw a large amount of infections from the Downadup worm last month. This worm is also known as Conficker or Kido and is able to spread very quickly because it uses 3 effective ways to propogate:

• Exploits a Windows vulnerability MS08-067. The patch was released a long time ago but there are still a lot of unpatched computers.
• Exploiting network shares with weak or no passwords. The worm contains a list of common passwords - a good reason to use strong passwords.
• Copies itself to removable media, usually USB sticks. Using the AutoRun function (creates autorun.inf file)

The first versions of Downadup were seen at the start of December 08 and until now we have observed more than 300 different variants. All known variants are detected and healed by AVG. Besides spreading, the worm can also download other malware and can redirect legitimate URLs access to various other malicious webpages.

We strongly recommend that you install all of the latest security patches for your version of Windows. Microsoft have also released a special KB article here.

Download the latest AVG update for maximum protection.

 

Share | |