Do you trust Google searches? I know I do. Altho I also know what to look for when doing searches for anything.
Last Friday afternoon late, Jr. wanted some Power Ranger coloring pages. Nothing odd, done it about a 100 times in the last few years give or take and printed about 1 million pages for him to color, feels that way at least.
Search I used and results:
http://www.google.com/search?q=power+ra ... f8&oe=utf8
But I noticed right off the bat that most all of the results were from .cn domains, China....
huge red flag for me.
As I was on my primary box, I immediately moved over to test box\Sandboxie and began to click.
First link,
POW! Prompt for a coded install, site here:
qzrtxrwiuemm.cn/819.html
I then went thru a couple of page results and had two other sites pushed Spy Shredder on me:
vhzxps.in/hr
hxxp://knygxl.in/an
I stopped after a bit, as most seemed to deliver me to a search engine:
hxxp://www.lookuplive.com/
And that page required two clicks of the back button to get back to results page.
Mind you this wasn't any sort of 'misspelled search' either. I typed what I wanted to see.
As the infection showed up in HJT:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888;https=127.0.0.1:8888;
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: MSVPS System - {A4D00A75-F69A-49FD-9058-AB925712CCFF} - C:\WINDOWS\popnetkqw.dll
O3 - Toolbar: The jokwmp - {AB9235F6-DB9F-4FDC-AAFB-A3BAF1849E34} - C:\WINDOWS\jokwmp.dll
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O21 - SSODL: E404Helper - {a305ecda-5cd1-4e09-9232-cda4e954a297} - e404d.dll (file missing)
O21 - SSODL: rmvgor - {1E0A7717-1CB7-45F2-8216-4E972BBC31F4} - C:\WINDOWS\rmvgor.dll
O21 - SSODL: sapnet - {51C0F601-D985-4174-9BE6-2D99188D6CBE} - C:\WINDOWS\sapnet.dll
Files collected and scanned:
Code:
File ttvbongfl.exe received on 11.25.2007 18:51:16 (CET)
Additional information
File size: 143360 bytes
MD5: f8c54b5916b704b0d6c9bb36b5d62cfc
SHA1: 75b33842e81c2e4ac147d28d45f5536b5ad4179e
Result: 5/32 (15.63%)
AVG 7.5.0.503 2007.11.25 Downloader.Zlob.NE
CAT-QuickHeal 9.00 2007.11.24 TrojanDownloader.Zlob.ejq
Ikarus T3.1.1.12 2007.11.25 Trojan-Downloader.Win32.Zlob.egn
Kaspersky 7.0.0.125 2007.11.25 Trojan-Downloader.Win32.Zlob.ena
Microsoft 1.3007 2007.11.25 TrojanDownloader:Win32/Zlob.gen!W
==============================
File gormet.dll received on 11.25.2007 18:55:50 (CET)
Additional information
File size: 348160 bytes
MD5: 04d4a3d6467a8241cd2d7c7ee1fac7f2
SHA1: 1b5d4ea3b735c331211f98711a0033f34bb800e8
Result: 5/32 (15.63%)
AntiVir 7.6.0.34 2007.11.23 TR/Zlob.Dll
Avast 4.7.1074.0 2007.11.23 Win32:Agent-LTS
AVG 7.5.0.503 2007.11.25 Downloader.Zlob.OC
Ikarus T3.1.1.12 2007.11.25 Virus.Win32.Agent.LTS
Webwasher-Gateway 6.0.1 2007.11.25 Trojan.Zlob.Dll
=========================
File packer.exe received on 11.25.2007 19:01:07 (CET)
File size: 127488 bytes
MD5: 654bddd78f9c5d3b570b551e5f3caf5d
SHA1: 73aa37e4e4097ab7d67d97d90c3c889ae2d30e6b
packers: UPX
packers: embedded, UPX
packers: PE_Patch.UPX, UPX
Result: 4/32 (12.5%)
AntiVir 7.6.0.34 2007.11.23 TR/Delphi.Downloader.Gen
CAT-QuickHeal 9.00 2007.11.24 (Suspicious) - DNAScan
DrWeb 4.44.0.09170 2007.11.25 Trojan.AVKill.origin
Webwasher-Gateway 6.0.1 2007.11.25 Trojan.Delphi.Downloader.Gen
=======================
File pmkret.dll received on 11.25.2007 19:02:41 (CET)
File size: 283648 bytes
MD5: c68b4565fdfd9e26c7f460d489c1b21f
SHA1: 140dc8b2f0a264ebd38a6dde3c306e58cea6e34e
Result: 2/32 (6.25%)
Ikarus T3.1.1.12 2007.11.25 not-a-virus:AdWare.Win32.Agent.bn
Norman 5.80.02 2007.11.23 Agent.CUUF
=====================
File monhop.exe
File size: 151552 bytes
MD5: 8e195848bb2756a7c10e6c2b1f416458
SHA1: 017e2d13f75634a9b932650dca274963595662e2
Result: 2/32 (6.25%)
AVG 7.5.0.503 2007.11.25 Downloader.Zlob.NA
BitDefender 7.2 2007.11.25 Adware.NetAdware.BY
Since I found these sites, and posted at one of the 'back rooms' where many of the big malware vendors have access, Sunbelt Software, makers of CounterSpy have had a couple of detailed write ups
here and
here.
Too bad I'm not a well oiled research machine as these guys are(not to mention I was nursing a severely pulled calf muscle, had to keep it elevated and stay off it), I may have made a splash had I written this up sooner, especially now that mainstream media sites are picking it up left and right.
And so it goes.
Lesson learned here folks:
Don't just blindly click links, as much as we all want to trust Google, they can't be relied on to catch everything.
Login
Register
FAQ
Search
Members
