Threat Spotlight

For the week of 25 Jan 2010
Threat 1

Adobe Reader exploit a ubiquitous threat

Threat Name:

Trojan: Troj/PDFJs-GE

Users at Risk:

Windows users

Further Reading:

Removal Instructions:

If you believe you've been infected, follow these instructions on how to remove Trojans.

About:

Troj/PDFJs-GE is another variant in the PDFJs family. PDFJs Trojans exploit JavaScript parsing flaws in Adobe's ubiquitous Adobe Reader software. This variant is the 5th most common malware seen on infected websites by SophosLabs this week and it targets computers with unpatched versions of Adobe Reader.

The malicious JavaScript resides within the annotation section of the PDF and a mitigation technique is to disable JavaScript within Adobe Reader. As always, people should patch Reader as soon as Adobe releases an update. Patches are available from http://get.adobe.com/reader

Threat 2

Trojan leads to drive-by downloads

Threat Name:

Trojan: Troj/JSRedir-AK

Users at Risk:

Windows users

Removal Instructions:

Please follow these instructions on how to remove Trojans.

About:

Troj/JSRedir-AK is a variant of the JSRedir family that has had a massive impact since early December 2009. JSRedir infections are unintended JavaScript code that is embedded in a website to silently redirect surfers to malicious content on other websites. This is known as a drive-by download.

For the month of January 2010 this infection made up more than 40 percent of web detections discovered by SophosLabs dwarfing other web infections in prominence.

SophosLabs have seen a new website infected with this malware every 15 seconds. The best defense against these attacks is to ensure your anti-virus is up to date, and have users surf through a web filtering proxy to look for malicious contents.

Threat 3

Spam hides Bredo malware

Threat Name:

Trojan: Troj/Agent-MEX

Users at Risk:

Windows users

Removal Instructions:

Please follow these instructions on how to remove Trojans.

About:

Troj/Agent-MEX is a variant of the Bredo family of malware. The Trojan spreads a spam email attachment. It is a continuance of a campaign we have seen for several years purporting to be a shipping notification or wire transfer that asks you to open a malicious manifest. The attachment is usually as a zip file containing only one executable and named:

DHL_Details_Nr455.exe
Western_Union_details_Nr1456.exe

Sample message body:

Hello!

The courier company was not able to deliver your parcel by your address.
Cause: Error in shipping address.

You may pickup the parcel at our post office personaly!

Attention!
The shipping label is attached to this e-mail.
Please print this label to get this package at our post office.

Please do not reply to this e-mail, it is an unmonitored mailbox!

Thank you.
DHL International Service.

If the program is run it will install itself, copying itself to

%STARTMENU%\Programs\Startup\rarype32.exe

and creating a data file in

%PROFILE%\Application Data\avdrn.dat

Once installed Troj/Agent-MEX will attempt to contact a website hosted at dollardream.ru.

This is known to be related to the FakeAV malware family and might download further samples which encourage downloading rogue anti-virus products.

In addition to the detection provided for Troj/Agent-MEX, the proactive HIPS technology in Sophos Endpoint Security can prevent the installation of Troj/Agent-MEX, using rule HIPS/FileMod-001.

Mail gateway filtering solutions should be configured to blog executable files from delivery, including inside of archives. Additionally, proactive protections should be enabled in endpoint anti-virus products to prevent this and future variants from circumventing detection.

© 1997 - 2012 Sophos Ltd. All rights reserved. Legal Privacy