Threat Spotlight

For the week of 10 Jan 2011
Threat 1

Social networking worm spams itself out

Threat Name:

W32/Palevo-BB

Users at Risk:

Windows users

Also Known As:

  • Avira: Worm/Yahos.jh
  • AVP: IM-Worm.Win32.Yahos.jh
  • McAfee: Generic.dx!vme trojan
  • Microsoft: Trojan:Win32/Ircbrute
  • Symantec: W32.Yimfoca

Removal Instructions:

Please use the instructions for removing worms.

About:

W32/Palevo-BB is a new incarnation of the Mal/Rimecud-D worm family, which spreads through instant messaging applications. This worm is spammed out as links through social networking chats or instant messaging. When someone clicks a link in the file, a malicious file called "facebook-pic000934519.exe" gets downloaded to their machine and runs. This malware then searches for contacts in social network chats and instant messaging and gets spammed out.

When first run, this worm copies itself to C:\WINDOWS\nvsvc32.exe. It then creates the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\ Software\Microsoft\Windows\CurrentVersion\Run NVIDIA driver monitor
c:\windows\nvsvc32.exe


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NVIDIA driver monitor
c:\windows\nvsvc32.exe

W32/Palevo-BB attempts to contact MySpace.com and numerous other websites and IP requests. In addition to the standard detection provided for W32/Palevo-BB, the proactive HIPS technology in Sophos Endpoint Security can prevent the action of this malware and the additional malware it attempts to install. When W32/Palevo-BB is run it will fire the following HIPS rules:

HPsus/SysDrop-C
HIPS/FileMod-001
HIPS/RegMod-002
HIPS/RegMod-007
Threat 2

Post-Christmas spam spike

About:

The Christmas dip in spam levels is officially over. The period of relative botnet inactivity that started around Christmas ended on Monday Jan 9th with the return of many of the usual botnet generated spams. The spike coincides with the end of the Russian 10 day New Year holiday, or "Novogodnie Kanikuly."

We can attribute the rise in spam levels to the return of the usual botnet Viagra spam campaigns. One campaign we have seen little of since Christmas is the Canadian Pharmacy campaign with subject "<Email_Address> Viagra/Pfizer -xx% off." The actual savings promised in the spam subject vary from an appealing 60% off to a profit-prohibiting 90% off!

As usual, the campaign promises you cheap blue pills after clicking the link. While the spammers are using different .ru domains, most links use Viagra.com as a subdomain to confuse the user into believing this is a valid link. Naturally, abcde.viagra.com.spammer.ru is still part of the spammer domain, so you shouldn't click it. The abcde part of the domain is most probably used for tracking purposes.

Clicking on the link for takes us to a page that redirects you to Pharmacy Express, a variant of the usual online drug store. The site is hosted on a number of IPs located all over the globe, from the Ukraine to Colombia.

While earlier variants of this campaign came from the rather convincing no-reply@pfizer.com by spoofing the email address, newer variants use addresses that are either compromised or simply random; most probably to get around filters set to delete messages coming from no-reply@pfizer.com

This brings us back to the recent spam dip. Many theories have been flying around about the reason for the botnet Christmas inactivity — one of which is that the botnets were re-equipping and preparing for new waves of spam using new and improved methods. From everything discussed above, the new spam looks at least so far to be more of the same, but we will keep monitoring our spam traps for any changes.

Threat 3

Another Trojan in the wild

Threat Name:

Troj/Patched-Y

Users at Risk:

Windows users

Also Known As:

  • Avira: TR/Patched.Gen
  • Symantec: Trojan.Bamital.B!inf

Removal Instructions:

Please follow the instructions for disinfecting Trojans.

Note: Troj/Patched-Y might require a reboot to cleanup. In cases when critical system files (e.g. explorer.exe, winlogon.exe) are locked and cannot be disinfected it might require SBAV to cleanup.

About:

Troj/Patched-Y is a family of infected Trojans. When run, it tries to load the file kb.dll. This DLL file in turn tries to read and run the code found in <System32>\dll.

Sophos products detect kb.dll and <System32>\dll as Troj/Patched-Y.