Threat Spotlight

For the week of 07 Jul 2011
Threat 1

Malware lures users to download fake antivirus

Threat Name:

Mal/FakeAvJs-A

Users at Risk:

Windows users

Also Known As:

Avira: HTML/FakeAlert
McAfee: HTML/FakeAV
Microsoft: Trojan:JS/FakeIA
Symantec: Trojan.Fakeavalert

Removal Instructions:

Please follow these instructions on how to remove generically detected files.

About:

Mal/FakeAvJs-A is a fake antivirus Trojan affecting Windows users.

The Trojan is found on pages that display fake security scanning results with false warnings alerting users to threats on their computer. These pages also encourage users to download the fake security software, also known as rogueware or scareware, from related websites. They will typically use repeated pop-ups and offer to download the software even if the user initially refuses. In some cases, the fake scanner may be automatically installed using browser vulnerabilities.

Users are directed to the fake scanning pages using social engineering techniques and search engine optimization, luring them with seemingly relevant search results. The static content of the fake scanning pages is normally in HTML—JavaScript is responsible for dynamic content such as a scanning progress bars, displays of bogus threats and display pop-ups.

The fake scanning software (installed as a result of visiting sites hosting Mal/FakeAvJs-A) is usually a member of the Troj/FakeAV family, one of the more common web threats today.

Threat 2

Old viruses never die

Threat Name:

W32/Sality-AM

Users at Risk:

Windows users

Removal Instructions:

Please follow the instructions for disinfecting PE executables.

About:

W32/Sality-AM is a member of the Sality family of viruses for Windows.

W32/Sality-AM has been around since January 2008, but viruses remain infectious long after their original release. Recently, this particular virus has had a minor resurgence.

W32/Sality-AM may also spread by copying itself to removable devices and network shares. It typically drops a hidden file autorun.inf to run copies of itself automatically, detected as Mal/AutoInf-A.

When first run, the W32/Sality-AM may infect executables in the root folder, files on network shares.

The initial dropped files includes dropping as: rejoice101.exe

It is also known to drop drivers in the system32 drivers folder. The driver can have different names but is detected as Troj/RKSal-Gen.

Mal/Sality-AM will attempt to delete a large swathe of files related to antivirus and anti-spyware software. It will modify a large list of registry keys including the following list:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKLM\SOFTWARE\Microsoft\Security Center
HKLM\System\CurrentControlSet\Control\SafeBoot
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Mal/Sality-AM connects to a large list of hard-coded websites to download further malware. The dropped driver files also act as a filter driver which prevents access to various security websites.

Users of the HIPS runtime behavior analysis features of Sophos Endpoint Security have additional protection against Mal/Sality-AM. The actions of this malware trigger the HIPS rules HIPS/FileMod-005, HIPS/RegMod-016 and HIPS/RegMod-013.

Threat 3

Trojan redirects traffic from compromised websites

Threat Name:

Troj/Iframe-BW

Users at Risk:

Windows users

Also Known As:

Malicious iFrame injection

Removal Instructions:

Please follow the instructions for removing viruses.

About:

Troj/Iframe-BW is a Trojan that is used to redirect traffic from compromised legitimate websites.

The Trojan creates a tiny frame in an infected webpage, invisible to the victim of the attack, which sends their browser to a site operated by malicious hackers.

Iframe attacks (whether by Trojans or malware) are still one of the most commonly seen threats on web pages that have been compromised by malicious hackers.

© 1997 - 2013 Sophos Ltd. All rights reserved. Legal Privacy Cookie Information