Trevor Peacock » Science & Technology

Antivirus 2009 infection, and how to prevent it

TrevorP — Sun, 01 Feb 2009 10:45:10 +0000

Overview:

This article describes an investigation into the cause of infection of AntiSpyware2009 and similar malware.

Goals:

Find where this malware lives
Find how this malware is installed

Method:

This research was performed on two VMWare Server 2 virtual machines, on an Internet connected computer, isolated by a firewall from any other computers on the site.

The two computers were:

Windows 2000, Service Pack 4, Internet explorer 6 and Firefox 3, All windows updates installed
Windows XP, Service Pack 3, no updates installed. Internet Explorer 6 and 7 tested.

Online research provided the researcher with several possible malicious websites. These sites were opened in the web browsers of the test machines.

Results:

The virus was discovered on several servers designed to handle redirects from other sites. These redirects come from sites that have been tampered with, usually by installing a .htaccess file that redirects users who visit an otherwise legitimate site.

Two different sites were found containing this virus. Each site presented several “warning” dialog boxes, telling the user they had a virus, and needed to run Antivirus 2009. Two examples of this dialogue are shown:

These dialog boxes show “Microsoft Internet Explorer” in the blue title bar. This is a limitation of the scam. A true virus scanner running on your system would be able to present an appropriate title bar, representing the correct name or function of the software. Seeing the name of your web-browser in the title bar is a give-away that the message is being generated by a web page inside the browser, and not by software on your system.

The site then presents a mock virus scan, which quickly pretends to find several (hundred) infections. Clicking on any part of the page at any time causes a file download dialog to show, allowing the user to download and install the malware on their system.

Again, in both these examples, the falsified scan is bounded within the Internet Explorer window, and Internet Explores title-bar, menu and controls are visible at the top of the falsified scan. Furthermore, minimising the Internet Explorers window also hides the scan within it (This is not a foolproof test)
The scans claim to be scanning a C:\ drive and a D:\ drive, both hard drives. I know that my system only had one hard disk drive, so this report is clearly false.

On completion of the falsified scan, the scam presents a warning that viruses have been found and should be removed. These warnings are simply images shown within the browser, allowing them to look very realistic.

Again, these screens are contained within the browser. Closing or moving the browser also moves these windows.
Being a static image, these do not react the way normal windows do. The mouse cursor is incorrect over much of the image, normal windows hover highlighting does not work.

Clicking on any part of the browser frame causes a file download window to appear. Curiously it always seems to have the letters “AVg”, possibly to make the user think its the common Grisoft AVG virus scanner. Running this file will install the Antivirus 2009 malware package on the computer.

An important principal in computer security is not to accept files from someone you don’t know. Though this may appear to be a legitimate virus scanner, nowhere is the following information available:
- The name of the software vendor
- The location of the software vendor
- The vendors website or other contact details
- Any other information about the software, the license (describing who is allowed to use it, and for what purposes), and if the software is a trial or fully functioning.

This research did not proceed to install the malware and observe its behaviours, the goals were only to discover how infection occurred.

The files however were analysed, and were found to be viruses, both similar variants. Unfortunately only a few virus scanners actually detected this. The reason is unknown. Perhaps the virus is some form of self-modifying virus, which some scanners have difficulty detecting.

At the time of analysis (24th Jan), only three virus scanners were known to detect any virus in these files. Now a week later, 15-25 virus scanners (40-60%) now see it. Unfortunately, a newly downloaded file (recently updated by the virus writer) is only detected by 5 scanners. It seems the authors are constantly publishing new versions to hinder detection by virus scanners. (1 2 3)

Conclusion:

It was suspected before investigation that infection was due to a browser exploit, allowing the virus to install itself without user knowledge or consent. This was not found to be the case, rather, the user must knowingly install the virus, presumably after being convinced by the false virus report that it is a desirable course of action. Thus infection from these sites is preventable with user training.

Recommendations to users to avoid this style of attack are as follows.

Know what virus scanners and security software are installed on your computer. If you see anything unfamiliar when using the Internet, be suspicious.
- Know what this software is called, and what it looks like.
- Other common security software you may not be aware of is Windows Defender and Microsoft Malicious Software Removal Tool.
Before downloading any file from the Internet or email;
- Know that running a file potentially allows it full access to your system, to modify it in any way, and use whatever techniques it has available to hide any virus activity.
- Know and trust the author of the file. Ensure you are receiving the file directly from the author, so that you are sure the file has not been tampered with.
Always browse the Internet with an up-to-date browser. In this testing, Firefox 3 prevented me from visiting these sites, warning that they were known to contain malwarre.
- Avoid browsing with older or unsupported operating systems.
- Ensure all your system software is kept up to date, Turn on Microsoft Update or Windows Update in Windows.

Bilby Mark II (Part 2)

admin — Fri, 01 Dec 2006 18:38:01 +0000

Well, our new line following robot is done. With any engineering project, you can always do more, but after tidying up the program, and tweaking values for a few hours, we came up with a reasonable configuration, able to complete out test circuit in an average of 40 seconds.

The robot is much quicker making left turns than right turns (as shown in the video below). When the robot looses the line, it will turn left to try and find it. If the path leads left, the robot will find the line again very quickly, and continue. If the path leads right, the robot will try to seek left, fail to find the line within a pre-determined time, then seek left to find the line.

The following images show a summary of the program, as shown by the graphical programming environment supplied with the NXT.

The main body of the Bilby’s program

The section of the Bilby’s program that instructs it to seek left

The section of the Bilby’s program that instructs it to seek right

For those unfamiliar with reading NXT programs, here is a pseudo-code version:

Wait until sensor sees black
loop forever:
  move forward
  wait until sensor sees white
  call seek_left
  if sensor sees white:
    call seek_right

seek_left:
  loop 10 times:
    pivot left (move left motor backwards, and right motor forwards)
    if sensor sees white:
      wait 0.01 seconds

seek_right:
  pivot right (move right motor backwards, and left motor forwards)
  wait until sensor sees black
  wait 0.02 seconds

All in all, not bad for a few hours tinkering, we certainly enjoyed it. For those interested in seeing more, we recorded a video of the robot in action, and are also providing the program we used.
Download Video (2.95Mb, slow connection, 109secs)
Download Program (339Kb)

Bilby Mark II (Part 1)

admin — Thu, 30 Nov 2006 18:36:37 +0000

Fun and games last night. Bradley Robinson (who absolutely refuses to have his photo taken) bought a Lego Mindstorms NXT kit. Brad has had it a few days before I had a chance to see it. When I first saw it it was configured as a walking bi-ped, though it more a shuffle than a walk. The system has four sensors:

Ultrasonic distance and movement sensor
Sound sensor, with sound pattern and tone recognition
Light sensor, detecting light intensity
Touch sensor (press/release/bump detection)

and also three servo motors with rotation sensors.

After some discussion, food, and music, we decided to revisit our Bilby Competition days, where in Newcastle in 2000 we won 2nd place in the competition with “Little Jim”, an autonomous path following robot.

From Left: Ian Peacock (Dad), Trevor Peacock (Me), Bradley Robinson, John Dietsch (Teacher)

The NXT kit comes with a paper “field” with lines and patterns printed on it for testing and sensing. Printed on this field is an inch-wide oval circle. Using this path and the single light sensor we started to build our robot.

Much of the challenge was similar to the original bilby, determining the best sensor placement, and adjusting sensor sensitivity. An additional problem encountered due to the single sensor was the fact that while correcting the robot would miss the path if it was moving too quickly. After several attempts to increase the accuracy of the sensing (trying to sense more quickly) the final solution was simply to slow down the motors.

A further limitation was the programming interface, a graphical interface with simple programming constructs. It took some re-arrangement of our logic to code. The pseudo-code:

WAIT UNTIL (2 seconds pass) OR (sensor sees black)

required re-factoring as:

LOOP 20 times:
  if sensor sees white:
    WAIT 0.1 seconds

The language does not allow the use of any sort of variable or constant, re-usable functions of any type, or multi-parameter tests (with ORs or ANDs), but after some rearranging the few problems we found could be overcome.

After some research it seems there are several other programming interfaces available for the NXT. I haven’t tried any, but of the ones I’ve found, the promising ones are:

Bricx Command Centre, with available debugger
NXT Python
nxtC

The blog nxtacy has many links to other projects and seems about the best resource for the NXT hacker.

The practical result is, after 3 hours tinkering (before 1. flat batteries, and 2. sleep time) we had an almost functioning line following robot.

With any luck tonight we will have a chance to finish and fine tune it. I’ll report back with the end results and programming ASAP.

This post is followed up by This Post.

Finish Term / Linux

admin — Mon, 12 Sep 2005 04:26:24 +0000

Well, long time. Finished assignments, and end of term.
Spent a few days working with tapestry, trying to write a library. Seeing as there’s little documentation it was more or less trial and error, but got it working in the end. have an eclipse environment set up for developing it. Also wrote a tapestry filter to log requests to a file. Should implement it soon, as not all pages are being logged since the installation of new things such as this blog.
Have installed Debian on my main machine, got it dual booting with windows (no hassle), what has been a hassle is getting gaim 1.5, and newer versions of thunderbird and firefox. added this line to /etc/apt/sources.list

deb ftp://sunsite.cnlab-switch.ch/mirror/debian/ unstable main contrib non-free

I manually installed thunderbird from their website, and after changing sources.list thunderbird broke. updated thunderbird from synaptic, and worked fine.

Spent hours trying to get thunderbird working in the first place. I have a thunderbird profile of about 1Gb, which i didn’t want to loose. Ended up having to manually editing prefs.js to update all the paths from my windows setup. After that, and upgrading thunderbird it seems to be working fine, except the fact i am unable to access postoffice.csu.edu.au from this IP address. Its getting rather annoying.

Been going back through the histories music-wise. Found a stack of albums at leading edge, Gene Pitney, Hank Williams, Bee Gees, Carpenters, and Beach Boys. Also found a very nice album from Sydney musician Lior. Very impressed with Gene Pitney, and was already fans of Carpenters and Bee Gees. Also got my hands on Motown Remixed, which I saw advertised in Sain magazine (for Sanity Music). Eleanor and her father are big fans of motown artists, and although i know some of the songs on the album, i don’t know them well enough to compare them to the originals. Also finally got a Jackson 5 album (only took me 2 years), and loving it.

Working hard doing nothing

admin — Fri, 19 Aug 2005 02:00:30 +0000

Been (very) busy the last few days, although I don’t have a lot to show for it. Installed MediaWiki on my Apache server (about my only success). Tried to get WikiPDF working. Its obviously designed to run on Linux. After a bit of tweaking I got it to generate latex, but it failed to convert that to PDF. Tried to get PHP working atop Tomcat. This seemed the most promising lead, and it did work on Tomcat 5.5, but not 4.1, and MySQL didn’t work. Perhaps I should learn how to set up PHP normally, might explain how to get MySQL to work.
Also started a few days ago upgrading tomcat 4.1 to 5.5, all going fairly well, except getting manager and admin modules to work. The Admin module now has to be installed manually, but it doesn’t work on a virtual host, it must be running in the default app.

Continuing to work back through Dream Theaters discography, I’m quite impressed by their 1997 album “Falling Into Infinity”. Quite a relaxing mix of songs, plenty of different styles, every song is unique.

Books

admin — Tue, 02 Aug 2005 05:24:30 +0000

Another 382 lecture, nothing terribly exciting, mostly business centred stuff, not too bad though (not my favourite field).
Had an idea today of what I might be able to focus on in this subject. I haven’t re-read the criteria yet to understand it better, so I don’t know if this will suit, but… I once had planned to write a webapp to allow Java students to learn and interact together, through a number of forms (wiki philosophy), primarily through the use of problems (questions) that students can attempt, and post their answers online to be “marked” and critiqued by other students. This is not so much conforming to a business model, more a non-profit organisation or community. Again, I don’t know if it will fit the criteria, but I’ll check over the next few days.
Another thought, as an application of the XML tutorials, I may be able to write an interface in ZOPE on the ISPG server to show this blog, via RSS (or other) from the ZOPE site. Learn about XML, learn about ZOPE, and have a good excuse to play with python (I looooove python, but rarely have time or reason to use it)

Bought text books today, the one for my distance subject (262, Operating systems) is on back-order, and isn’t expected for at least a month. Shame, was looking forward to getting my hands dirty in that subject. I’ll have to see if the library has a copy, and chase up the recommended resources. There should be plenty of online resources too.

Was supposed to take the bass back today, couldn’t find dave tonight, so I’ll take it back tomorrow (after another quick play ).
Found a page providing a nice definition of “progressive rock”. It has a list of progressive metal bands, many of which I’m not familiar with, so I have found myself some research to do. Pain of Salvation and Opeth (who I saw last year in Melbourne) are big favourites, also know tool, but the rest are largely unfamiliar. Its always fun to explore.

CSS

admin — Mon, 01 Aug 2005 05:09:00 +0000

Alan and I today looked into CSS. Al wanted to “customise” his blog. Decided to have a look too, as i previously knew nothing about CSS. Tweaked my page, from this to this, by changeing only the CSS (and adding a few jpgs). Clayton reccomended oswd (this in particular) as a source of quality css to learn from. Think i still need to learn more about how CSS fundamentally works first.

Found a useful screen capture program today. Windows XP will do captures to clipboard by pressing print-scn on the keyboard, however i’m not sure if older versions of windows will. CapturePlus saves shots to a file (bmp or jpg), and also allows captures from a single window rather than the entire screen. Personally i’ll stick with the old faithful Corel Capture (comes with corel draw suite, i only have the ancient version 7). Its much more flexible, but capture plus is a tiny (90k) but functional free alternative.

Wore out my fingers again today playing Opeth on bass. Only 30 days until their next album. I have it pre-ordered, but not sure what to expect. For a band described as a “classical, jazz, folk, progressive rock, death metal band” (original site no longer available), theyre a bit hard to predict.

Bass hurts

admin — Wed, 27 Jul 2005 16:09:41 +0000

Highlight of the day: borrowed a bass guitar (one pick-up version) off Dave. Spent a few hours playing today, my fingers feel like they’re going to get blisters. Standard electrics have small strings that tend to cut into your fingers, but the bass has such thick strings, doing bends and slides really burns your fingers, more so than a nylon (from which I have received blisters). Hopefully my fingers will have recovered by morning, and become a little tougher (I haven’t been playing enough guitar lately, my fingers have gone soft).
I was surprised when I saw the bass, its a 5 string, I had forgotten it was (last time I saw it was about a year ago). Bonus!! I have always thought its almost pointless to get a 4 string when you can get a 5, but now I’m not 100% sure, the 5th string gets in the way when playing songs typically played on a 4. On a 4 you can access the E string (or D if you tune it down) with the first two fingers, but the 5th C string gets in the way. Its also very low pitched, its surprisingly hard to play by ear, because the frequencies are so low, there’s only a cycle or less between semitones, I’ll keep practising. Think I’ll have a listen to “The Gathering” and “Pale Forest” tomorrow, and try to play some of that.

Downloaded Apache HTTPD, PHP, and MySQL as separate packages today. We have been using XAMPP for our ITC307 project, but when we put it into production it would be best to use a more compact and controlled distribution. Grace (in another project team) needs a php/mysql system working, so tomorrow we are both going to try and figure out how to manually install the three packages, save us both some time.

Tonight Alan and I tried to get Dark-Reign working over the Internet. Haven’t played it for years, and although I’m not a great fan of it, it would have made a nice change of pace, if it had worked. The problem is probably caused by the fact we are both running dedicated firewalls, config problem there somewhere I expect, anyway, off to bed.

PS. I did find a spell-checking plug-in for firefox, SpellBound works nicely. It can be downloaded from the site, installed, and once run, it will have no dictionary, simply choose download more from the spell check box, and pick one.

PPS. Another interesting thing today:

Requested by Trevor..
Site Feed
Whispers: I don’t really know what this is for…

I dont know how long it has been there. FYI, it allows me to read the blog via my email client (almost as if it was an email), which I can at last. Thanks Katrina.