Security Cadets » Rogue Programs

Javascript message for ESET from a Rogue

AndyAtHull — Wed, 26 May 2010 19:20:30 +0000

What do you do if you found a message directed to you in a javascript from a rogue security product? This is the question ESET have stumbled upon just recently.

Steven Burns, a fellow researcher, posted this on his blog the other day:

“On the hunt as usual, I came across yet another rogue, again using xorg.pl etc via blackhat SEO, but using .tk domains (surprise surprise). What I did find rather humorous however, was a javascript file that was loaded.

The javascript contained a lovely little snippet, and a note for the folks over at Eset (though evidently, the bad guys got their Star Wars and Star Trek mixed up, as it was the Borg that said Resistance is futile – not anyone from Star Wars)“;

/*hello nod32 guys; the force is strong with u, young Padawans, but u won’t defeat us; any resistance is futile;*/

The file in question appears to be:

hxxp://www2.megosave2.tk/107ad6ae3feaa24b00263864f0be76edbcf43009611.js

(Do not copy into your browser!)

The guys at Sunbelt also blogged about this with a view graphics to show you some of the messages to ESET.

So what do you do if you are ESET? Well to be truthful, nothing other than blocking the URL’s in any software that ESET have for computer users. There is not a lot you can do because the minute the URL’s get taken down, new URL’s will appear. Besides, traking down .tk tld’s is not proving easy.

Have you had any rogues installed on your system via whatever means? Get free help here. Our forum topic on this lists all domains with the javascript which you find here.

Stay in touch – Twitter, Facebook.

Bitdefender Update Cripples 64-Bit Versions Of Windows

AndyAtHull — Sun, 21 Mar 2010 16:56:37 +0000

An update for BitDefender which was released on Saturday has caused some serious problems for 64-Bit versions of Windows. As BleepingComputer.com reports:

“This update caused BitDefender to flag Windows system files and BitDefender files as the Trojan.Fakealert.5 infection. Depending on a users action settings for when a virus is found, this has led to numerous Windows system files being added to the BitDefender quarantine. When this happens, these computers are not be able to boot into Windows.”

A mammoth 67 page forum topic at the BitDefender forums shows some of the frustrations of the problem. Not long after, Bit Defender released the following:

“Today (morning PST) we had an update for 64-bit systems (available on our servers between 8 AM and 11 30 AM PST) that caused multiple Windows and BitDefender files to be quarantined. We are creating a patch that will restore all quarantined files. The patch will be available shortly. We apologize for this error and we will work to prevent this from occurring again in the future.

BitDefender trojan alert update issue: BitDefender has released an alternative solution for users that are able to boot their systems. The details are available here http://www.bitdefender.com/site/KnowledgeBase/consumer/#638 . The solution for users that are not able to boot their system will be available shortly. Thanks for your understanding.

We would like to provide you with a current update regarding the Trojan.FakeAlert.5 issue:

Today BitDefender products running on Windows 64-bit systems experienced problems caused by a faulty update. Multiple BitDefender and Windows files have been incorrectly detected as Trojan.FakeAlert.5 and have been moved to quarantine. Based on the information we have, only .exe, .dll and other binary files have been quarantined (no pictures or documents). Consequently, on some systems BitDefender did not run anymore, applications did not work and/or Windows did not start on those systems.”

You can read that press release in full here – Trojan.FakeAlert.5 Update issue.

If you have been affected by this and require advice on how to resolve it, we offer free support on a range of problems. Visit our support forums and navigate to the correct subforum.

Have an opinion on this story? Share it here.

Sunday NewsBot: Weekly Round Up (22/11/2009)

AndyAtHull — Sun, 22 Nov 2009 18:18:06 +0000

Welcome to another blog post of Sunday NewsBot. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology and gathered in our centre. This weeks top articles are:

There are more articles located within the NewsBot Centre. Plus there is also an chance to have your blog feed included. Details about it can be found here.

Sunday NewsBot: Weekly Round Up (15/11/2009)

AndyAtHull — Sun, 15 Nov 2009 18:13:36 +0000

There are more articles located within the NewsBot Centre. Plus there is also an chance to have your blog feed included. Details about it can be found here.

Sunday NewsBot: Weekly Round Up (18/10/2009)

AndyAtHull — Sun, 18 Oct 2009 17:00:41 +0000

Welcome to this weeks round-up. Before we go firther, SCars Beta testing is going well. Places are always available for this. Please re-visit the blog post to express your interest.

All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks articles are:

There are more articles located within the NewsBot Centre. There is an oppertunity to put your blog feed forward and have a chance to be added to our NewsBot service. Details about it can be found here.

Sunday NewsBot: Weekly Round Up (27/09/2009)

AndyAtHull — Sun, 27 Sep 2009 17:51:58 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks articles are:

Sunday NewsBot: Weekly Round Up (20/09/2009)

AndyAtHull — Sun, 20 Sep 2009 17:26:16 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks articles are:

Sunday NewsBot: Weekly Round Up (13/09/2009)

AndyAtHull — Sun, 13 Sep 2009 17:40:01 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

Sunday NewsBot: Weekly Round Up (06/09/2009)

AndyAtHull — Sun, 06 Sep 2009 17:55:43 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

Sunday NewsBot: Weekly Round Up (30/08/2009)

AndyAtHull — Sun, 30 Aug 2009 18:00:32 +0000

Welcome to this weeks round-up. This week I have put a timer on this article being published due to work commitments I have. I did think about changing it to a Monday NewsBot, but decided against it.

Also, on a side point away from our weekly round-up, our application (formally codename ProjectX) SCars, is in full swing and several components are finished. There is no predicted release date, but we will hopefully provide a run down of what we’re actually programming soon. We are after a few graphic designers to help us with graphics on the application. Please contact me, AndyAtHull, via my forum account for details. Let us crack on.

All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

Sunday NewsBot: Weekly Round Up (26/07/2009)

AndyAtHull — Sun, 26 Jul 2009 17:57:52 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

There are more articles located within the NewsBot Centre. You can also add your feed to our NewsBot should you wish, details about it can be found here.

Sunday NewsBot: Weekly Round Up (07/06/2009)

AndyAtHull — Sun, 07 Jun 2009 17:00:23 +0000

Welcome to this weeks round-up. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

There are more articles located within the NewsBot Centre. You can also add your feed to our NewsBot should you wish, details about it can be found here.

Sunday NewsBot: Weekly Round Up (26/04/2009)

AndyAtHull — Sun, 26 Apr 2009 18:48:57 +0000

Welcome to this weeks Sunday NewsBot. All articles in the NewsBot Centre are imported from blog and site feeds from the world of security and technology. This weeks top articles are:

There are more articles located within the NewsBot Centre. You can also add your feed to our NewsBot should you wish, details about it can be found here.

ComboFixTool – What’s that all about?

AndyAtHull — Sun, 29 Mar 2009 14:51:46 +0000

First there was SmitFraudFixTool and then VundoFixTool came onto the scene. What do all these have in common?

… Well, they all imitate legit removal tools for malware. And probably created to gain financial advantages from the traffic the original tools get.

This time they have released another version called ComboFixTool which imitates the legit tool ComboFix.

Make no bone about it. SmitFraudFixTool, VundoFixTool and now ComboFixTool are the fake applications here. Not SmitFraudFix, VundoFix or ComboFix.

What is funny at the time of me writing this is that the offending domain has not been updated. Nor has it’s download. Example below:

(Click to Enlarge)

Another twist on this story are the comments we’ve been getting from the last product this gang released. A victim has claimed to even get a refund on the amount of money they had spent before realising it’s practices from our articles. They’re also receiving help in our support forums.

A discussion has started about ComboFixTool over at BleepingComputer.com. And it’s safe to say that exploiting ComboFix is a dangerous prospect. You should never use the legit tool without supervision due to the nature of it. So when this fake application comes along, the impression it has could well affect this area of ComboFix and possibly push users into confusion.

We have procedures to help you with this kind of problem. Our forums have experts in place to assist you and will provide step-by-step help freely in removing it:

Malware Removal Assistance with an Expert

Update (29/03/2009 – 17:41 PM – BST) – Offending URL’s are combofixtool.org and combofixtool.com. Both sites still not updated with graphics and download.

Update (31/03/2009 – 20:40 PM – BST ) – Both offending URL’s are now down – Result

Selective Linkbacks;

Dell Forums – ComboFixTool – What’s that all about?
Forum Linkback- ComboFixTool – What’s that all about?

Sunday NewsBot: Weekly Round Up (22/03/2009)

AndyAtHull — Sun, 22 Mar 2009 20:01:13 +0000

This weeks Sunday NewsBot marks it’s first anniversary. We started this venture all the way back in March 2008 and the first article was a Microsoft Security Advisory (950627) article. Let’s hope this is the start of many more.

All articles in the NewsBot Centre are imported from blog and site feed from the world of security and technology:

We hope you have a great remaining Sunday wherever you are. There are more articles from the last eight days or so. Just visit the NewsBot Centre for more.

You can add your feed to our NewsBot should you wish, details about it can be found here.