Posted: Sat Jun 30, 2007 6:19 am Post subject: Live Trojan (Zlob + Dnschanger) hosting sites takedown| Code: |
|
http://www.plus-codec.com/ = 64.28.184.184 http://plus-codec.com/download/plus-codec1020.exe (Trojan.Win32.DNSChanger.jb) http://www.network-ticket.com/ = 64.28.184.202 http://www.network-ticket.com/download/pageticket2000.exe (Trojan.Win32.DNSChanger.ik) http://www.useticket.com/ = 64.28.184.201 http://useticket.com/download/useticket2008.exe (Trojan.Win32.DNSChanger.iu) http://www.zcodec.com/ = 64.28.181.230 http://zcodec.com/download/ZCodec1000.exe (Trojan.Win32.DNSChanger.jb) http://tv-codecs.com/ = 64.28.181.252 http://tv-codecs.com/download/tvcodec1000.exe (Trojan.Win32.DNSChanger.jb) |
| Code: |
|
http://www.playercodec.net/ = 216.255.176.178 http://playercodec.net/download/playercodec1000.exe (Trojan.Win32.DNSChanger.ih) http://www.dvdaccess.net/ = 216.255.176.180 http://dvdaccess.net/download/dvdaccess1000.exe (Trojan.Win32.DNSChanger.ih) http://www.dvds-access.com/ = 216.255.181.155 http://dvds-access.com/download/dvdaccess1000.exe (Trojan.Win32.DNSChanger.ih) http://moviecodecs.net/ = 216.255.181.157 http://moviecodecs.net/download/moviecodec1000.exe (Trojan.Win32.DNSChanger.ih) http://www.movies-codecs.com/ = 216.255.182.170 http://movies-codecs.com/download/moviecodec1000.exe (Trojan.Win32.DNSChanger.ih) http://dvdsaccess.com/ = 216.255.181.154 http://dvdsaccess.com/download/dvdaccess1000.exe (Trojan.Win32.DNSChanger.ih) http://moviecsodecs.com/ = 216.255.181.158 http://moviecsodecs.com/download/moviecodec1000.exe (Trojan.Win32.DNSChanger.ih) http://access-dvd.com/ = 216.255.181.156 http://access-dvd.com/download/dvdaccess1000.exe (Trojan.Win32.DNSChanger.ih) --- http://www.vidaccess.net/ = 69.50.170.100 http://vidaccess.net/download/videosaccess1000.exe (Trojan.Win32.DNSChanger.ih) http://www.vids-access.com/ = 69.50.170.101 http://vids-access.com/download/videosaccess1000.exe (Trojan.Win32.DNSChanger.ih) http://www.activexsource.com/ = 69.50.188.105 http://activexsource.com/main/axssetup.exe (Trojan-Downloader.Win32.Zlob.bip) http://playerscodec.com/ = 69.50.170.98 http://playerscodec.com/download/playercodec1000.exe (Trojan.Win32.DNSChanger.ih) http://siteentrances.com/ = 69.50.170.102 http://siteentrances.com/download/siteentrance2000.exe (Trojan.DNSChanger) |
Posted: Tue Jul 03, 2007 1:03 am Post subject: | Code: |
|
DEAD http://www.playercodec.net/ DEAD http://www.dvdaccess.net/ DEAD http://www.dvds-access.com/ DEAD http://moviecodecs.net/ DEAD http://www.movies-codecs.com/ DEAD http://dvdsaccess.com/ DEAD http://moviecsodecs.com/ DEAD http://access-dvd.com/ DEAD http://www.vidaccess.net/ DEAD http://www.vids-access.com/ DEAD http://www.activexsource.com/ DEAD http://playerscodec.com/ DEAD http://siteentrances.com/ |
| Code: |
|
DEAD http://www.plus-codec.com/ DEAD http://www.useticket.com/ |
Posted: Tue Jul 03, 2007 7:03 am Post subject: 
because now they're using net-codec.com. In two more days they might be using nasty-sex-codec.com or uber-neato-codec.com, and in six days they'll be on to yet another one.
I guess there's no shortage of people who'll run these Trojans and then fall for the OMG YOUR COMPUTER IS INFECTED, GIVE US $50 TO FIX IT (LOL) song and dance.
Posted: Tue Jul 03, 2007 2:45 pm Post subject: Posted: Tue Jul 03, 2007 3:25 pm Post subject: 
Some mornings, time might be scarce... I get up, make coffee, log onto Malware Research and AIEEEE there's SIX new ones overnight!! There's barely time (or no time) to get VT results and report them all to SiteAdvisor without being late for work.
| Quote: |
| I take my little victories where I can get them. |
Posted: Fri Jul 06, 2007 5:40 am Post subject: | Code: |
|
http://activeximagesetup.com = 85.255.117.244 http://activeximagesetup.com/download.php?id=4058 (Trojan-Downloader.Win32.Zlob.bvs) http://imgaxobject.com = 85.255.117.246 http://imgaxobject.com/download.php?id=107 (Trojan-Downloader.Win32.Zlob.bvs) http://mediaobjectsetup.com = 85.255.117.243 http://mediaobjectsetup.com/download.php?id=1067 (Trojan-Downloader.Win32.Zlob.bvs) http://getvideoactivex.com = 85.255.117.246 http://getvideoactivex.com/download.php?id=4040 (Trojan-Downloader.Win32.Zlob.bvs) http://axobjectinstall.com = 85.255.117.242 http://axobjectinstall.com/download.php?id=1104 (Trojan-Downloader.Win32.Zlob.bvs) http://getiaxobject.com = 85.255.118.181 http://getiaxobject.com/download.php?id=4058 (Trojan-Downloader.Win32.Zlob.btc) http://getvaxobject.com = 85.255.118.178 http://getvaxobject.com/download.php?id=4095 (Trojan-Downloader.Win32.Zlob.btc) http://www.downloadvax.com = 85.255.118.180 http://www.downloadvax.com/download.php?id=107 (Trojan-Downloader.Win32.Zlob.btc) http://www.vaxdownload.com = 85.255.118.178 http://www.vaxdownload.com/download.php?id=1699 (Trojan-Downloader.Win32.Zlob.btc) |
| Code: |
|
http://popular-ticket.com = 64.28.184.203 http://popular-ticket.com/download/pageticket2000.exe (Trojan.Win32.DNSChanger.ik) http://basic-codec.com = 64.28.184.186 http://basic-codec.com/download/playercodec.exe (Trojan.Win32.DNSChanger.jc) http://tv-codecs.com = 64.28.181.252 http://tv-codecs.com/download/tvcodec1000.exe (Trojan.Win32.DNSChanger.jc) http://zcodec.com = 64.28.181.230 http://zcodec.com/download/ZCodec1000.exe (Trojan.Win32.DNSChanger.jc) http://www.page-ticket.net = 64.28.181.253 http://www.page-ticket.net/download/pageticket2000.exe (Trojan.Win32.DNSChanger.ik) |
Posted: Fri Jul 06, 2007 6:26 pm Post subject: 
Posted: Fri Jul 06, 2007 10:53 pm Post subject: | mechBgon wrote: |
| getiax.com can be added to the hit list. freeimageheaven.com has reverted to them. Current detection is better than average (although still not great), and it's encouraging to see more heuristic/generic detections.
Oh, and if anyone wants some comic relief, read this: "McAfee continues to be on the lookout for new versions of such threats." Given their dismal detection rates and steadfast ignoring of my WebImmune.net submissions, I'm afraid I don't believe that.
|
| Code: |
|
DEAD http://activeximagesetup.com = 85.255.117.244 DEAD http://imgaxobject.com = 85.255.117.246 DEAD http://mediaobjectsetup.com = 85.255.117.243 DEAD http://getvideoactivex.com = 85.255.117.246 DEAD http://axobjectinstall.com = 85.255.117.242 DEAD http://getiaxobject.com = 85.255.118.181 DEAD http://getvaxobject.com = 85.255.118.178 DEAD http://www.downloadvax.com = 85.255.118.180 DEAD http://www.vaxdownload.com = 85.255.118.178 |
Posted: Fri Jul 06, 2007 11:20 pm Post subject: Posted: Sun Jul 08, 2007 9:44 pm Post subject: | Quote: |
|
Hello Mark, We've received a response this morning from our client in regards to the activex video software. Please review their response attached at the end of this message. One thing I did find is that Windows Defender did state the string it found to classify it as the Zlob Trojan, setup.exe->(nsis-6-$(PLUGINSDIR)\abc.dll). I have tried to find SOME anti-virus software to detect their software as a Zlob varient, and I haven't found anything. I've tried the following programs: Mcafee Anti-Virus Norton Anti-Virus Comodo Anti-Virus AVG Anti-Virus AVG Anti-Malware Comodo Anti-Malware All of the software above was UP-TO-DATE. It doesn't appear that the software really IS malware. Please advise if you can provide any more insight in this situation. Also, don't forget the client's response below. Thank you for your time. Have a great day. --- Russell XXXXX InterCage, Inc. Konstantin XXXXX (Esthost) Posted on 08 Jul 2007 07:45 AM ================================================================ Hi, Please look at the oiwner's answer below and forward it to the MIRT. Regards, Konstantin "To whom it may concern, The software you have quoted contains no malware. Video Active-X Object was created to: 1. Protect adult content from children 2. Protect video content from unauthorized views Video Active-X Objects includes EULA on the very first page of its install wizzard and install process can be canceled at any time. The software can not be defined as virus. We have checked it with Symantec Norton AV and McAfee AV and no problems were found. Futhermore, Video Active-X Object has never been distributed through any security exploits or used in unfair tactics. Best Regards Anthony" |
| Quote: |
|
Greetings, I will gladly explain to you how this is malware. Firstly new versions of this trojan are released every few days and sometimes daily to avoid antivirus detection. Mcafee and Symantec(Norton) are barely acceptable products, however they sometimes take weeks to add new malware to their definitions. The Zlob trojan is known as a "moving target", in which the malware is updated constantly to avoid detection. The reason why new domains are registered almost daily and malware links are updated to point to the new domains is to avoid blacklisting and tracking by Antimalware efforts. There are two good ways to determine whether a file is new malware. The first is http://www.virustotal.com which scans a file with 29 different antivirus products. The second is to use Kaspersky's file scanner at: (Kaspersky has a very fast virus research laboratory) http://www.kaspersky.com/scanforvirus In this case Kaspersky has to say: Scanned file: setup.exe - Infected ... setup.exe/stream/data0006 - infected by Trojan-Downloader.Win32.Zlob.bwr ... If click on the for that virus name you will see this: Malware detected 08.07.2007 17:06:51 Update released 08.07.2007 18:45:05 As you can see this new malware was released today. Virustotal has this to say: (I have included only the detections) Complete scanning result of "setup.exe", received in VirusTotal at 07.08.2007, 19:51:51 (CET). Kaspersky 4.0.2.24 07.08.2007 Trojan-Downloader.Win32.Zlob.bwr Microsoft 1.2704 07.08.2007 TrojanDownloader:Win32/Zlob Norman 5.80.02 07.06.2007 DNSChanger.gen10 Sophos 4.19.0 07.06.2007 Mal/Zlob-A Four Antivirus products detect it as malware at this time. Now I would like to address your customer's statements: "The software you have quoted contains no malware. Video Active-X Object was created to: 1. Protect adult content from children" I find this statement ridiculous. There is no provision to protect children on the zlob installer (setup.exe), nor is there any warning of adult content on the sites that direct surfers to install the zlob 'video codec'. For example: hxxp://www.adultvideosportal.com/ (porn, no warning) Another example: hxxp://www.onlyfreepornvideos.com/ (porn, no warning) They can say that they don't control these websites but it doesnt matter because all of this is purely a scam and fraud. "2. Protect video content from unauthorized views Video Active-X Objects" This is a false statement. Most of the time, there is no actual porn videos to see on these sites once you install the zlob 'video codec'. When I installed the zlob 'video codec' and then attempted to view a video all I got was a blank video. I tried this on numerous zlob 'video' sites. Proof: http://img2.freeimagehosting.net/uploads/5d2fa74ecd.jpg "includes EULA on the very first page of its install wizzard and install process can be canceled at any time." Just because it has a EULA, doesnt mean it is good. The presence of the EULA is only to fool people into thinking this is legitimate software. The Accept box is also pre-checked. "The software can not be defined as virus. We have checked it with Symantec Norton AV and McAfee AV and no problems were found." I addressed this at the beggining of this message. "Futhermore, Video Active-X Object has never been distributed through any security exploits or used in unfair tactics." Security exploits are not used for the most part, there is a more reliable method of infecting a users machine. It is called 'Social Engineering'. Unfair tactics: Portraying the product as a Video codec or object is wrong, when no actual codec or video object is installed. Upon installing the 'video object', there is still no video to be seen. If hijacking your computer with fake security software, fake security toolbar, fake security popups is a 'video activex object', then I must not understand english. Here are some screenshots of what this 'video activex object' does to your computer. Hijacks your homepage and gives a fake security warning: http://img2.freeimagehosting.net/uploads/06ff74994a.jpg Fake Protection Center made to look like the legitimate one: http://img2.freeimagehosting.net/uploads/44105aae18.jpg Installs a rogue security software which goads you into purchasing it by displaying that it found threats. (notice that the software itself shows Video Activex Access as malware, ironic) The whole goal of this is to get you to spend money and buy one of their fake security products. http://img2.freeimagehosting.net/uploads/e9cdf41218.jpg Uses scare tactics on your IE homepage to get you to install another fake security product. http://img2.freeimagehosting.net/uploads/711b5db3b0.jpg Attempting to uninstall these things manually from the control panel is an exercise in futility. After numerous reboots, my system tray was still hijacked and a malicious process was still running. Most normal people would not even know what to uninstall from the control panel. This malware adds 5 different things to that list, some of which do nothing when you try to uninstall them. This is the relavant parts of my hijackthis log after many reboots and attempting to uninstall. O2 - BHO: (no name) - {184746EC-9E9D-4C7D-B9E7-9039EBD801A9} - C:\Program Files\Video ActiveX Access\iesplg.dll O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video ActiveX Access\iesmn.exe O22 - SharedTaskScheduler: biocomputing - {98ca7898-6029-41ab-8f67-ea4f5e1afc22} - C:\WINDOWS\system32\myqlejy.dll System tray still hijacked: http://img2.freeimagehosting.net/uploads/fb04ca3a8e.jpg I hope this is enough explanation and proof to show how "Video activex object" (zlob) is malicious. Nothing good comes from these people, their only thought is how to make money in fraudulent ways and to escape the detection of those opposed to malware and law enforcement. I believe you would be in your best interest to cease all business with them. Thank you for your time and attention. Regards, Mark XXXXXX Castlecops MIRT |
Posted: Tue Jul 10, 2007 2:52 am Post subject: 
Distribute your software solely from one website, that has a clear description about
/postitle193662-0-0-.html
/c55-MIRT.htmlPosted: Tue Jul 10, 2007 3:09 am Post subject: Posted: Tue Jul 10, 2007 12:44 pm Post subject: 
Posted: Tue Jul 10, 2007 6:15 pm Post subject: ReplyPosted: Wed Jul 11, 2007 12:35 am Post subject: | Code: |
|
http://www.axvideosetup.com/download.php?id=1862 http://iaxobjectdownload.com/download.php?id=4058 http://installvaxobject.com/download.php?id=4040 http://www.videoaxdownload.com/download.php?id=1303 http://getimageactivex.com/download.php?id=1103 |
| Code: |
|
http://micro-codec.com/ http://virtual-ticket.net/ http://basic-codec.com/ http://www.freerealitympegs.com http://freepornmoviesworld.net http://nmextensions.com |
| Code: |
|
http://www.onlyfreepornvideos.com/ http://todaysfreevideo.com http://free3xmovies.com http://www.adultvideosportal.com http://www.fulltimempegs.com http://www.freeimageheaven.com/ http://www.dailyxvids.com/ |
All times are GMT
