  StraitShoot Who Loves Ya Baby? - Theo Kojak Premium join:2003-02-08 Clinton, MA
1 edit | Is there a new Zhelatin Trojan out there?
Here are the results from Jotti...
The body of the email...
I deleted the link that takes you to a website that looks like a Windows Media Player box
Hi. Mate has sent you a greeting ecard. See your card as often as you wish during the next 15 days.
SEEING YOUR CARD
If your email software creates links to Web pages, click on your card's direct www address below while you are connected to the Internet:
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Or copy and paste it into your browser's "Location" box (where Internet addresses go).
We hope you enjoy your awesome card.
Wishing you the best, Mail Delivery System, Hallmark.Com |
|
  Jean Luc
@telstra.net | Doh! AVAST found nothing?
You should have stayed with KAV. |
|
  tempnexus Premium join:1999-08-11 Boston, MA | NO AV software works 100%. If you want 97% protection then you have to run ALL OF THE AV SOFTWARE PRESENT in JOTTI Or VIRUSTOTAL. At which point you might consider being infected as a more productive alternative. |
|
 kpatz MY HEAD A SPLODE Premium join:2003-06-13 Manchester, NH
| reply to StraitShoot The trojans are constantly updated to evade virus scanners, especially since they're hosted on "websites" rather than attached to the emails. It makes it easy for the scum of the universe to keep ahead of the anti-malwares.
Which is why I filter out all fake "greeting card" emails... -- Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK. |
|
 MagnusM Premium join:2001-07-07
| reply to StraitShoot Yup, lots of new variants of Zhelatin out recently. The latest versions even patch the standard Windows tcpip.sys driver file to load their own driver, making them very difficult (or even impossible) to detect using standard autostart viewers.
See my most recent analysis here for further details (including a manual cleaning guide for any Google users who happen to stumble upon this post): »blog.misec.net/2007/08/01/new-zh···-driver/ -- Mischel Internet Security http://www.misec.net |
|
  StraitShoot Who Loves Ya Baby? - Theo Kojak Premium join:2003-02-08 Clinton, MA
| reply to Jean Luc said by Jean Luc :
Doh! AVAST found nothing?
You should have stayed with KAV. DOH! A trojan is EASIER TO REMOVE than Kaspersky!
Besides, Avast does detect it today! -- Don't Forever Alter Your Computer! Don't Install or Use Anything with Kaspersky or AOL, including AOL Active Virus Shield!
|
|
  StraitShoot Who Loves Ya Baby? - Theo Kojak Premium join:2003-02-08 Clinton, MA
| reply to StraitShoot I guess there is another new variant out there. Kaspersky DOESN"T DETECT THIS DOH!
I just got an email, same as before but different writing...
Jim -- Don't Forever Alter Your Computer! Don't Install or Use Anything with Kaspersky or AOL, including AOL Active Virus Shield!
|
|
 redwolfe_98
join:2001-06-11
·RoadRunner Cable
2 edits | reply to StraitShoot i always download those "ecard.exe" files and upload them to "virustotal", to see if there are new variants.. i have seen a few new ones, but even they seem "old", now, with virtually all av vendors flagging them..
update: i just got a new variant.. i uploaded it to virustotal and submitted it to kaspersky and mcafee (i didn't need to submit it to everyone, and i will leave it to some to get the file by some other means, like from virustotal, if nothing else).. |
|
  StraitShoot Who Loves Ya Baby? - Theo Kojak Premium join:2003-02-08 Clinton, MA | reply to StraitShoot Avast now detects it.. LOL |
|
  EGeezer Go Bobcats Premium join:2002-08-04 Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage
1 edit | reply to StraitShoot There seem to be several variants of Zhelatin/Storm popping up, hopscotching AV detections. They're quite successful it seems - See this Information Week story which link is also posted here by daveinpoway 
said by IW Sharon Gaudin article :
As the Storm worm grows into a prolonged online siege 10 times larger than any other e-mail attack in the last two years -- amassing a botnet of nearly 2 million computers -- researchers worry about the damage hackers could wreak if they unleash a denial-of-service attack with it.
Between July 16 and Aug. 1, researchers at software security firm Postini have recorded 415 million spam e-mails luring users to malicious Web sites, according to Adam Swidler, a senior manager with Postini. Before the Storm worm began its attack, an average day sees about 1 million virus-laden e-mails crossing the Internet. On July 19, Postini recorded 48.6 million and on July 24, researchers tracked 46.2 million malicious messages -- more than 99% of them are from the Storm worm.
Researchers at SecureWorks are seeing similar staggering numbers, as well. Joe Stewart, a senior security researcher at SecureWorks, noted that the number of zombie computers that the Storm worm authors have amassed as skyrocketed in the past month. From the first of January to the end of May, the security company noted that there were 2,815 bots launching the attacks. By the end of July, that number had leapt (to)of 1.7 million.
As easy as this email is to spot, people are still falling for it. Folks who advocate security tools, configurations and applications as the silver bullet need to consider whether or not they have users on their network who are susceptible to social engineering. -- Sive enim ad sapientiam perveniri potest, non paranda nobis solum ea, sed fruenda etiam est |
|
 kpatz MY HEAD A SPLODE Premium join:2003-06-13 Manchester, NH
| said by EGeezer :Folks who advocate security tools, configurations and applications as the silver bullet need to consider whether or not they have users on their network who are susceptible to social engineering. Perhaps social engineering could work for us good guys too. We just need to convince everyone in the world that opening greeting card emails will cause your (select body part based on gender) to fall off.  -- Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK. |
|
  EGeezer Go Bobcats Premium join:2002-08-04 Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage
| said by kpatz :We just need to convince everyone in the world that opening greeting card emails will cause your (select body part based on gender) to fall off. You mean it WON'T really fall off if I open one of those???  -- Sive enim ad sapientiam perveniri potest, non paranda nobis solum ea, sed fruenda etiam est |
|