Search:  

 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » Is there a new Zhelatin Trojan out there?
Search Topic:
Uniqs:
934
Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
No more AOL ACTIVE VIRUS SHIELD..... Now what? »
« Is Ad-ware bad?  
AuthorAll Replies


StraitShoot
Who Loves Ya Baby? - Theo Kojak
Premium
join:2003-02-08
Clinton, MA


1 edit
Is there a new Zhelatin Trojan out there?

Click for full size
Here are the results from Jotti...

The body of the email...

I deleted the link that takes you to a website that looks like a Windows Media Player box

Hi. Mate has sent you a greeting ecard.
See your card as often as you wish during the next 15 days.

SEEING YOUR CARD

If your email software creates links to Web pages, click on your
card's direct www address below while you are connected to the Internet:

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Or copy and paste it into your browser's "Location" box (where Internet
addresses go).

We hope you enjoy your awesome card.

Wishing you the best,
Mail Delivery System,
Hallmark.Com


Jean Luc

@telstra.net
Doh! AVAST found nothing?

You should have stayed with KAV.


tempnexus
Premium
join:1999-08-11
Boston, MA
NO AV software works 100%. If you want 97% protection then you have to run ALL OF THE AV SOFTWARE PRESENT in JOTTI Or VIRUSTOTAL. At which point you might consider being infected as a more productive alternative.

kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH

reply to StraitShoot
The trojans are constantly updated to evade virus scanners, especially since they're hosted on "websites" rather than attached to the emails. It makes it easy for the scum of the universe to keep ahead of the anti-malwares.

Which is why I filter out all fake "greeting card" emails...
--
Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK.

MagnusM
Premium
join:2001-07-07

reply to StraitShoot
Yup, lots of new variants of Zhelatin out recently. The latest versions even patch the standard Windows tcpip.sys driver file to load their own driver, making them very difficult (or even impossible) to detect using standard autostart viewers.

See my most recent analysis here for further details (including a manual cleaning guide for any Google users who happen to stumble upon this post): »blog.misec.net/2007/08/01/new-zh···-driver/
--
Mischel Internet Security
http://www.misec.net


StraitShoot
Who Loves Ya Baby? - Theo Kojak
Premium
join:2003-02-08
Clinton, MA

reply to Jean Luc
said by Jean Luc :

Doh! AVAST found nothing?

You should have stayed with KAV.
DOH! A trojan is EASIER TO REMOVE than Kaspersky!

Besides, Avast does detect it today!
--
Don't Forever Alter Your Computer! Don't Install or Use Anything with Kaspersky or AOL, including AOL Active Virus Shield!



StraitShoot
Who Loves Ya Baby? - Theo Kojak
Premium
join:2003-02-08
Clinton, MA

reply to StraitShoot
Click for full size
I guess there is another new variant out there. Kaspersky DOESN"T DETECT THIS DOH!

I just got an email, same as before but different writing...

Jim
--
Don't Forever Alter Your Computer! Don't Install or Use Anything with Kaspersky or AOL, including AOL Active Virus Shield!


redwolfe_98

join:2001-06-11
·RoadRunner Cable


2 edits
reply to StraitShoot
i always download those "ecard.exe" files and upload them to "virustotal", to see if there are new variants.. i have seen a few new ones, but even they seem "old", now, with virtually all av vendors flagging them..

update: i just got a new variant.. i uploaded it to virustotal and submitted it to kaspersky and mcafee (i didn't need to submit it to everyone, and i will leave it to some to get the file by some other means, like from virustotal, if nothing else)..


StraitShoot
Who Loves Ya Baby? - Theo Kojak
Premium
join:2003-02-08
Clinton, MA
reply to StraitShoot
Avast now detects it.. LOL


EGeezer
Go Bobcats
Premium
join:2002-08-04
Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage


1 edit
reply to StraitShoot
There seem to be several variants of Zhelatin/Storm popping up, hopscotching AV detections. They're quite successful it seems - See this Information Week story which link is also posted here by daveinpoway See Profile

said by IW Sharon Gaudin article :

As the Storm worm grows into a prolonged online siege 10 times larger than any other e-mail attack in the last two years -- amassing a botnet of nearly 2 million computers -- researchers worry about the damage hackers could wreak if they unleash a denial-of-service attack with it.

Between July 16 and Aug. 1, researchers at software security firm Postini have recorded 415 million spam e-mails luring users to malicious Web sites, according to Adam Swidler, a senior manager with Postini. Before the Storm worm began its attack, an average day sees about 1 million virus-laden e-mails crossing the Internet. On July 19, Postini recorded 48.6 million and on July 24, researchers tracked 46.2 million malicious messages -- more than 99% of them are from the Storm worm.

Researchers at SecureWorks are seeing similar staggering numbers, as well. Joe Stewart, a senior security researcher at SecureWorks, noted that the number of zombie computers that the Storm worm authors have amassed as skyrocketed in the past month. From the first of January to the end of May, the security company noted that there were 2,815 bots launching the attacks. By the end of July, that number had leapt (to)of 1.7 million.
As easy as this email is to spot, people are still falling for it. Folks who advocate security tools, configurations and applications as the silver bullet need to consider whether or not they have users on their network who are susceptible to social engineering.
--
Sive enim ad sapientiam perveniri potest, non paranda nobis solum ea, sed fruenda etiam est

kpatz
MY HEAD A SPLODE
Premium
join:2003-06-13
Manchester, NH

said by EGeezer See Profile :

Folks who advocate security tools, configurations and applications as the silver bullet need to consider whether or not they have users on their network who are susceptible to social engineering.
Perhaps social engineering could work for us good guys too. We just need to convince everyone in the world that opening greeting card emails will cause your (select body part based on gender) to fall off.
--
Windows Vista has detected that your mouse was moved. In order to enhance your user experience, Vista needs to contact Microsoft to re-activate the software. Please make sure you are connected to the Internet, have your credit card handy, then click OK.


EGeezer
Go Bobcats
Premium
join:2002-08-04
Country!
·Callcentric
·RoadRunner Cable
·AT&T CallVantage

said by kpatz See Profile :

We just need to convince everyone in the world that opening greeting card emails will cause your (select body part based on gender) to fall off.
You mean it WON'T really fall off if I open one of those???
--
Sive enim ad sapientiam perveniri potest, non paranda nobis solum ea, sed fruenda etiam est
Forums » Up and Running » Security » SecurityNo more AOL ACTIVE VIRUS SHIELD..... Now what? »
« Is Ad-ware bad?  


Wednesday, 02-Dec 13:54:28 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [159] Comcast Releasing Promised Usage Meter
· [74] Latest Consumer Reports Survey Not Kind To AT&T
· [69] Baltimore To Ban Lazy Cable Installs
· [63] Graduate Student Unveils Sprint's GPS Sharing With Feds
· [60] Broadband Killed The Game Console
· [54] Rogers Unveils The ISP Dream Model
· [46] ACTA: Global Three Strikes
· [41] Rural Carriers Quickly Embracing Fiber
· [36] Charter Exits Chapter 11
· [33] AT&T Top Lobbyist Cicconi Has His Feelings Hurt
Most people now reading
· MS admits Windows Updates principally created to annoy [Security]
· Am I the only one that loves to work in IT? [No, I Will Not Fix Your #@$!! Computer]
· Data Usage Meter Launched [Comcast HSI]
· IMG 1.7 (IMG Updates and Discussion) [Verizon FIOS TV]
· LFM Overkill [World of Warcraft]
· DK Weapon Upgrade [World of Warcraft]
· [Newsgroups] Newzleech down? [Filesharing Software]
· A little freaky, not sure if its legit. [Spam, Scam and Phishbusters]
· UBB round 2 at the CRTC [Canadian Broadband]
· Quality/longevity of 15A 120V receptacles [Home Repair & Improvement]