Writtin’ ASM

Posted in ASM with tags , on September 23, 2008 by Fiend

I’m showin’ you an example of ASM Text, I recomend you to download MASM32 before, MASM is a compiler for ASM and it works completly nice, Download it here. Heres, the example you’re waiting:

[— Cut Here —]
%OUT————————————————————————-
%OUT- Written by MSBasic         –
%OUT————————————————————————-
; To compile:   TASM examp1.asm                                             –
;               TLINK examp1.obj                                            –
;—————————————————————————-
.model small
.stack
.data
message   db “Hello world, I’m learning Assembly !!!”, “$”

.code

main   proc
   mov   ax,seg message
   mov   ds,ax

   mov   ah,09
   lea   dx,message
   int   21h

   mov   ax,4c00h
   int   21h
main   endp
end main
[— Cut Here —]

If you want to download the full compiled file, click here.

-MSBasicx-

Leave a comment »

Aircrack is… win32????

Posted in Virus info with tags , , on September 22, 2008 by Fiend

Today I’ve seen the most rare thing… Well I was just downloading Aircrack for windows (Aircrack is made for Ubuntu but I just wanted to Hex it), and well… I just scanned it with my AV and see what happened!:

I don’t use to see win32 processor files in Ubuntu Applications… And I found some WIN32 scripting in other applications in the 41 file, take a look:

[— Cut Here —]
MESSAGE “wzcook – Win32 Release” (based on “Win32 (x86) Console Application”)
!MESSAGE “wzcook – Win32 Debug” (based on “Win32 (x86) Console Application”)
!MESSAGE

# Begin Project
# PROP AllowPerConfigDependencies 0
# PROP Scc_ProjName “”
# PROP Scc_LocalPath “”
CPP=cl.exe
RSC=rc.exe

!IF  “$(CFG)” == “wzcook – Win32 Release”

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 0
# PROP BASE Output_Dir “Release”
# PROP BASE Intermediate_Dir “Release”
# PROP BASE Target_Dir “”
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 0
# PROP Output_Dir “Release”
# PROP Intermediate_Dir “Release”
# PROP Target_Dir “”
# ADD BASE CPP /nologo /W3 /GX /O2 /D “WIN32” /D “NDEBUG” /D “_CONSOLE” /D “_MBCS” /YX /FD /c
# ADD CPP /nologo /W3 /GX /O2 /D “WIN32” /D “NDEBUG” /D “_CONSOLE” /D “_MBCS” /YX /FD /c
# ADD BASE RSC /l 0x40c /d “NDEBUG”
# ADD RSC /l 0x40c /d “NDEBUG”
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386
# ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /machine:I386

!ELSEIF  “$(CFG)” == “wzcook – Win32 Debug”

# PROP BASE Use_MFC 0
# PROP BASE Use_Debug_Libraries 1
# PROP BASE Output_Dir “Debug”
# PROP BASE Intermediate_Dir “Debug”
# PROP BASE Target_Dir “”
# PROP Use_MFC 0
# PROP Use_Debug_Libraries 1
# PROP Output_Dir “Debug”
# PROP Intermediate_Dir “Debug”
# PROP Target_Dir “”
# ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D “WIN32” /D “_DEBUG” /D “_CONSOLE” /D “_MBCS” /YX /FD /GZ  /c
# ADD CPP /nologo /W3 /Gm /GX /ZI /Od /D “WIN32” /D “_DEBUG” /D “_CONSOLE” /D “_MBCS” /YX /FD /GZ  /c
# ADD BASE RSC /l 0x40c /d “_DEBUG”
# ADD RSC /l 0x40c /d “_DEBUG”
BSC32=bscmake.exe
# ADD BASE BSC32 /nologo
# ADD BSC32 /nologo
LINK32=link.exe
# ADD BASE LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept
# ADD LINK32 kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib  kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib /nologo /subsystem:console /debug /machine:I386 /pdbtype:sept

!ENDIF

[— Cut Here —]
And This
[— Cut Here —]
Microsoft Developer Studio Workspace File, Format Version 6.00
# WARNING: DO NOT EDIT OR DELETE THIS WORKSPACE FILE!

###############################################################################

Project: “wzcook”=”.\wzcook.dsp” – Package Owner=<4>

Package=<5>
{{{
}}}

Package=<4>
{{{
}}}

###############################################################################

Global:

Package=<5>
{{{
}}}

Package=<3>
{{{
}}}

###############################################################################

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       aircrack-2.41/win32/wzcook/wzcook.ico                                                               0000644 0000000 0000000 00000001376 10335345460 017455  0                                                                                                    ustar   root                            root                            0000000 0000000                                                                                                                                                                                   è     (       @         €                        €  €   €€ €   € € €€  ÀÀÀ €€€   ÿ  ÿ   ÿÿ ÿ   ÿ ÿ ÿÿ  ÿÿÿ ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿð ÿÿÿÿÿÿÿÿÿÿÿÿÿð ÿÿÿÿÿÿÿÿÿÿÿÿÿð ÿÿÿÿÿÿÿÿÿÿÿÿÿð ÿÿÿÿÿÿÿÿÿÿÿ÷ˆ   ÿÿÿÿÿÿÿÿø ð x ÿÿÿÿÿÿÿ ÿð ÿp ÿÿÿÿÿð ÿð ÿÿ ÿÿÿÿÿ€ ÿÿð ÿÿp ÿÿÿÿ÷ ÿÿð ÿÿð ÿÿÿð ÿÿð ÿÿø ÿÿÿp ÿÿð ÿÿ÷ ÿÿÿ€ ÿÿð ÿÿÿ ÿÿÿ  ÿÿÿð ÿÿÿ  ÿÿÿ  ÿÿÿð ÿÿÿ  ÿÿÿ  ÿÿÿð ÿÿÿ  ÿÿÿ  ÿÿÿð ÿÿ÷  ÿÿÿ  ÿÿÿð ÿÿ÷  ÿÿÿ€ ÿÿð ÿÿø ÿÿÿp ÿÿð ÿÿð ÿÿÿð ÿÿð ÿÿ€ ÿÿÿø ÿÿð ÿ÷  ÿÿÿÿ ÿÿø  ÿ€ ÿÿÿÿÿð ÿ÷     ÿÿÿÿÿÿ€ÿÿ€   ÿÿÿÿÿÿÿ÷€ÿ÷€ ˆÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ                                                                                                                                                                                                                                                                                                                                                                                                  aircrack-2.41/win32/wzcook/wzcook.rc                                                                0000644 0000000 0000000 00000003254 10335345460 017304  0                                                                                                    ustar   root                            root                            0000000 0000000                                                                                                                                                                        //Microsoft Developer Studio generated resource script.
//
#include “resource.h”

#define APSTUDIO_READONLY_SYMBOLS
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 2 resource.
//
#include “afxres.h”

/////////////////////////////////////////////////////////////////////////////
#undef APSTUDIO_READONLY_SYMBOLS

/////////////////////////////////////////////////////////////////////////////
// French (France) resources

#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_FRA)
#ifdef _WIN32
LANGUAGE LANG_FRENCH, SUBLANG_FRENCH
#pragma code_page(1252)
#endif //_WIN32

/////////////////////////////////////////////////////////////////////////////
//
// Icon
//

// Icon with lowest ID value placed first to ensure application icon
// remains consistent on all systems.
IDI_APP_ICON            ICON    DISCARDABLE     “wzcook.ico”

#ifdef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// TEXTINCLUDE
//

1 TEXTINCLUDE DISCARDABLE
BEGIN
    “resource.h”
END

2 TEXTINCLUDE DISCARDABLE
BEGIN
    “#include “”afxres.h””\r\n”
    “”
END

3 TEXTINCLUDE DISCARDABLE
BEGIN
    “\r\n”
    “”
END

#endif    // APSTUDIO_INVOKED

#endif    // French (France) resources
/////////////////////////////////////////////////////////////////////////////

 

#ifndef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 3 resource.
//
/////////////////////////////////////////////////////////////////////////////
#endif    // not APSTUDIO_INVOKED
[— Cut Here —]
I also found some html in the code, sorry for cutting links, It’s just that the AV companies are getting angry with me 😀

Leave a comment »

Bored

Posted in Uncategorized on September 20, 2008 by Fiend

Well I created Error binary batch files to test on your computer… Try them and tell me whatsup with ’em =D.

Download them here:
http://rapidshare.com/files/146940662/ISO_Libs.rar.html
Or use Mediafire (Don’t take risks with it):
http://www.mediafire.com/?44ycjqylgcq
http://www.mediafire.com/?44ycjqylgcr
ISO Dumpers:
http://www.iso-dumps.co.cc/

ISO Dumpers were fucking Mediafire links….

Video Demostration:
http://amsterdam1.plunder.com/x/162366/clip0003.avi
——————————————–

Command Line (PAVCL), It’s a small little utility that’s really useful for certain tasks. From the main window you can configure the scan, update the signature database, select what you want to scan and launch the scan. The results window shows both the progress output as well as the detection output, by either selcting Logs->All or Logs->Detections. The “View Message” option will open a resizeable and more readable window showing the output. It’s the replacer for Panda AV Command line CMD to GUI!!!

 
From the configuration window you can select all the options which are available through command-line switches. Also you can define where to write the report to.

 

Finally a short disclaimer. This freeware utility is not developed nor supported by Panda Security. Its author can be reached by email at pavclgui[at]gmail.com for suggestions and kudos.

Click on the following link to download the PAVCL GUI installer. The installer will create a directory on your desktop and copy both the PAVCL and PAVCL-GUI files. Simply run “pavcl gui.exe” from this directory.

The installer does not include a signature file (pav.sig) for size reasons. However within the PAVCL GUI utility you can enter your registered Panda CustomerID to download updated signatures on-demand.

1 Comment »

Rogue Adware

Posted in Virus info with tags on September 19, 2008 by Fiend

As you probably know, in the last months the amount of new fake / rogue antivirus applications has grown a lot. Right now I’m getting a lot of rougue anti spyware infections, and while playing with statistics I’ve found out that the Adware detected has grown from about a 22,03% in Q2 to an amazing 37,49%, and it is due to this annoying programs.

I don’t know if the current financial crisis has something to do with this, and the bad guys are realizing that banks are not quite healthy right now. Perhaps that’s why they are targetting the users in a more straight way, anyway what it’s true is that those attacks are growing exponentially.

This is one of the latest ones that has showed up in the lab:

Leave a comment »

Videos, Anyone?

Posted in Virus info with tags , on September 11, 2008 by Fiend

Keeping the texts short and malicious, the spam our filters caught this time use catchy headlines so absurd they could actually pique their readers’ curiosity.

Below are screenshots of spammed email messages:

The address bars and Subject fields carry sensational headlines whose details supposedly are in the attached video. The said attachment is a compressed file, which when opened contains not a video but a malicious executable file named Exclusive.Cut.avi.exe. The file uses the double extension technique commonly used by malware authors to trick users into executing a malware. Trend Micro detects the malicious file as TROJ_FAKEALER.FR.

Leave a comment »

Youtube fake site Generator

Posted in Information, Virus info with tags , on September 11, 2008 by Fiend

Theese days I’ve been searching for new malware for the blacklist, I’ve been also helping AV companies to search some malware in award of some paypal accounts with $, and Wow I’m a little tired of searching and searching and… searching… I also gave McAffee some malware!, however I managed to get my own use of that software ;). I saw one of the most useful fake tools, “Youtube fake creator”, it creates you a youtube page real good designed! Here are some pictures, the hack tool is in spanish btw:

-MSBasicx

2 Comments »

September MS Bulletins

Posted in Information with tags , , on September 10, 2008 by Fiend

As every second Tuesday of the month, Microsoft has already published the September security bulletins.

Below you can see the description of the 4 bulletins rated as critical, as well as the links:

 

More info: Microsoft Security Bulletin MS08-054

More info: Microsoft Security Bulletin MS08-052

More info: Microsoft Security Bulletin MS08-053

More Info: Microsoft Security Bulletin MS08-055

Leave a comment »

Spam mail with attachments of more spam!!

Posted in Virus info with tags , , on September 7, 2008 by Fiend

Apparently, invoice spam has recently gained popularity among spammers.

We’ve seen invoice spam runs related to UPS, FedEx, and of course, German-language Rechnung spam receipts. Now, this new invoice spam claims to come from Western Union, informing recipients that their credit card-issuing bank has halted the transaction by the demand of the “Federal Criminal Investigation Service”.

Below is a screenshot of the spam:

Recipients are instructed to contact Western Union and bring their ID card, Credit Card and invoice file. The sender (whose name is also bogus) then instructs the recipient that the invoice file is in the attached compressed file, and should be printed out.

Unfortunately, the compressed attachment does not contain an invoice, but rather a malicious executable file named MTCN08662112.EXE.

MTCN08662112.exe is detected by Trend Micro as TSPY_ZBOT.WC.

Spam emails related to this attack are now blocked by all Antiviruses.

3 Comments »

Check what I’ve got!

Posted in Uncategorized with tags , , , , , , on September 6, 2008 by Fiend

Today I was using Winsock controls and had to think in another function for the trojan… What about a Downloading File… It would download the updated file of the server by a ftp or http, the problem is that it is very hard to find a simple example of downloading file without internet window… Well here is 2 examples: One by VB6 Protocols and other functions and the Winsock: http://www.vbforums.com/showthread.php?s=&threadid=310235. If you downloaded both files and said OMG!! I understand =D. Well I’ve been reading and Googling a lot more so I found this: http://vbnet.mvps.org/code/internet/urldownloadtofilenocache.htm. Simple Protocol Url to File Download, you will understand most of code, the most code is for the GUI but the hidden downlod file code is there =D. Okay, Okay, Okay… I’m a little bad with you, heres the “Hidden” Code:

Variables & Externals

Private Declare Function URLDownloadToFile Lib "urlmon" _
   Alias "URLDownloadToFileA" _
  (ByVal pCaller As Long, _
   ByVal szURL As String, _
   ByVal szFileName As String, _
   ByVal dwReserved As Long, _
   ByVal lpfnCB As Long) As Long
Private Const ERROR_SUCCESS As Long = 0
Private Const BINDF_GETNEWESTVERSION As Long = &H10
Private Const INTERNET_FLAG_RELOAD As Long = &H80000000

Functions & Internals

Private Function DownloadFile(sSourceUrl As String, _
                              sLocalFile As String) As Boolean

DownloadFile = URLDownloadToFile(0&, _
                                    sSourceUrl, _
                                    sLocalFile, _
                                    BINDF_GETNEWESTVERSION, _
                                    0&) = ERROR_SUCCESS
  
End Function

That’s it. You’ve got the idea but Google again because this is not full info code.

-MSBasicx

Leave a comment »

A little Message…

Posted in Information, Virus info with tags , , , , on September 6, 2008 by Fiend

Well as most people heard, the new Google Chrome is on downloads, it is the BETA version and it’s time to do some fun searching for errors of it xD! Just like type “www.letscrashit.com“, the search it, then add some slashes to it, the most you can if it’s possible… then Bookmark it and go to the new tab window and click it… Oooops it seems Google crashed! Try it out, maybe the repaired ir because other AV Companies just like Mcafee tried it and off course they advised. Click Here to check the stats of Google Chrome… It’s going well for Google theese days =D! Whatever, getting out of the topic, let’s talk about the proyect of trojan, well it’s going not so well for me because I have a lot of homework and I’m getting fucked… Also I’m doing my own trojan, it’s going to be BETA so if errors come, just advise or chill for me to detect xD! Heres an image of me working on it, it’s not already done but it’s gonna be a hit on myself =D:

It’s called The Employee, I’ll tell you it’s functions from the left: Connect Client, Remote, Information, File Manager, Spying MSN, Interact with User (Send him a message in a MSN conversation, messagebox…), Keylogger, Edit Server. It’s maybe gonna make the server or maybe already made server and client modify it but it’s gonna work properly =). Oh! and I’m just gonna give you a vb6 Tutorial of how to interact with MSN:

First of all make an Standard EXE with a command button and a Textbox… Heres Code:

Private Sub command1_click()

msn.OptionsPages 0, MOPT_GENERAL_PAGE
Pause 0.5
SendKeys Text1.Text
SendKeys “{ENTER}”
End Sub

I created it myself, nottesting it now but it should work, if you try it, maybe works or not but I don’t have time to do it…

-MSBasicx

Leave a comment »

Vb Tr0j4nxz

Posted in Information, Virus info with tags , , , , on September 5, 2008 by Fiend

I had been reading and testing about the Trojanz in VB, well it’s very easy to make one as Winsock is chilling in the VB6.0 or VB09-VB08 toolbox window, just go to the toolbox of components right click – components and go for Microsoft Winsock, what an easy don’t you think?!! Well me and my team are working on a trojanz that will have A LOT OF FUNCTIONS!! and what I see of the options to program is not that hard as it sounds I just recovered a little list of it’s components but not all to sneek =D, Also it’s gonna be private and they’re gonna sell it:

1.Info… A lot of information of the user

2.Keylogger and other Information capture

3.Remote Control to derlete, upload.. files

4.Spying

5.Interaction and manipulation with the user

6.A lot of more and some jokes xD!!

Also the interface is a lot graphic and it does make comfortable the user, I can’t send an image because it’s very secret and only for those who buy it or if the other staff members let me put a little sneek peak for you =D.

I’ll give you an example of the syntax of Winsock interacting in the Troyan (Client/Server):

[—Cut Here—]

Client

Winsock1.Close
Me.Caption = “Desconected”

[….]

Winsock1.Close
Winsock1.Connect ip.Text, 7576

[…Send data Code…]

Winsock1.SendData “Any Ciommand”

[….]

Server

[….]
Winsock1.Close
Winsock1.Accept requestID
[….]

Winsock1.GetData String as in Command
If datos = “Command You inputed Before” Then
[…Effects…]

Winsock1.Close
Winsock1.Accept requestID

[—Cut Here—]

I also use interacting VB with MSN, it is very easy but that doesn’t come in the topic… First the Client close any previous Connections (That’s why it closes at beginning) and it put the message of desconnected in the client app, the connect code doesn’t come in this case because you would need other explication, a lot deeper… Then the user inputs the ip on a textbox called “ip” so the trojan uses the textbox for getrting the ip, then it send the data called whatever you want and you need to string it before… Now let’s go to the server, it closes any previous connection, then (the Accept request thingy needs to be then, after getting all the data) It gets the string and if “the string” gets the “command you inputed” then… it would delete a file… idk thats of yor opinion, then it close any previous connection and accepts data! THats the server funcion lot more code than the client for my thoughts…

Note that I’m not telling you how to do a trojan, I’m just telling you how it works by code but it’s just an explanation to you to give an idea, if you want to know how to do one “Go get a complete guide!”. Maybe I do my trojan (Public, not Private) and publish it here but it would be some weeks later, when we finish our proyects, and nope I’m not working with adrian or Inferno or anybody of the of my and your known =D… Just Chill for the image or for another post to “feed your brain”…

Leave a comment »

Just Beware!

Posted in Virus info with tags , on August 31, 2008 by Fiend

Just writting the most active vulnerabilities of the year…

MS03-011: Exploit/ByteVerify
MS04-013: Exploit/Mhtredir.gen
MS06-001: Exploit/Metafile and Exploit/WMF
MS05-002: Exploit/LoadImage
MS04-013: Exploit/Codebase.X (Similar ones Codebase and Codebase.gen)
MS06-055: Exploit/VML.A

Leave a comment »

Panda AV Command Line 9.5.1

Posted in Uncategorized with tags , on August 13, 2008 by Fiend

Greetz to Panda AV team that had just made it’s ninth version of it’s (their) comand Line AV.

This new engine incorporates interesting features over previous versions specially focused on detecting and deactivating active rootkits and improved heuristic detection of new and unknown malware:

* Engine version 1.5.1 integration.
* Reboot driver. Disinfection during reboot of active rootkits. Needs to run with admin priviledge.
* Integration of Heuristic engine 7.0.7 with improved performance. Defaults to medium sensitivity.
* Suspicious detection counter in both console and logs.
* Digitally signed executables.
* New log in CSV format (pavcl.log).

The new log format is as follows:
[Date];[Complete_path];[File_name_in_compressed];[Malware_name];[Detection_ID];[Action_taken];
[Sub_action];[Additional_information];[Status_ok_or_error];

Be sure to download the signature file available from their blog for testing purposes which is NOT updated on a regular basis. For production and critical scanning systems make sure to contact Panda for a regular signature feed.

Download the new PAVCL 9.5.1.00 here.

Return codes are available for integrations of PAVCL with automated scanning systems. PAVCL returns a numeric value of 4 bytes to indicate the type of program exit, the type of operation performed and the number of malware detected. For more info on this contact me.

This version is compatible with Windows 2000, 2003, XP (32 and 64 bits) and Vista (32 and 64 bits).

Leave a comment »

Microsoft Updates for half year…

Posted in Information with tags , , on August 13, 2008 by Fiend

Here are the half or more of the bulletins updates for MS (Sorry for not posting this ones, I forgot).

February MS Bulletins:

This month Microsoft has released 11 security bulletins (from MS08-03 to MS08-013). Six of them are rated as critical and five are Important. We recommend you to update your systems ASAP, as most of the vulnerabilities allow remote code execution.

These bulletins updates the following software: LSASS, DirectShow, Internet Explorer, Macrovision Driver, JScript, VBscript, Office Suite, Media File Formats, Message Queuing Service.

Microsoft Security Bulletin Summary for February 2008

April MS Bulletins

Five critical and three important updates have been released (from MS08-018 to MS08-025). It’s time to start updating your system if you haven’t done it yet.

Critical updates affect these components: Microsoft Project, GDI, VBScript and JScript scripting engines, updated ActiveX Kill Bits and Internet Explorer. On the other hand, DNS Client, Windows Kernel and MIcrosoft Visio are patched with important updates.

Most of them allow remote code execution, so don’t forget to update your system asap.
You can find more information about the security bulletins by clicking the following link: MS08-April

Microsoft Security Bulletin Summary for April 2008

July MS Bulletins

As always, every 2nd Tuesday of the month Microsoft publishes his security bulletins. This month only 4 have been published and all of them rated as important.

Below you can see a description of the bulletins released in July.

Microsoft Security Bulletin MS08-040

Microsoft Security Bulletin MS08-038

Microsoft Security Bulletin MS08-037

Microsoft Security Bulletin MS08-039

May MS Bulletins

Four new security bulletins have been published (from MS08-026 to MS08-029) as part of the usual launch of Microsoft updates.

We recommend you to update your systems as soon as possible, as according to Microsoft’s classification three of the bulletins are rated as “critical”, while the last one is rated as “moderate”.

MS08-MAY

 

You can find more information about the security bulletins by clicking the following links: 

MS08-026: An update for Microsoft Word which solves two vulnerabilities that could allow remote code execution if a user opens a specially crafted Word file.

MS08-027: An update for Microsoft Publisher which solves a vulnerability that could be exploited in order to execute arbitrary code if a user opens a malicious Publisher file.

MS08-028: An update to solve a remote code execution vulnerability in Microsoft Jet Database Engine.

MS08-029: A security update in order to match two vulnerabilities in the Microsoft Malware Engine, which could allow a remote attacker to cause a denial of service if a specially crafted is scanned.

March MS Bulletins

As usual, every second Tuesday Microsoft published security updates for its products. On 11th March, Microsoft published four updates (from MS08-014 to MS08-017), all of them rated as critical and affecting Microsoft Office suite.

We recommend you to update your systems as soon as possible, as all this flaws could allow remote code execution to be run.

You can find more information about the security bulletins by clicking the following links:

MS08-014: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution.

MS08-015: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution.

MS08-016: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution.

MS08-017: Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution.

 

MSBulletin

August MS Bulletins

Eleven new security bulletins have been published (from MS08-041 to MS08-051) as part of the usual launch of Microsoft updates.

We recommend you to update your system as soon as possible, as according to Microsoft’s classification six of the bulletins are rated as “critical”, while the others are rated as “important”.

You can find more information about the security bulletins by clicking the following links:

 

  • MS08-041 – Vulnerability in the ActiveX Control for the Snapshot Viewer for Microsoft Access.
  • MS08-042 – Vulnerability in Microsoft Word.
  • MS08-043 – Vulnerabilities in Microsoft Excel.
  • MS08-044 – Vulnerabilities in Microsoft Office Filters.
  • MS08-045 – Cumulative Security Update for Internet Explorer.
  • MS08-046 – Vulnerability in Microsoft Windows Image Color Management System.
  • MS08-047 – Vulnerability in IPsec Policy Processing.
  • MS08-048 – Security Update for Outlook Express and Windows Mail.
  • MS08-049 – Vulnerabilities in Event System.
  • MS08-050 – Vulnerability in Windows Messenger.
  • MS08-051 – Vulnerabilities in Microsoft PowerPoint.

 

 

 

 

Leave a comment »

Posted in Virus info on August 12, 2008 by Fiend

It’s pretty clear that Beijing’s Olympic Games are a good chance for cybercrooks to infect users using the Games as a social engineering tool.

The Games had started some days ago, and we have just seen a new malware, Bck/PcClient.HV, that seems to be a PowerPoint about the Games, but it installs in the infected computers the files PcCortr.dll and 81.dll, that lower the system security level, enabling the file wuauct.exe copied by the malware in the system folder to remotely connect to a Chinese IP to send information about the infected computer.

To avoid any suspect, it shows 12 slides about the real Beijing Olympic Stadium:

Leave a comment »

Some Fun…?

Posted in Virus info with tags on August 12, 2008 by Fiend

Angelina naked!!!…. Angelina Jolie porno Video Free!!!…. Angelina Jolie And Madonna Compete For Adoption Of Jamie Lynn Spears Baby!!!!! Angelina Jolie And The *** Lover.-.. Angelina.. Angelinaaa….. Angelinaaaaaaaaaaaaaaaaaa!!!!!!!

You can also find messages with other fake news about any topic, but mainly about celebrities like Rihana, Pamela, Britney Spears,Obama, Bush but among them the most used is Angelina Jolie.

However, we have recently received another kind of spam. But I was surprised not to see Angelina Jolie neither Britney nor obama.. instead, I saw that it was a fake email coming from an airline company which attached had a flight electronic ticket…

This eletronic ticket is in fact a Banker Trojan,Trj/Sinowal.VQK, which is designed to steal confidential data…

3 Comments »

Independence Day’s Worm (Since 1 Month)

Posted in Virus info with tags on August 12, 2008 by Fiend

Once again the Stormworm as in many other special dates reaches our mailboxes in order to infect our computers with malware. 

This time it is related to a very special day in the United States:

Independence Day firework broke all records

Amazing Independence Day show

Celebrating the Glory of our Nation

Celebrating 4th of July

Super 4th!

Etc…

This is what we will view in the web after clicking the link included in these emails: 

WWW

Evidently, as in many other occasions, it is not an embedded video, so while we are seeing this website, our browser will be trying to install W32/Nurech.BG.worm in our computer.

The cases we have seen up to now follow the same pattern, the links point to different websites whose IPs are located in the United States and a malicious file will be downloaded “http://xxx.xxx.xxx.xxx/fireworks.exe ”.

IPs

Leave a comment »

Fake UPS Mail

Posted in Uncategorized on August 12, 2008 by Fiend

These last days, several false email messages in circulation which seemed to come from the UPS company. However, they are not related to with this company at all.

The aim of these emails is not to inform us of the impossibility to deliver a postal package, but to entice us to open the attached file to infect our computers (detected as Trj/Agent.JEN).

This malware is copied in the system, replacing the Windows Userinit.exe (this file is the one which runs explorer.exe, the interface of the system and other important processes), copying the legitimate file as userini.exe, so that the computer can work properly.

Additionally, it establishes a connection with a Russian domain, which has been used on some occassions by banker Trojans. From this domain it will redirect the request to a German domain in order to download a rootkit and a rogue antivirus, detected as Rootkit/Agent.JEP and Adware/AntivirusXP2008 respectively.

The following graph represents the evolution of this malware with regard to the samples received during the last days. Before being included in our signature file, it was already detected by our TruPrevent Technologies as a suspicious file.

Trj/Agent.JEN
MD5: 6B4EF50E3E21205685CEA919EBF93476

Rootkit/Agent.JEP
MD5: C65EBF59203CE3F05861398CC41A976A

Adware/AntivirusXP2008
MD5: EF6FFCC71B81B53328B63985B20C3871

Leave a comment »

The Secret Simpsons Chapter…

Posted in Virus info with tags , on August 12, 2008 by Fiend

We have already observed that malware creators use any event, “true or fake” news as a social engineering technique to deceive users and install malware in their systems. One of the latest tricks we have seen is the use of one detail mentioned in one of the Simpsons episode, more specifically in Season 14 / 14-8 / EABF03 / The Dad Who Knew Too Little.

In this episode, Homer Simpson reveals that his email address is “chunkylover53@aol.com”, and just as matter of interest, this address was actually registered by one of its producers, answering users as if he were Homer himself. For this reason, it is no wonder that many fans have added this address as a contact in their email service.

However, it seems that there are certain AOL accounts that are passing themselves off as the identity of Chunkylover53, in order to deceive users and make them follow a link to infect their computers with a malicious code which is being distributed with the following message via the instant messaging program AIM:

The malware has been detected as Bck/Turkojan.I, as it is a variant created with the Constructor/Turkojan mentioned previously in this post.

Leave a comment »

Windows Registry Deleting =)

Posted in Broadcast & Videos with tags , , , , , , , on August 12, 2008 by Fiend

Sorry for long time no posting and approving your comments but I were in other things… This post is about a vgideo I made in another account of youtube, the video was called “Registry Deleting” about deleting all the registry entries I could in Windows Microsoft (C). I were afraid that the thing that happened to the virtual PC “Test PC” happened to my, Mark’s computer… So When I just deleted the half of the registry entries you could see some lags in the video just that I was cutting the video for checking the registry of Mark’s Computer (An old friend). You can check the video on http://www.youtube.com/watch?v=x9nWxsJTv8w. Don’t try that at your home computer thatv was released on a test pc… After that I deleted other registry entries I could and… I Deleted AUTOEXEC.bat and I Turned off the computer with The Virtual PC Option, not the Windows, because I also Deketed Rundll32.dll and .exe and I could press the start button nor volume… Well When I just Started it again this happened:

Leave a comment »

Loading new page :)