January « 2008 « Anti Rootkit Blog

Archive for January, 2008

A Stormy Valentines Day ahead of us…

Tuesday, January 15th, 2008

It looks like the Storm Worm is with us once again.

Emails have been spammed out with aÂ Subject Line that contains one of the following,

Falling In Love with You
Special Romance
You’re In My Thoughts
Sent with Love
Our Love Will Last
Our Love is Strong
Your Love Has Opened
You’re the One
A Toast My Love
Heavenly Love

If a user clicks on the link in the email then they are brought to a website thatÂ gets unsuspecting users to download their Love ecard. If run, the “ecard” will turn the usersÂ PC into a bot. The PC will then join the many others in the Storm WormÂ Botnet.

It seems a bit early for Valentines Day though! Maybe the authors mistakenly released it?

If not, then weÂ could beÂ in for a long run in to Valentines Day.

Keep Safe

Steo – www.antirootkit.com

Posted in Analysis, Debate, E-Cards, News, Other Malware, Storm Worm | Comments Off

Anti Rootkit Software Scanners for Vista

Friday, January 11th, 2008

We are often asked what Anti Rootkit Scanners are available for Windows Vista. There are currently only 7, out of the 20 or so scanners available, that will work with Vista. These scanners will also only work with 32 Bit versions of Vista.

Here is a list of the 7 in alphabetical order. Please click on the scanner name or screenshotÂ to bring you to a more detailed page where you can download the software.

F-Secure Blacklight

GMER

Icesword

Rootkit Hook Analyser

Rootkit Revealer

Rootkit Unhooker

Unhackme

Keep Safe,

Steo – www.antirootkit.com

Posted in Analysis, Blacklight, Debate, GMER, Icesword, News, Rootkit Hook Analyser, Rootkit Revealer, Rootkit Scanners, Rootkit Unhooker, Unhackme, Vista | 7 Comments »

Security Flaw in Vista and XP – Rootkit exploit in the wild

Thursday, January 3rd, 2008

In early DevemberÂ 2007 a new rootkit that hides itself in the Master Boot Record (MBR) of a users disk was spotted in the wild. Up until then this was more of a proof of concept (POC).

This goes to show how much effort rootkit authors are putting in to creating new ways of evading Anti Rootkit software. This is a new vector of attack for malware writers and gives them control from outside the Operating System.

This rootkit is usingÂ the MBRÂ flaw. The MBR can be written to from within Windows.

The rootkit installs itself ( 244K ) on the last sectors of the users disk and then modifies other sectors including sector 0. The code is run before your PC boots up into XP, Vista or NT and has full control of the boot process which means it can install and run any application it wants without you, XP, Vista or NT knowing about it.

GMER has written an excellent write up on the MBR Rootkit and goes into more depth on the issue.

Indeed GMER’s Anti Rootkit Software can find the rootkit.

The rootkit files cannot be removed from within XP, Vista or NT and must be removed without the PCÂ runningÂ the rootkit code.

Until the MBR Security flaw within the NT code is fixed then we will all be soon riddled with MBR Rootkits.

Keep Safe,

regards,

Steo – www.antirootkit.com

Posted in Analysis, Debate, GMER, MBR Rootkit, Master Boot Record Rootkit, Microsoft, NT, New Rootkits, News, Other Malware, Rootkit Scanners, Underground, Vista, XP | 11 Comments »

New Storm Worm Rootkit Domain happy2008toyou.com appears on the stroke of Midnight

Tuesday, January 1st, 2008

Another Storm Worm domain as popped up on the radar,

happy2008toyou.com

The whois…

Domain name:Â Â Â Â Â Â Â Â Â Â Â Â HAPPY2008TOYOU.COM
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns.happy2008toyou.com 68.251.106.142
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns10.happy2008toyou.com 89.35.121.187
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns11.happy2008toyou.com 58.9.65.61
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns12.happy2008toyou.com 222.209.139.28
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns13.happy2008toyou.com 82.59.136.43
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns2.happy2008toyou.com 68.36.252.81
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns3.happy2008toyou.com 71.230.66.163
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns4.happy2008toyou.com 68.61.185.117
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns5.happy2008toyou.com 70.232.142.1
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns6.happy2008toyou.com 66.75.86.71
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns7.happy2008toyou.com 85.29.202.180
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns8.happy2008toyou.com 86.139.75.35
Name Server:Â Â Â Â Â Â Â Â Â Â Â Â ns9.happy2008toyou.com 86.130.251.39
Creation Date:Â Â Â Â Â Â Â Â Â Â 2007.12.29
Updated Date:Â Â Â Â Â Â Â Â Â Â Â 2007.12.29
Expiration Date:Â Â Â Â Â Â Â Â 2008.12.29
Status:Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â DELEGATED
Registrant ID:Â Â Â Â Â Â Â Â Â Â X05O1TC-RU
Registrant Name:Â Â Â Â Â Â Â Â Larry Claus
Registrant Organization: Larry Claus
Registrant Street1:Â Â Â Â Â 1874 str.Â office 923
Registrant City:Â Â Â Â Â Â Â Â Los-Angeles
Registrant State:Â Â Â Â Â Â Â CA
Registrant Postal Code:Â 320784
Registrant Country:Â Â Â Â Â US
AdministrativeÂ Technical Contact
Contact ID:Â Â Â Â Â Â Â Â Â Â Â Â Â X05O1TC-RU
Contact Name:Â Â Â Â Â Â Â Â Â Â Â Larry Claus
Contact Organization:Â Â Â Larry Claus
Contact Street1:Â Â Â Â Â Â Â Â 1874 str.Â office 923
Contact City:Â Â Â Â Â Â Â Â Â Â Â Los-Angeles
Contact State:Â Â Â Â Â Â Â Â Â Â CA
Contact Postal Code:Â Â Â Â 320784
Contact Country:Â Â Â Â Â Â Â Â US
Contact Phone:Â Â Â Â Â Â Â Â Â Â 1 320 5216723
Contact E-mail:Â Â Â Â Â Â Â Â Â larryknower931@yahoo.com

Registrar:Â Â Â Â Â Â Â Â Â Â Â Â Â Â ANO Regional Network Information Center dba RU-CENTER
Last updated on 2008.01.01 03: 36: 27 MSK/MSD

The full list of domains we currently have is:

familypostcards2008.com
freshcards2008.com
happy2008toyou.com
happycards2008.com
happysantacards.com
hellosanta2008.com
hohoho2008.com
newyearcards2008.com
newyearwithlove.com
parentscards.com
postcards-2008.com
Santapcards.com
Santawishes2008.com

The filename downloaded is happy_2008.exe

Most Virus Scanners find it,

Have a happy New Year,

Keep Safe,

regards,

Steo

Posted in Analysis, E-Cards, McAfee, Microsoft, New Rootkits, News, Nuwar, Other Malware, Rootkit Scanners, Rootkit Unhooker, Storm Worm, peacomm, wincom32 | 2 Comments »

Anti Rootkit Blog

Archive for January, 2008

A Stormy Valentines Day ahead of us…

Anti Rootkit Software Scanners for Vista

Security Flaw in Vista and XP – Rootkit exploit in the wild

New Storm Worm Rootkit Domain happy2008toyou.com appears on the stroke of Midnight

Pages

Archives

Categories