🚀 go-pugleaf

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:3e-dnV4iuIbifMLUnZ2dnUVZ_jqdnZ2d@giganews.com: 

> From: "Doc" <docsavage20@yahoo.com>
> 
>| There's a website for a couple of famous jazz trumpeters, the late
>| Candoli brothers.
> 
>| h**p://www.candoli.com
> 
>| It's a legitimate site, these guys were icons. There's a photo in
>| their gallery of Pete playing wearing a Superman suit. I posted the
>| direct link to it in a trumpet forum.
> 
>| h**p://www.candoli.com/pic28.htm
> 
>| Several people reported that clicking the link brought up that
>| Antivirus 2009 malware bogus alert. I tried it and got the same
>| thing.
> 
>| How does that Antivirus 2009 page hijack attempts to go to other
>| sites like that? How does it get attached to certain ones?
> 
>| How is it these people haven't been shut down?
> 
> The site was hacked and is now compramised.  It takes you to a
> malicious site 78.110.175.21
> 
> http://isc.sans.org/diary.html?storyid=5440
> 
> The malicous site will test the PC for vulneranilities in Adobe Flash,
> Adobe Reader and MDAC.
> 
> Successful exploitation will yield a EXE file.
> 
> http://www.virustotal.com/analisis/e8a650fafef32407bb729fdc63f44f78
> 
> Prevx1 V2 2009.01.03 Information Stealer
> Sophos 4.37.0 2009.01.03 Troj/Daonol-Fam
> TrendMicro 8.700.0.1004 2009.01.02 PAK_Generic.001
> 
> Which will drop; %windir%\system32\wdmaud.sys

Someone sent us 4 copies of this, all different. It's quite the morphing 
little turd.
 
> All you can do it was what you did, contact the site owner to get the
> site fixed. 

Yep.


-- 
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org