Article View: microsoft.public.security
Article #20Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?
From: David H. Lipman
Date: Sat, 03 Jan 2009 22:06
Date: Sat, 03 Jan 2009 22:06
48 lines
3358 bytes
3358 bytes
From: "Doc" <docsavage20@yahoo.com>
| There's a website for a couple of famous jazz trumpeters, the late
| Candoli brothers.
| h**p://www.candoli.com
| It's a legitimate site, these guys were icons. There's a photo in
| their gallery of Pete playing wearing a Superman suit. I posted the
| direct link to it in a trumpet forum.
| h**p://www.candoli.com/pic28.htm
| Several people reported that clicking the link brought up that
| Antivirus 2009 malware bogus alert. I tried it and got the same
| thing.
| How does that Antivirus 2009 page hijack attempts to go to other sites
| like that? How does it get attached to certain ones?
| How is it these people haven't been shut down?
The site was hacked and is now compramised. It takes you to a malicious site
78.110.175.21
http://isc.sans.org/diary.html?storyid=5440
The malicous site will test the PC for vulneranilities in Adobe Flash, Adobe Reader and
MDAC.
Successful exploitation will yield a EXE file.
http://www.virustotal.com/analisis/e8a650fafef32407bb729fdc63f44f78
Prevx1 V2 2009.01.03 Information Stealer
Sophos 4.37.0 2009.01.03 Troj/Daonol-Fam
TrendMicro 8.700.0.1004 2009.01.02 PAK_Generic.001
Which will drop; %windir%\system32\wdmaud.sys
All you can do it was what you did, contact the site owner to get the site fixed.
{ BTW: Thanx go to Ant ! }
--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
Technical Details
Message-ID:
<3e-dnV4iuIbifMLUnZ2dnUVZ_jqdnZ2d@giganews.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local02.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mailReferences:
<6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>Show Full Headers
Complete Article Headers
X-Google-Thread: f9855,76f4f8cd2b965afc
X-Google-Thread: fe5ee,76f4f8cd2b965afc
X-Google-Thread: faa3c,76f4f8cd2b965afc
X-Google-Thread: fcd68,76f4f8cd2b965afc
X-Google-Attributes: gidf9855,gidfe5ee,gidfaa3c,gidfcd68,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local02.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail
NNTP-Posting-Date: Sat, 03 Jan 2009 16:06:55 -0600
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: microsoft.public.security,alt.windows-xp,24hoursupport.helpdesk,alt.comp.virus
References: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>
Subject: Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?
Date: Sat, 3 Jan 2009 17:06:54 -0500
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2900.5512
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579
X-Comment-To: Doc
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 24/12/2008 20:32:05
Message-ID: <3e-dnV4iuIbifMLUnZ2dnUVZ_jqdnZ2d@giganews.com>
Lines: 50
X-Usenet-Provider: http://www.giganews.com
X-Trace: sv3-Qu3WG6iwhGwYF5O+j33ICdgWNUuGxFtv/eiQ6oNa4KYJaIJLczPCbA+thwNSUhwN8wDxZvxAYbDlF6M!nf9WD6yvg580O4nMoWvf7ydBhEPkiBZ2THlgmWTA4ttetPEJwd9lZkBIqzWLIQzKfTFwoZnkUAhi
X-Complaints-To: abuse@giganews.com
X-DMCA-Notifications: http://www.giganews.com/info/dmca.html
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.39