Re: Why/how does Antivirus 2009 malware popup attach itself to certain links?

Article View: microsoft.public.security

Article #7

Back to microsoft.public.security Previous Next

From: Cadillakin
Date: Thu, 08 Jan 2009 04:03

41 lines
2865 bytes

On Sat, 03 Jan 2009 17:06:54 -0500, David H. Lipman wrote:

> From: "Doc" <docsavage20@yahoo.com>

> 
> | How is it these people haven't been shut down?
> 
> The site was hacked and is now compramised.  It takes you to a malicious
> site 78.110.175.21
> 
> http://isc.sans.org/diary.html?storyid=5440
> 
> The malicous site will test the PC for vulneranilities in Adobe Flash,
> Adobe Reader and MDAC.
> 
> Successful exploitation will yield a EXE file.
> 
> http://www.virustotal.com/analisis/e8a650fafef32407bb729fdc63f44f78
> 
> Prevx1 V2 2009.01.03 Information Stealer Sophos 4.37.0 2009.01.03
> Troj/Daonol-Fam TrendMicro 8.700.0.1004 2009.01.02 PAK_Generic.001
> 
> Which will drop; %windir%\system32\wdmaud.sys
> 
> All you can do it was what you did, contact the site owner to get the
> site fixed.
> 
> { BTW: Thanx go to Ant ! }

Right! Using Firefox3 sandboxed with Sandboxie, an explicit warning popup 
comes to the fore from Sandboxie alerting me that Acrobat.exe is trying 
to connect to the net. In my default sandbox, only the browsers are 
allowed to connect... This is the first time I've seen such a warning. I 
configured Sandboxie for just such an occurance - that something other 
than the browsers would be vulnerable to exploit.

-- 
Regards,
Cadillakin

Technical Details

Message-ID: <3We9l.8428$hc1.3853@flpi150.ffdc.sbc.com>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!news.glorb.com!nlpi057.nbdc.sbc.com!prodigy.net!flph199.ffdc.sbc.com!prodigy.com!flpi107.ffdc.sbc.com!flpi150.ffdc.sbc.com.POSTED!84381652!not-for-mail

References: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com> <3e-dnV4iuIbifMLUnZ2dnUVZ_jqdnZ2d@giganews.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: f9855,76f4f8cd2b965afc
X-Google-Thread: fe5ee,76f4f8cd2b965afc
X-Google-Thread: faa3c,76f4f8cd2b965afc
X-Google-Thread: fcd68,76f4f8cd2b965afc
X-Google-Attributes: gidf9855,gidfe5ee,gidfaa3c,gidfcd68,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!news.glorb.com!nlpi057.nbdc.sbc.com!prodigy.net!flph199.ffdc.sbc.com!prodigy.com!flpi107.ffdc.sbc.com!flpi150.ffdc.sbc.com.POSTED!84381652!not-for-mail
From: Cadillakin <cadillakin@sbcglobal.net>
Subject: Re: Why/how does Antivirus 2009 malware popup attach itself to
 certain links?
Newsgroups: microsoft.public.security,alt.windows-xp,24hoursupport.helpdesk,alt.comp.virus
References: <6a82feef-8a3a-4042-bfd0-684ce1e56ad3@l39g2000yqn.googlegroups.com>
 <3e-dnV4iuIbifMLUnZ2dnUVZ_jqdnZ2d@giganews.com>
User-Agent: Pan/0.133 (House of Butterflies)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Lines: 41
Message-ID: <3We9l.8428$hc1.3853@flpi150.ffdc.sbc.com>
NNTP-Posting-Host: 99.137.83.128
X-Complaints-To: abuse@prodigy.net
X-Trace: flpi150.ffdc.sbc.com 1231387391 ST000 99.137.83.128 (Wed, 07 Jan 2009 23:03:11 EST)
NNTP-Posting-Date: Wed, 07 Jan 2009 23:03:11 EST
Organization: at&t http://my.att.net/
X-UserInfo1: S[OWSZKE]RVYSWDXN[O@_WH@YR_B@EXLLBWLOOAF@YUDUWYAKVUOPCW[ML\JXUCKVFDYZKBMSFX^OMSAFNTINTDDMVW[X\THOPXZRVOCJTUTPC\_JSBVX\KAOTBAJBVMZTYAKMNLDI_MFDSSOLXINH__FS^\WQGHGI^C@E[A_CF\AQLDQ\BTMPLDFNVUQ_VM
Date: Thu, 08 Jan 2009 04:03:11 GMT

Reply to Parent Message