Fausses alertes TrojanSPM/LX* - SafeStrip

par **Malekal_morte** » 06 oct. 2007 22:12

Pour supprimer cette infection, suivre la procédure de désinfection Supprimer SafeStrip & TrojanSPM/LX*

Après...Fausses alertes TrojanSPM/LX* - WinAntivirus Pro 2007

Voici une nouvelle infection qui ajoute une icône à côté de l'horloge ouvrant des alertes :
"Windows has detected detected spywares infection! Click this Message to install the last update of Windows Software"

Le fond d'écran est modifié... offrant un message sur fond bleu "Warning! You're in danger, Your computer is infected with spywares!"
ainsi que des popups... :

Des popups alerte "Security Monitor: WARNING!" s'ouvrent avec le message "Attention! System detected a potential hazard (TrojanSPM/Lx) on your computer"

La page de démarrage de votre navigateur WEB est modifiée vers l'adresse http://safe-strip-download.com ou des propositions insitantes pour vous faire télécharger le rogue SafeStrip

Le fichier HOSTS de Windows est modifié afin d'empécher la mise à jour des antivirus, la connexion sur des sites d'antivirus etc..

10.18.250.4 ad.doubleclick.net
10.18.250.4 ad.fastclick.net
10.18.250.4 ads.fastclick.net
10.18.250.4 ar.atwola.com
10.18.250.4 atdmt.com
10.18.250.4 avp.ch
10.18.250.4 avp.com
10.18.250.4 avp.ru
10.18.250.4 awaps.net
10.18.250.4 banner.fastclick.net
10.18.250.4 banners.fastclick.net
10.18.250.4 ca.com
10.18.250.4 click.atdmt.com
10.18.250.4 clicks.atdmt.com
10.18.250.4 customer.symantec.com
10.18.250.4 dispatch.mcafee.com
10.18.250.4 download.mcafee.com
10.18.250.4 downloads-us1.kaspersky-labs.com
10.18.250.4 downloads-us2.kaspersky-labs.com
10.18.250.4 downloads-us3.kaspersky-labs.com
10.18.250.4 downloads1.kaspersky-labs.com
10.18.250.4 downloads2.kaspersky-labs.com
10.18.250.4 downloads3.kaspersky-labs.com
10.18.250.4 downloads4.kaspersky-labs.com
10.18.250.4 engine.awaps.net
10.18.250.4 f-secure.com
10.18.250.4 fastclick.net
10.18.250.4 ftp.avp.ch
10.18.250.4 ftp.downloads1.kaspersky-labs.com
10.18.250.4 ftp.downloads2.kaspersky-labs.com
10.18.250.4 ftp.downloads3.kaspersky-labs.com
10.18.250.4 ftp.f-secure.com
10.18.250.4 ftp.kasperskylab.ru
10.18.250.4 ftp.sophos.com
10.18.250.4 ids.kaspersky-labs.com
10.18.250.4 kaspersky-labs.com
10.18.250.4 kaspersky.com
10.18.250.4 liveupdate.symantec.com
10.18.250.4 liveupdate.symantecliveupdate.com
10.18.250.4 mast.mcafee.com
10.18.250.4 mcafee.com
10.18.250.4 media.fastclick.net
10.18.250.4 my-etrust.com
10.18.250.4 nai.com
10.18.250.4 networkassociates.com
10.18.250.4 norton.com
10.18.250.4 phx.corporate-ir.net
10.18.250.4 rads.mcafee.com
10.18.250.4 secure.nai.com
10.18.250.4 securityresponse.symantec.com
10.18.250.4 service1.symantec.com
10.18.250.4 sophos.com
10.18.250.4 spd.atdmt.com
10.18.250.4 symantec.com
10.18.250.4 trendmicro.com
10.18.250.4 update.symantec.com
10.18.250.4 updates.symantec.com
10.18.250.4 updates1.kaspersky-labs.com
10.18.250.4 updates2.kaspersky-labs.com
10.18.250.4 updates3.kaspersky-labs.com
10.18.250.4 updates4.kaspersky-labs.com
10.18.250.4 updates5.kaspersky-labs.com
10.18.250.4 us.mcafee.com
10.18.250.4 vil.nai.com
10.18.250.4 viruslist.com
10.18.250.4 viruslist.ru
10.18.250.4 virusscan.jotti.org
10.18.250.4 virustotal.com
10.18.250.4 http://www.avp.ch
10.18.250.4 http://www.avp.com
10.18.250.4 http://www.avp.ru
10.18.250.4 http://www.awaps.net
10.18.250.4 http://www.ca.com
10.18.250.4 http://www.f-secure.com
10.18.250.4 http://www.fastclick.net
10.18.250.4 http://www.grisoft.com
10.18.250.4 http://www.kaspersky-labs.com
10.18.250.4 http://www.kaspersky.com
10.18.250.4 http://www.kaspersky.ru
10.18.250.4 http://www.mcafee.com
10.18.250.4 http://www.my-etrust.com
10.18.250.4 http://www.nai.com
10.18.250.4 http://www.networkassociates.com
10.18.250.4 http://www.sophos.com
10.18.250.4 http://www.symantec.com
10.18.250.4 http://www.trendmicro.com
10.18.250.4 http://www.viruslist.com
10.18.250.4 http://www.viruslist.ru
10.18.250.4 http://www.virustotal.com

L'infection ajoute les lignes suivantes sur HijackThis :
O4 - HKLM\..\Run: [sware] C:\Program Files\WinMsg\SWARE.EXE
O4 - HKLM\..\Run: [bal] C:\Program Files\WinMsg\SYSMONMS.EXE
O4 - HKCU\..\Run: [SafeStrip] C:\Program Files\SafeStrip\SafeStrip.exe

par **Malekal_morte** » 08 mars 2008 14:42

Nouvelle variante affichant de fausses alertes disant que vous êtes infecté.

Cette dernière modifie aussi le fond d'écran de la même manière que précédemment comme ceci :
(fichier %SystemRoot%\mywallpaper.bmp sur le système)

Vous pouvez recevoir des messages du type :

YOUR'RE IN DANGER!
YOUR COMPUTER IS INFECTED WITH SPYWARE!
ALL YOU DO WITH COMPUTER IS STORED FOREVER IN YOUR HARD DISK.

WHEN YOU VISIT SITES, SEND EMAILS... ALL YOUR ACTIONS ARE

LOGGED. AND IT IS IMPOSSIBLE TO REMOVE THEM WITH STANDARD TOOLS.

YOUR DATA IS STILL AVAILABLE FOR FORENSICS. AND IN SOME CASES

FOR YOUR BOSS, YOUR FRIENDS, YOUR WIFE, YOUR CHILDREN.

Every site you or somebody or even something, like spyware, opened in your browsers,
with all images, and all downloaded and maybe later removed movies or mp3 songs -
ARE STILL THERE and could broke your life!
SECURE YOURSELF RIGHT NOW!
REMOVE ALL SPYWARE FROM YOUR PC!

ou

WARNING: Your computer is infected
Windows has detected spyware infection! Click this message to install the last update of Windows security software..

Actuellement l'infection tente de vous faire télécharger (puis acheter), les rogues :
* SysCleaner
* SpyBurner

L'infection ajoutes les lignes suivantes sur HijackThis :

O4 - HKLM\..\Run: [1029BB4B-16A9-4E77-AA3D-96930BD68EEC] "C:\WINDOWS\system32\sysockeu.exe"
O4 - HKLM\..\Run: [2177F056-0AA6-4D6C-A944-13F71F341C29] "C:\WINDOWS\system32\sysokuaw.exe"
O4 - HKLM\..\Run: [852EBF20-A95D-4F1F-B9C2-B2CD24350F3E] "C:\WINDOWS\system32\sysodkcs.exe"

Les scans des fichiers ;
http://www.virustotal.com/analisis/8b0a ... 9f7a0d2bb3

File sysokuaw.exe received on 03.08.2008 14:06:14 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 7/32 (21.88%)

Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.07 -
AntiVir 7.6.0.73 2008.03.07 -
Authentium 4.93.8 2008.03.07 -
Avast 4.7.1098.0 2008.03.07 -
AVG 7.5.0.516 2008.03.07 -
BitDefender 7.2 2008.03.08 -
CAT-QuickHeal 9.50 2008.03.08 -
ClamAV 0.92.1 2008.03.08 Trojan.Fakealert-102
DrWeb 4.44.0.09170 2008.03.08 -
eSafe 7.0.15.0 2008.03.06 -
eTrust-Vet 31.3.5597 2008.03.07 Win32/Sastrip.A
Ewido 4.0 2008.03.08 -
FileAdvisor 1 2008.03.08 -
Fortinet 3.14.0.0 2008.03.08 -
F-Prot 4.4.2.54 2008.03.08 -
F-Secure 6.70.13260.0 2008.03.07 -
Ikarus T3.1.1.20 2008.03.08 -
Kaspersky 7.0.0.125 2008.03.08 not-virus:Hoax.Win32.Renos.bbp
McAfee 5247 2008.03.07 -
Microsoft 1.3301 2008.03.07 -
NOD32v2 2931 2008.03.08 Win32/TrojanDownloader.FakeAlert.AS
Norman 5.80.02 2008.03.07 -
Panda 9.0.0.4 2008.03.08 Adware/SpyBurner
Prevx1 V2 2008.03.08 Heuristic: Suspicious File With Code Injection Technology
Rising 20.34.52.00 2008.03.08 -
Sophos 4.27.0 2008.03.08 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.08 -
TheHacker 6.2.92.237 2008.03.08 -
VBA32 3.12.6.2 2008.03.05 -
VirusBuster 4.3.26:9 2008.03.07 -
Webwasher-Gateway 6.6.2 2008.03.07 Virus.Win32.FileInfector.gen!90 (suspicious)
Additional information
File size: 28672 bytes
MD5: 45f1e0a8754a78354944a6b34fd27953
SHA1: 1495f69db92f6e8da78939b226ca8473ef0c9447
PEiD: -
Prevx info: http://info.prevx.com/aboutprogramtext. ... 009A971C7F

http://www.virustotal.com/analisis/9e67 ... 50b93d8665

File sysodkcs.exe received on 03.08.2008 14:14:52 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 8/32 (25%)

Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.07 -
AntiVir 7.6.0.73 2008.03.07 HEUR/Malware
Authentium 4.93.8 2008.03.07 -
Avast 4.7.1098.0 2008.03.07 -
AVG 7.5.0.516 2008.03.08 -
BitDefender 7.2 2008.03.08 -
CAT-QuickHeal 9.50 2008.03.08 -
ClamAV 0.92.1 2008.03.08 Trojan.Fakealert-103
DrWeb 4.44.0.09170 2008.03.08 -
eSafe 7.0.15.0 2008.03.06 -
eTrust-Vet 31.3.5597 2008.03.07 Win32/Sastrip.A
Ewido 4.0 2008.03.08 -
FileAdvisor 1 2008.03.08 -
Fortinet 3.14.0.0 2008.03.08 -
F-Prot 4.4.2.54 2008.03.08 -
F-Secure 6.70.13260.0 2008.03.07 not-virus:Hoax.Win32.Burner.h
Ikarus T3.1.1.20 2008.03.08 -
Kaspersky 7.0.0.125 2008.03.08 not-virus:Hoax.Win32.Burner.h
McAfee 5247 2008.03.07 -
Microsoft 1.3301 2008.03.07 -
NOD32v2 2931 2008.03.08 Win32/TrojanDownloader.FakeAlert.AR
Norman 5.80.02 2008.03.07 -
Panda 9.0.0.4 2008.03.08 Adware/SpyBurner
Prevx1 V2 2008.03.08 -
Rising 20.34.52.00 2008.03.08 -
Sophos 4.27.0 2008.03.08 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.08 -
TheHacker 6.2.92.237 2008.03.08 -
VBA32 3.12.6.2 2008.03.05 -
VirusBuster 4.3.26:9 2008.03.07 -
Webwasher-Gateway 6.6.2 2008.03.07 Heuristic.Malware
Additional information
File size: 32256 bytes
MD5: 5f94321df9cea8dcff5d80b79258ff6c
SHA1: 3d6a391478f29aed4618f8f882146e28a7241228
PEiD: BobSoft Mini Delphi -> BoB / BobSoft

File sysounrk.exe received on 03.08.2008 14:16:02 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 6/32 (18.75%)

Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.07 -
AntiVir 7.6.0.73 2008.03.07 -
Authentium 4.93.8 2008.03.07 -
Avast 4.7.1098.0 2008.03.07 -
AVG 7.5.0.516 2008.03.08 -
BitDefender 7.2 2008.03.08 -
CAT-QuickHeal 9.50 2008.03.08 -
ClamAV 0.92.1 2008.03.08 Adware.Agent-1289
DrWeb 4.44.0.09170 2008.03.08 -
eSafe 7.0.15.0 2008.03.06 -
eTrust-Vet 31.3.5597 2008.03.07 Win32/AdClicker.DK
Ewido 4.0 2008.03.08 -
FileAdvisor 1 2008.03.08 -
Fortinet 3.14.0.0 2008.03.08 -
F-Prot 4.4.2.54 2008.03.08 -
F-Secure 6.70.13260.0 2008.03.07 -
Ikarus T3.1.1.20 2008.03.08 -
Kaspersky 7.0.0.125 2008.03.08 -
McAfee 5247 2008.03.07 -
Microsoft 1.3301 2008.03.07 -
NOD32v2 2931 2008.03.08 Win32/TrojanClicker.Delf.NBB
Norman 5.80.02 2008.03.07 -
Panda 9.0.0.4 2008.03.08 Adware/SpyBurner
Prevx1 V2 2008.03.08 Heuristic: Suspicious File With Anti-Security Technology
Rising 20.34.52.00 2008.03.08 -
Sophos 4.27.0 2008.03.08 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.08 -
TheHacker 6.2.92.237 2008.03.08 -
VBA32 3.12.6.2 2008.03.05 -
VirusBuster 4.3.26:9 2008.03.07 -
Webwasher-Gateway 6.6.2 2008.03.07 Virus.Win32.FileInfector.gen!90 (suspicious)
Additional information
File size: 20992 bytes
MD5: a9f699e1f123345becce58d6d6dc33dd
SHA1: b8a021970b4edc04c6e325aed80bbff7e3924e99
PEiD: -

http://www.virustotal.com/analisis/4e6a ... 51ed23aeb8

File sysockeu.exe received on 03.08.2008 14:16:48 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 6/32 (18.75%)

Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.07 -
AntiVir 7.6.0.73 2008.03.07 HEUR/Malware
Authentium 4.93.8 2008.03.07 -
Avast 4.7.1098.0 2008.03.07 -
AVG 7.5.0.516 2008.03.08 -
BitDefender 7.2 2008.03.08 -
CAT-QuickHeal 9.50 2008.03.08 -
ClamAV 0.92.1 2008.03.08 Trojan.Fakealert-104
DrWeb 4.44.0.09170 2008.03.08 -
eSafe 7.0.15.0 2008.03.06 -
eTrust-Vet 31.3.5597 2008.03.07 Win32/Sastrip.A
Ewido 4.0 2008.03.08 -
FileAdvisor 1 2008.03.08 -
Fortinet 3.14.0.0 2008.03.08 -
F-Prot 4.4.2.54 2008.03.08 -
F-Secure 6.70.13260.0 2008.03.07 -
Ikarus T3.1.1.20 2008.03.08 -
Kaspersky 7.0.0.125 2008.03.08 -
McAfee 5247 2008.03.07 -
Microsoft 1.3301 2008.03.07 -
NOD32v2 2931 2008.03.08 Win32/TrojanDownloader.FakeAlert.AQ
Norman 5.80.02 2008.03.07 -
Panda 9.0.0.4 2008.03.08 Adware/SpyBurner
Prevx1 V2 2008.03.08 -
Rising 20.34.52.00 2008.03.08 -
Sophos 4.27.0 2008.03.08 -
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.08 -
TheHacker 6.2.92.237 2008.03.08 -
VBA32 3.12.6.2 2008.03.05 -
VirusBuster 4.3.26:9 2008.03.07 -
Webwasher-Gateway 6.6.2 2008.03.07 Heuristic.Malware
Additional information
File size: 35840 bytes
MD5: dfbfb2a143a8422fd076325ef1549311
SHA1: 28cfb4765c0ba67f63ec080dbc53295605f5eee5
PEiD: BobSoft Mini Delphi -> BoB / BobSoft

par **Malekal_morte** » 13 avr. 2008 23:47

Nouvelle variantes qui rajoute ces lignes sur HijackThis se propageant toujours via un faux codec

O4 - HKLM\..\Run: [{DD651081-A909-45ad-BD71-2335B0ADE043}] "C:\WINDOWS\sysabmpmfr.exe"
O4 - HKLM\..\Run: [{7DD4A7AC-A3F1-4495-884A-7947C5B89108}] "C:\WINDOWS\sysahbecjh.exe"
O4 - HKLM\..\Run: [{9754B85A-3B34-4969-BE1F-CD03227E9470}] "C:\WINDOWS\sysatjsicj.exe"
O4 - HKLM\..\Run: [{2C70168B-97CE-4f31-B85D-1FEC5002721D}] "C:\WINDOWS\sysavxjgdu.exe"
O4 - HKLM\..\Run: [{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}] "C:\WINDOWS\sysawechod.exe"

Même symptome, l'infection redirige vers hxxp://pcsafetysupply.com/remove_spyware.php?affid=47jxf
afin de vous faire télécharger le rogue SpyBurner.

Malekal.com forum

Fausses alertes TrojanSPM/LX* - SafeStrip

Fausses alertes TrojanSPM/LX* - SafeStrip

YOUR COMPUTER IS INFECTED WITH SPYWARE!

Re: Fausses alertes TrojanSPM/LX* - SafeStrip