trojan dropper – Paul's Tech Talk

Hackers Jump onto Power Point Exploits : KB969136

PaulApril 3, 2009

In my Previous post, we talked about Microsoft [intlink id=”3280″ type=”post”]Advisory for KB969136[/intlink] and the exploit was in the wild. It looks like Trend Micro has published some new spam attempts to get the users to open up the Maleware for them to deposit TROJ_PPDROP.AB onto there systems.

[ad#cricket-right-ez]Trend Micro has some screen shots of the most common Fake Presentations for you to see just how they try to get you to open the file.

Although these are some common tactics for attackers to use such as nude pictures, Earth Hour, or Celebrities without Makeup, users who don’t normally use PPT should check the files out before you load them. You also should remember to save them to a file and [intlink id=”2205″ type=”page”]scan them with your Anti-virus software[/intlink], also it wouldn’t hurt to have a firewall software. It looks like these exploits tries to connect to the internet and you might be able to find out by the request from the firewall.

According to Internet Storm Center, the CVE place Holder for this is CVE-2009-0556 and hasn’t become live yet. I do not think they will release that information until they get a chance for Microsoft to patch the systems.

This would be a good time to remind IT staff and anyone who might use Power Point that they should not open anything they aren’t expecting and even then they should verify with your IT staff that it is safe until Microsoft issues a patch for this. I expect that if this become widely used it will be released out of Cycle or even In May’s Patch Tuesday. According to Microsoft you could install Microsoft Office Isolated Conversion Environment (MOICE) but requires Office 2003 and Office 2007 systems. Find out how you can use this work around at Microsoft’s Advisory of KB969136 for further instructions.

Crafty little Trojan:W32/DNSChanger.ARNF

PaulDecember 11, 2008

Saw this post and couldn’t resist talking about it. This was talked about on F-secure. It looks like they use a program call “Homeview Installer” and after you install it you get the Trojan:W32/DNSChanger.ARNF. So how do you get that off your system? Before we talk about that, let’s talk about what it does. According to F-secure:

[ad#ad2-right]

This malware is dropped onto the system by Trojan-Dropper:W32/Agent.FLN. It is used to change the DNS settings on a system so that information such as passwords and credit card details can be retrieved.

[Via F-secure]

What you need to do to get rid of this of this Trojan is to scan your system. You will also need to understand that this is a really good Trojan, it sees to modify your DNS and also your Registry. Once you located and destroyed it you will then want to remove all your restore points. After that you will want to check my other resources to better protect yourself. You are the only one to prevent a virus from getting on your system. If you like this one check out my other post as well.

Sites that you need not Visit:

PaulNovember 2, 2008

[ad#ad2-right]I’ve had some Anti-virus problems in the past few weeks and have been trying to see if it is my system or if it was just luck of the draw. So I did some research and found some sites that you should not go to, or download from. These sites have been know to spread the fake anti-virus malware software. So I wanted to warn people of some common websites that have been known to have viruses on them:

hxxp://movieportal2008q.com/freemovie/Movie/xxxx/x/ — this site usually tries to send you the “Trojan.HTML.Zlob.AG” Virus.

hxxp://porntubedot.com/xxxxxxxx/WatchFreeMovie.php –This site usually tries to send you the “Trojan.Dropper.SMN” Virus.

hxxp://handballfondi.it/xxxxxx1.php — This site is one of the new Malware sites that looks like Youtube, When you go to this site they say you need a special to play a video clip. Most of the time when you get something like this, it is going to try to install Malware. A good broad set of Codecs that you may want to download is called Klite Mega Codec, which if you us that you should never need to download any other codec to play a movie clip from any site online.

hxxp://0scanner.com/—censored—/ — This site usually tries to send you the “Adware.FakeAntiVirus.L” virus. Another site trying to install malware. [ad#ad2-left]