Sunbelt Adds Detection for ID Theft Keylogger

Discussion in 'other anti-malware software' started by ronjor, Aug 11, 2005.

Thread Status:
Not open for further replies.
  1. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    164,145
    Location:
    Texas
    Article

    More
     
    ronjor, Aug 11, 2005
    #1
  2. ftwynne59

    ftwynne59 Registered Member

    Joined:
    May 24, 2005
    Posts:
    185
    ID Theft Spyware Scam Uncovered

    Hi all

    Interesting read.....

    http://news.bbc.co.uk/1/hi/technology/4173218.stm

    Apologies...Tried to copy and paste the link (BBC News Website) but just got the web location text. So a question to the Forum members (being a newbie an' all) is how is this done ?

    Cheers

    ftwyyne59
     
    Last edited: Aug 23, 2005
    ftwynne59, Aug 23, 2005
    #2
  3. controler

    controler Guest

    Re: ID Theft Spyware Scam Uncovered

    I wonder if ProcessGuard could stop this type install?

    controler
     
    controler, Aug 23, 2005
    #3
  4. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    Re: ID Theft Spyware Scam Uncovered

    I couldn't see how pg would block a trojan (drive by download) if it doesn't have a service to block...

    it would be nod32 or ewido on my machine stopping the trojan ...

    I have been infecting myself for a while now and I haven't seen pg doing anything about any infection unless it would be a rootkit or stopping some code injection but the actual trojan wasn't stopped...

    I have been reading a story from Paperghost and I must say I see some comparision with the BBC story and PPG's own crusade against spyware .. some server collecting ... some server infesting .. and very hard to find such server.

    grtz.
     
    Infinity, Aug 23, 2005
    #4
  5. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    4,020
    Location:
    California
    Re: ID Theft Spyware Scam Uncovered

    I would hope so, if its anti-execution protection is working.

    The article states that the trojan is a variant of dumaru. From the Semantic site:

    http://securityresponse.symantec.com/avcenter/venc/data/w32.dumaru.y@mm.html

    ------------------------
    Copies itself as these files: %System%\l32x.exe %System%\vxd32v.exe %Startup%\dllxw.exe
    ------------------------

    As soon as the trojan attempts to copy/load the .exe, PG should alert. This would probably be the keylogger referred to.

    Other types of protection should also catch it:

    ----------------------------
    Adds the value:

    "load32"="%System%\l32x.exe"

    to the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the worm runs when you start Windows.
    ----------------------------------------------------

    If you have a registry monitor of sometype, this action would be blocked.

    If you have a lock-down program, all would be erased on reboot before the worm could run.


    -rich
    ________________
    ~~Be ALERT!!! ~~
     
    Rmus, Aug 23, 2005
    #5
  6. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    Re: ID Theft Spyware Scam Uncovered

    the execution protection should protect the exe from executing yes that's true.
     
    Infinity, Aug 23, 2005
    #6
  7. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    4,020
    Location:
    California
    It turns out that the worm installs the keylogger, Srv.SSA-KeyLogger in a similar way as the dumaru worm , and easily prevented by any program that catches keyloggers:

    http://research.sunbelt-software.com/Advisory.cfm

    Also, as mentioned in another post, tweaking IE helps!


    -rich
    ________________
    ~~Be ALERT!!! ~~
     
    Last edited: Aug 23, 2005
    Rmus, Aug 23, 2005
    #7
  8. trickyricky

    trickyricky Registered Member

    Joined:
    Mar 27, 2005
    Posts:
    475
    Location:
    London, UK
    I'm sure not using IE would help even more.
     
    trickyricky, Aug 23, 2005
    #8
  9. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    ID theft ring escapes shutdown

     
    Bubba, Aug 27, 2005
    #9
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...