Comodo Defence Plus Bypassed by Zeroaccess rootkit

Discussion in 'other anti-malware software' started by aigle, Dec 4, 2011.

Thread Status:
Not open for further replies.
Page 2 of 4
  1. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    test strategy is very much valid. Defence plus and sandbox are there to catch any thing that is not detected by AV. I just test this aspect of CIS.

    I don't care for the AV so i turn it off( just assume that the sample was zero day for the AV). All other settings are defa2ult. And i do test with maximum paranoid settings too, which are actually the settings i use to protect my PC.
     
    aigle, Dec 6, 2011
    #26
  2. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Sent to a member there.
     
    aigle, Dec 6, 2011
    #27
  3. blacknight

    blacknight Registered Member

    Joined:
    Sep 25, 2007
    Posts:
    3,347
    Location:
    Europe, UE citizen
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    I suspect that sandbox enabled weakens Defense+, also in Paranoid Mode with restricted settings. I think that there is some interference.
     
    blacknight, Dec 6, 2011
    #28
  4. Ranget

    Ranget Registered Member

    Joined:
    Mar 24, 2011
    Posts:
    846
    Location:
    Not Really Sure :/
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    i think sandbox will weaken the D+
    because comodo made it disabled by default in v5.8

    also really disappointed by OA
     
    Ranget, Dec 6, 2011
    #29
  5. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,784
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Just curious why you think DefenseWall and/or Sandboxie would fail at this?
     
    LoneWolf, Dec 6, 2011
    #30
  6. Zyrtec

    Zyrtec Registered Member

    Joined:
    Mar 4, 2008
    Posts:
    534
    Location:
    USA
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Strange, indeed!

    Based on MGR Tests, DW has passed all those 0-day rootkit samples with flying colors [either TDSS or ZeroAccess], so like you I'm just wondering why would DW not pass this ZeroAccess rootkit test? [Unless you purposely disable DW HIPS while testing ZeroAccess, or the rootkit .exe file was already on the computer sitting on desktop as a “trusted app” before DW was installed and then you execute it].


    Thanks.
     
    Zyrtec, Dec 6, 2011
    #31
  7. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    DW will for sure nail this litle bugger in real time:thumb:
     
    jmonge, Dec 6, 2011
    #32
  8. andyman35

    andyman35 Registered Member

    Joined:
    Nov 2, 2007
    Posts:
    2,336
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    +1
    I can't actually recall either DW or SBIE being bypassed by anything similar to this,without the user deliberately circumventing their protection :doubt:
     
    andyman35, Dec 6, 2011
    #33
  9. Technical

    Technical Registered Member

    Joined:
    Oct 12, 2003
    Posts:
    471
    Location:
    Brazil
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    If the member could do something... it'll be ok.
    But it always better to send for the virus team for analysis.
     
    Technical, Dec 6, 2011
    #34
  10. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    sorry, for DW and SBIE, it was a typing mistake. I wanted to say no reason for them to NOT pass the test.
     
    aigle, Dec 6, 2011
    #35
  11. LoneWolf

    LoneWolf Registered Member

    Joined:
    Jan 2, 2006
    Posts:
    3,784
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Now I understand. :D
     
    LoneWolf, Dec 6, 2011
    #36
  12. Brandonn2010

    Brandonn2010 Registered Member

    Joined:
    Jan 10, 2011
    Posts:
    1,854
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Could we test this against the BZ 4 RC?
     
    Brandonn2010, Dec 6, 2011
    #37
  13. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    knew it:D :thumb:
     
    jmonge, Dec 6, 2011
    #38
  14. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    OA bypassed, no pop up at all- confirmed.
    AppGuard, default settings, high: Passed :thumb:
     
    Last edited: Dec 9, 2011
    aigle, Dec 8, 2011
    #39
  15. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    did you run it from a link or just download file and then run it?did you use default config?did you run it run safer or did you run any unknown or untrusted files to run safer?how do you configure OA?was it OA++,premium or free version?
    also what config did you use for appguard?lockdown mode?or what? thanks for testing
     
    jmonge, Dec 8, 2011
    #40
  16. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    4,020
    Location:
    California
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    I set up to simulate a driveby download to force the files into my Temp directory.

    Using Faronics AE v.2, the files cannot get onto disk, so cannot run:


    installlflashplayer.gif

    msimgdll.gif



    ----
    rich
     
    Rmus, Dec 8, 2011
    #41
  17. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    OA free default settings after config wizard and scan.

    Executed them from a desktop folder.

    AG default.
     
    aigle, Dec 8, 2011
    #42
  18. Fabian Wosar

    Fabian Wosar Developer

    Joined:
    Aug 26, 2010
    Posts:
    838
    Location:
    Germany
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Hi aigle,

    Unfortunately I am unable to confirm your findings. OA Free blocks the ZeroAccess variant abusing the signed Flash installer just fine on Windows XP and Windows 7 x64:

    oa_free_blocking_zeroaccess.png

    I recorded the session on Windows XP and you can download it here (best viewed using VLC):

    http://tmp.emsisoft.com/fw/videos/ZeroAccessTest.rar

    Would you mind repeating the test with Debug Mode enabled? That way we may be able to see why it is able to bypass OA on your test system but not on our.

    Thanks.
     
    Last edited: Dec 8, 2011
    Fabian Wosar, Dec 8, 2011
    #43
  19. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,491
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Wow that was a fast response Fabian, good to know you're lurking the forums :D
     
    Noob, Dec 8, 2011
    #44
  20. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    @Rmus,aigle and Fabian Wosar thanks for testing:thumb: :thumb:
     
    jmonge, Dec 8, 2011
    #45
  21. mrpink

    mrpink Registered Member

    Joined:
    Mar 29, 2010
    Posts:
    407
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    Little off topic. Mpc-hc and PotPlayer could not render the file. Only VLC seems to have VMWare's video codec built in
     
    mrpink, Dec 8, 2011
    #46
  22. Barthez

    Barthez Registered Member

    Joined:
    Apr 28, 2010
    Posts:
    113
    Location:
    Poland
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    You can download Vmnc Codec from official website if you wish. It will allow you to view the file.

    I re-encoded this video to XVID for those who don't wish to install any additional codecs :)
    http://www.mediafire.com/?aau5jz5p32dno1b (~8MB)


    From the video it looks like the bug is essentially on Adobe side, since it first loads .dlls from it's own directory instead those installed in system, right?
     
    Barthez, Dec 8, 2011
    #47
  23. pandorax

    pandorax Registered Member

    Joined:
    Feb 14, 2011
    Posts:
    386
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    What is the effect that malicious on system? I mean what do you suffer after infected with this? And why would someone who knows how to use hips install the flash player with a suspicious dll file?
     
    Last edited: Dec 8, 2011
    pandorax, Dec 8, 2011
    #48
  24. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    Re: Comodo Defence Plus Byapssed by Zeroaccess rootkit

    just hit block,there is enough info
     
    jmonge, Dec 8, 2011
    #49
  25. cruelsister

    cruelsister Registered Member

    Joined:
    Nov 6, 2007
    Posts:
    1,649
    Location:
    Paris
    cruelsister, Dec 8, 2011
    #50
Page 2 of 4
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...