MSNMaker/WinMaker

Hi!


Six People on my messenger list have spammed me today and are infected with this:

AntiVir Found Backdoor-Server/MSNMaker.W.9 backdoor
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found Trojan.MSNMaker
Dr.Web Found BackDoor.Oscar
F-Prot Antivirus Found nothing
Fortinet Found W32/MSNMaker.W!tr.bdr
Kaspersky Anti-Virus Found Backdoor.Win32.MSNMaker.w
NOD32 Found a variant of Win32/MSNMaker
Norman Virus Control Found nothing
VirusBuster Found nothing


I cannot believe so many of them clicked on it. Agreeing to open a PIF too. Worse still they are spamming me but don't believe they are infected as Symantec finds nothing.... arghhH!


Anyone know how this backdoor works? Our security people reckon it's easy to get rid of (I'm not infected) but I'm curious to know what sort of backdoor functionality it provides.

Fairy

 

This seems to be a relatively new virus, those AVs that catch it must be relying on heuristics at the moment.
Google searches using the various names the different AV scanners give the virus turn up negative.

My guess is it:
-connects to a remote server to download some files
-establishes network connections and phones home
-rootkit functionality (perhaps?,maybe) included in the package, allows attacker to hide most processes, files, registry settings, invisible processes in task manager.

These are only guesses and predictions as to what this IM virus may be like.

According to your talking of some PIF file, this may be it:
http://filext.com/detaillist.php?extdetail=PIF

The attack scenario I visualise is this:
-Hacker sends unknown file to some victims, click on file and opens it triggering the execution code. Virus starts to spread.
-IM programs, virus multiplies by mass spamming all those found on contacts list.
-Could be a 0-day attack in progress.

 

http://www.fortinet.com/VirusEncycl...ethod=viewVirusDetailsInfoDirectly&fid=248867

 

Thanks! Some of it matched my descriptions.

 

The PIF is called Photo656.pif and is hosted on photogbase dot com which we have blocked on our firewall.

 

"is that u on that photo <link>" is the message it spams to messenger

 

That'd get someone to click it. Social Engineering at it finest.

 

I had to respect the quality of the social engineering even though I loath for the creator of this.