PhoenixDzine

Here’s the latest of our malware wallpaper calendars.

1280×800 | 1680×1050 | 1920×1200 | 2560×1600

This month we’ve highlighted some malware-related dates for the month of March, including the well-known trigger date of the Michelangelo virus. I remember well that the number of real-world triggers in 1992 were very few in number – certainly out of all proportion with some of the dire warnings we saw in the media in the run up to 6 March.

Yesterday, Polish Security Consultant and blogger Piotr Konieczny wrote (Polish) about a new wave of ZeuS trojan attacks. This time, it took place in Poland and it was directed against customers of ING Bank.

The samples used in this attack run on a number of platforms: Trojan-Spy.Win32.Zbot.bbmf for Windows, Trojan-Spy.SymbOS.Zbot.b for Symbian and Trojan-Spy.WinCE.Zbot.a for Windows Mobile. Yes, this time ZeuS in the Mobile (ZitMo) targets users of Windows Mobile smartphones too.

This attack was very similar to the first ZitMo attack which happened at the end of September 2010. Users infected by the Windows versions of the Zbot trojan were also asked to enter their cell phone number and smartphone model for a ‘certificate update’. After that, an URL with the link to the ‘certificate update’ (which is actually a ZeuS trojan for particular smartphone platform) was sent in a SMS to the infected customer. If users would have downloaded and installed this malicious file, their incoming SMS messages (with mTAN authentication codes also) would have been resent silently to a predefined cell phone number.

A trojan called Bohu that was spreading earlier this year caught people’s attention: it has the ability to block cloud-based anti-virus services, which is kind of a new thing. The malware spreads via social engineering and mostly targets China. The guys over at MMPC have published a nice blog post with more details here.

First off, our products already detected and blocked Bohu based on its behavior profile even before we had any signatures out for it. On the contrary, if a system was already infected before the installation of a scanner, you might be in trouble…

Amongst other things, Bohu also prevents access to a Kaspersky server that hosts virus signature updates by hooking the DNS resolver in order to filter out resolution attempts for the corresponding domain name. Consequently, an infected system is prevented from automatically updating its Kaspersky signature databases, so it cannot detect and remove the threat.

However, the domain name filter can also be turned into an infection check! We have prepared a little web page at http://www.securelist.com/bohucheck that takes advantage of Bohu’s blockade and displays different messages depending on whether a system can access the blocked domain or not. Users can now simply surf to this page to find out if they are infected with the trojan. If the page shows the above message, the trojan is not present.

But if the web page shows a warning message, the system is most likely infected:

In any case, if you see the message above, you should manually scan and clean your system. To do so, you can download our freely available rescue disk image and burn it to a CD or USB drive, then boot into it. As the scanner on the rescue system is not affected by the trojan’s domain filter, it can still update its signatures and detect and remove the malware. More information on how to use the rescue system is available online on this link.

There Is No Blogpost. There are only two pictures here.