Showing posts with label misc. Show all posts
Showing posts with label misc. Show all posts
Thursday, January 12, 2012
Funny Mutex Name
Found in a Malware PE, a funny Mutex Name: AANCHODANCHEV_AND_BRIANKREBS_GOT_MARRIED
Thursday, March 25, 2010
Antivirus and FP
I did a test on Virus Total Online Scanner with an inoffensive ASM code.
This is the source code:
And this is what the compiled binary looks like
The program just exit itself. No more, no less.
Few years ago, the result on VT was: 3/33 with suspicious Virus Names. Today, the result is 10/42 for this Exit Program.
a-squared 4.5.0.50 2010.03.25 Backdoor.Poisonivy.E!IK
AhnLab-V3 5.0.0.2 2010.03.25 -
AntiVir 7.10.5.210 2010.03.25 -
Antiy-AVL 2.0.3.7 2010.03.24 -
Authentium 5.2.0.5 2010.03.25 -
Avast 4.8.1351.0 2010.03.24 -
Avast5 5.0.332.0 2010.03.24 -
AVG 9.0.0.787 2010.03.25 BackDoor.PoisonIvy.AD
BitDefender 7.2 2010.03.25 -
CAT-QuickHeal 10.00 2010.03.25 -
ClamAV 0.96.0.0-git 2010.03.25 -
Comodo 4378 2010.03.25 -
DrWeb 5.0.1.12222 2010.03.25 -
eSafe 7.0.17.0 2010.03.24 -
eTrust-Vet 35.2.7387 2010.03.25 -
F-Prot 4.5.1.85 2010.03.24 -
F-Secure 9.0.15370.0 2010.03.25 -
Fortinet 4.0.14.0 2010.03.24 -
GData 19 2010.03.25 -
Ikarus T3.1.1.80.0 2010.03.25 Backdoor.Poisonivy.E
Jiangmin 13.0.900 2010.03.25 -
K7AntiVirus 7.10.1004 2010.03.22 Trojan.Win32.Xorpix
Kaspersky 7.0.0.125 2010.03.25 -
McAfee 5930 2010.03.24 -
McAfee+Artemis 5930 2010.03.24 Artemis!CD73D32FC69E
McAfee-GW-Edition 6.8.5 2010.03.25 -
Microsoft 1.5605 2010.03.25 -
NOD32 4972 2010.03.24 -
Norman 6.04.10 2010.03.24 -
nProtect 2009.1.8.0 2010.03.25 -
Panda 10.0.2.2 2010.03.24 -
PCTools 7.0.3.5 2010.03.25 -
Prevx 3.0 2010.03.25 High Risk System Back Door
Rising 22.40.03.04 2010.03.25 -
Sophos 4.52.0 2010.03.25 Mal/Generic-A
Sunbelt 6075 2010.03.25 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.25 Suspicious.Insight
TheHacker 6.5.2.0.242 2010.03.24 -
TrendMicro 9.120.0.1004 2010.03.25 -
VBA32 3.12.12.2 2010.03.25 -
ViRobot 2010.3.25.2243 2010.03.25 -
VirusBuster 5.0.27.0 2010.03.24 Backdoor.Poisonivy.MM
Information additionnelle
File size: 1536 bytes
MD5...: cd73d32fc69e10e9f4b7c736cfaf2f22
SHA1..: acfa9c1beadfd9021552fe962029d00aea25221a
SHA256: cbe4ce3d527e6d6c0d0c94e9cf5e8b064c4205e35fc31ee99bfd04dfe50c1464
ssdeep: 3:WlWUqt/vllXl+YZcFTS9gXeF+X32ZpfLj4UTqQat4ll/ml8UTXlAkQ9dlllNl/
/w:idq2Vg3F+X32Tj4HYlOFiHUEEu2OuB
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x46ca8aeb (Tue Aug 21 06:49:15 2007)
machinetype.......: 0x14c (I386)
( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe 0x200 0.16 b429b070d0408908f37618354c81acb1
.rdata 0x2000 0x54 0x200 0.62 9469b36bdb6e6a481f3d64647c84b836
( 1 imports )
> kernel32.dll: ExitProcess
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=15781E43006B64C30666003B3C2E0700B79BCD14' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=15781E43006B64C30666003B3C2E0700B79BCD14</a>
This test was done with an unpacked binary. Using a packer increase the results: 27/42 with FSG and 25/41 with MEW. Various Trojan names were listed such as: Vundo, Trojan-Downloader, Backdoor/RBot and so on.
With packed versions, some AV are detecting the file because of an heuristic routine: Trojan.Generic, Win32.Suspicious, Mal/EncPk-BA, Cryp_MEW-11.
Take care with Antivirus Results and learn to decode Trojan Names.
This is the source code:
.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
.data
.code
start:
Push 0
CALL ExitProcess
end startAnd this is what the compiled binary looks like
00401000 >/$ 6A 00 PUSH 0 ; /ExitCode = 0
00401002 \. E8 01000000 CALL jmp.kernel32.exitprocess ; \ExitProcess
00401007 CC INT3
00401008 .- FF25 00204000 JMP DWORD PTR DS:[<kernel32.ExitProcess>]; kernel32.ExitProcess
The program just exit itself. No more, no less.
Few years ago, the result on VT was: 3/33 with suspicious Virus Names. Today, the result is 10/42 for this Exit Program.
a-squared 4.5.0.50 2010.03.25 Backdoor.Poisonivy.E!IK
AhnLab-V3 5.0.0.2 2010.03.25 -
AntiVir 7.10.5.210 2010.03.25 -
Antiy-AVL 2.0.3.7 2010.03.24 -
Authentium 5.2.0.5 2010.03.25 -
Avast 4.8.1351.0 2010.03.24 -
Avast5 5.0.332.0 2010.03.24 -
AVG 9.0.0.787 2010.03.25 BackDoor.PoisonIvy.AD
BitDefender 7.2 2010.03.25 -
CAT-QuickHeal 10.00 2010.03.25 -
ClamAV 0.96.0.0-git 2010.03.25 -
Comodo 4378 2010.03.25 -
DrWeb 5.0.1.12222 2010.03.25 -
eSafe 7.0.17.0 2010.03.24 -
eTrust-Vet 35.2.7387 2010.03.25 -
F-Prot 4.5.1.85 2010.03.24 -
F-Secure 9.0.15370.0 2010.03.25 -
Fortinet 4.0.14.0 2010.03.24 -
GData 19 2010.03.25 -
Ikarus T3.1.1.80.0 2010.03.25 Backdoor.Poisonivy.E
Jiangmin 13.0.900 2010.03.25 -
K7AntiVirus 7.10.1004 2010.03.22 Trojan.Win32.Xorpix
Kaspersky 7.0.0.125 2010.03.25 -
McAfee 5930 2010.03.24 -
McAfee+Artemis 5930 2010.03.24 Artemis!CD73D32FC69E
McAfee-GW-Edition 6.8.5 2010.03.25 -
Microsoft 1.5605 2010.03.25 -
NOD32 4972 2010.03.24 -
Norman 6.04.10 2010.03.24 -
nProtect 2009.1.8.0 2010.03.25 -
Panda 10.0.2.2 2010.03.24 -
PCTools 7.0.3.5 2010.03.25 -
Prevx 3.0 2010.03.25 High Risk System Back Door
Rising 22.40.03.04 2010.03.25 -
Sophos 4.52.0 2010.03.25 Mal/Generic-A
Sunbelt 6075 2010.03.25 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.25 Suspicious.Insight
TheHacker 6.5.2.0.242 2010.03.24 -
TrendMicro 9.120.0.1004 2010.03.25 -
VBA32 3.12.12.2 2010.03.25 -
ViRobot 2010.3.25.2243 2010.03.25 -
VirusBuster 5.0.27.0 2010.03.24 Backdoor.Poisonivy.MM
Information additionnelle
File size: 1536 bytes
MD5...: cd73d32fc69e10e9f4b7c736cfaf2f22
SHA1..: acfa9c1beadfd9021552fe962029d00aea25221a
SHA256: cbe4ce3d527e6d6c0d0c94e9cf5e8b064c4205e35fc31ee99bfd04dfe50c1464
ssdeep: 3:WlWUqt/vllXl+YZcFTS9gXeF+X32ZpfLj4UTqQat4ll/ml8UTXlAkQ9dlllNl/
/w:idq2Vg3F+X32Tj4HYlOFiHUEEu2OuB
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x46ca8aeb (Tue Aug 21 06:49:15 2007)
machinetype.......: 0x14c (I386)
( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe 0x200 0.16 b429b070d0408908f37618354c81acb1
.rdata 0x2000 0x54 0x200 0.62 9469b36bdb6e6a481f3d64647c84b836
( 1 imports )
> kernel32.dll: ExitProcess
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=15781E43006B64C30666003B3C2E0700B79BCD14' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=15781E43006B64C30666003B3C2E0700B79BCD14</a>
This test was done with an unpacked binary. Using a packer increase the results: 27/42 with FSG and 25/41 with MEW. Various Trojan names were listed such as: Vundo, Trojan-Downloader, Backdoor/RBot and so on.
With packed versions, some AV are detecting the file because of an heuristic routine: Trojan.Generic, Win32.Suspicious, Mal/EncPk-BA, Cryp_MEW-11.
Take care with Antivirus Results and learn to decode Trojan Names.
PS: I've edited the post, writing the conclusion in bold. Some people misinterpret this post: this is just a fun test, not an attack against AV vendors.
Tuesday, July 21, 2009
How to hide a known Malware code...
...and remains undetected.
Malware creators have to bypass antivirus protections to infect users. To be undetectable, the executable binary must not have a recognizable pattern.
Packing the file is one of the method used. It was a good trick to hide the code and reduce the size of the binary. But antivirus softwares can detect home made packers, entropy, and most of them can unpack known packers routines to scan the original file.
So, another protection was added to cypher the packed file:
On the picture, the work done in memory:
The executable contains a cyphered UPX binary that contains the malware itself. The first stub uncypher the binary (green arrow).
Let's have a look at the code: in red, the uncypher routine doing the job.
Once done, the code appears in clear. Simple, but effective:
Then the UPX stub unpack the Malware code (blue arrow) and run it.
A well known malware file can be undetectable (until an antivirus detects the first shell).
To remain undetected, the uncypher routine must be often changed:
- Some "junk code" is inserted before and after it (jumps, calls, various real and unnecessary routines),
- Some various protections can slow the analyst work,
- Modification of the file every time it is downloaded. A few bytes are changed (one is enough) to generate a new hash.
Then, every day, a file that contain a well known infection, is released. The file looks new (different size, no recognizable patterns) and malware analysts have to work on it to detect what seems to be new but is NOT. Virus Total returns a poor detection (or 0 detection sometimes).
Malware creators have to bypass antivirus protections to infect users. To be undetectable, the executable binary must not have a recognizable pattern.
Packing the file is one of the method used. It was a good trick to hide the code and reduce the size of the binary. But antivirus softwares can detect home made packers, entropy, and most of them can unpack known packers routines to scan the original file.
So, another protection was added to cypher the packed file:
On the picture, the work done in memory:
The executable contains a cyphered UPX binary that contains the malware itself. The first stub uncypher the binary (green arrow).
Let's have a look at the code: in red, the uncypher routine doing the job.
Once done, the code appears in clear. Simple, but effective:
Then the UPX stub unpack the Malware code (blue arrow) and run it.
A well known malware file can be undetectable (until an antivirus detects the first shell).
To remain undetected, the uncypher routine must be often changed:
- Some "junk code" is inserted before and after it (jumps, calls, various real and unnecessary routines),
- Some various protections can slow the analyst work,
- Modification of the file every time it is downloaded. A few bytes are changed (one is enough) to generate a new hash.
Then, every day, a file that contain a well known infection, is released. The file looks new (different size, no recognizable patterns) and malware analysts have to work on it to detect what seems to be new but is NOT. Virus Total returns a poor detection (or 0 detection sometimes).
Friday, July 17, 2009
is Paretologic a rogue creator ?
Paretologic creates many cleaners (Malware, Registry, Privacy...). XoftSpySE and RegCure are the most known. Recently, MalwareURL flag them as rogue. It's not a surprise, ParetoLogic is considered as rogue by a lot of security analysts.
Why ? ParetoLogix products are not automatically installed by trojan or fake codec. There is no DesktopHijack, constant alert messages, or such well known rogue symptoms. Where is the problem then ?
Affiliates communication. There is an intense communication made by third persons on blogs, google ads, twitter, ...
When ParetoLogic cares about reputation for not being classified as rogue, the company has no control on communication made by affiliates:
Few years ago, SmitfraudFix was spotted by a ParetoLogic Google ad:
Remove SmitfraudFix for good - Free SmitfraudFix scan & Fix
Unethical communication and false information. On some sites, XoftSpySE is proposed with known rogues products:
Another problem is the license. When the free scanner detects an infection. It proposes acquiring (buying) a license from the infected system. This is a very bad idea: the malware may stole identity and credit card informations.
The limit between rogue, PUP and non-ethic is poor. I won't consider it as rogue because of the missing rogue symptoms, but ParetoLogic is certainly not ethical.
hpHosts blog: http://hphosts.blogspot.com/2009/07/paretologic-vs-malwareurl.html
MalwareDiaries blog: http://blogs.paretologic.com/malwarediaries/index.php/2009/07/16/false-allegations-about-paretologic
Edit: Forum thread about this post.
Why ? ParetoLogix products are not automatically installed by trojan or fake codec. There is no DesktopHijack, constant alert messages, or such well known rogue symptoms. Where is the problem then ?
Affiliates communication. There is an intense communication made by third persons on blogs, google ads, twitter, ...
When ParetoLogic cares about reputation for not being classified as rogue, the company has no control on communication made by affiliates:
Few years ago, SmitfraudFix was spotted by a ParetoLogic Google ad:
Remove SmitfraudFix for good - Free SmitfraudFix scan & Fix
Unethical communication and false information. On some sites, XoftSpySE is proposed with known rogues products:
Another problem is the license. When the free scanner detects an infection. It proposes acquiring (buying) a license from the infected system. This is a very bad idea: the malware may stole identity and credit card informations.
The limit between rogue, PUP and non-ethic is poor. I won't consider it as rogue because of the missing rogue symptoms, but ParetoLogic is certainly not ethical.
hpHosts blog: http://hphosts.blogspot.com/2009/07/paretologic-vs-malwareurl.html
MalwareDiaries blog: http://blogs.paretologic.com/malwarediaries/index.php/2009/07/16/false-allegations-about-paretologic
Edit: Forum thread about this post.
Saturday, July 11, 2009
Trojan-Downloader.Win32.FraudLoad
There's not a day I don't read a blog article about FraudLoad "is a new infection", "is DNS.Changer" or wrong informations...
This malware is not new. I've started collecting DNS since April 2009. It have started months before. Here is some of them (forgive me for not listing 'em all. I was a little bored sometimes...)
tubeportalsoftware2008.com,
k-softportal.com,
dbs-softportal.com,
sim-softportal.com,
fhg-softportal.com,
del-softportal.com,
kxc-softwaresportal.com,
kol-development.com,
zaq-softwares.com,
frg-softwares.com,
dec-software.com,
dia-software.com,
knr-softwares.com,
lxl-softportal.com,
kvm-softwares.com,
xxx-softwares.com,
kxc-softwaresportal.com,
cls-softwares.com,
sim-softportal.com,
down-softportal.com,
slk-softwareportal.com,
sdfv-programs.com,
sgh-topprograms.com,
rol-programms.com,
kor-programms.com,
hex-programmers.com,
kir-fileplanet.com,
arch-grandsoftarchive.com,
grandfilesstore.com,
zxc-sofftwares.com,
exe-soft-portal.com,
file-exe-2009.com,
streaming-united.com,
wile-exe.com,
exe-load-area.com,
exe-web-development.com,
groufertation.com,
exe-soft-files.com,
my-exe-profile.com,
exe-file-boom.com,
fast-exe-load.com,
go-exe-go.com,
last-exe-portal.com,
exe-xxx-file.com,
exe-box.com,
hot-exe-area.com,
zone-exe-files.com,
exe-profile.com,
load-exe-soft.com,
let-exe-2009.com,
exe-4free.com,
red-exe.com,
exe-cosmos.com,
exe-online-world.com,
zone-exe-files.com,
hot-exe-area.com,
exe-direct.com,
era-exe.com
...
Contacted hosts are also old. But changing much slower. It was first PE binaries hidden under a picture filename. Then it change to a real pic with extra data (the crypted PE added after the picture data).
imagesaudi.com,
imagesopel.com,
images-humanity.com,
imagescopyleft.com,
texasimages2009.com,
imagesmazda.com,
imagesferrar.com,
caninejoker.com,
imageempires.com,
picturesoffline.com,
imagesmonitor.com,
pictureswall.com,
coolimagepro.com,
portalpics.com,
imagescolor.com,
picturehappiness.com,
picturephotoweb.com,
thenewpic.com,
images-smile.com,
picturephotoweb.com,
theimagesstudio.com,
imageheadphones.com,
pixphotos.com,
imgesinstudioonline.com,
yourimagesstudio.com,
isyouimageshere.com
It is not a DNS.Changer infection (can't remember the blog where I read this). It's a Trojan Downloader. See the previous post about it here.
This malware is not new. I've started collecting DNS since April 2009. It have started months before. Here is some of them (forgive me for not listing 'em all. I was a little bored sometimes...)
tubeportalsoftware2008.com,
k-softportal.com,
dbs-softportal.com,
sim-softportal.com,
fhg-softportal.com,
del-softportal.com,
kxc-softwaresportal.com,
kol-development.com,
zaq-softwares.com,
frg-softwares.com,
dec-software.com,
dia-software.com,
knr-softwares.com,
lxl-softportal.com,
kvm-softwares.com,
xxx-softwares.com,
kxc-softwaresportal.com,
cls-softwares.com,
sim-softportal.com,
down-softportal.com,
slk-softwareportal.com,
sdfv-programs.com,
sgh-topprograms.com,
rol-programms.com,
kor-programms.com,
hex-programmers.com,
kir-fileplanet.com,
arch-grandsoftarchive.com,
grandfilesstore.com,
zxc-sofftwares.com,
exe-soft-portal.com,
file-exe-2009.com,
streaming-united.com,
wile-exe.com,
exe-load-area.com,
exe-web-development.com,
groufertation.com,
exe-soft-files.com,
my-exe-profile.com,
exe-file-boom.com,
fast-exe-load.com,
go-exe-go.com,
last-exe-portal.com,
exe-xxx-file.com,
exe-box.com,
hot-exe-area.com,
zone-exe-files.com,
exe-profile.com,
load-exe-soft.com,
let-exe-2009.com,
exe-4free.com,
red-exe.com,
exe-cosmos.com,
exe-online-world.com,
zone-exe-files.com,
hot-exe-area.com,
exe-direct.com,
era-exe.com
...
Contacted hosts are also old. But changing much slower. It was first PE binaries hidden under a picture filename. Then it change to a real pic with extra data (the crypted PE added after the picture data).
imagesaudi.com,
imagesopel.com,
images-humanity.com,
imagescopyleft.com,
texasimages2009.com,
imagesmazda.com,
imagesferrar.com,
caninejoker.com,
imageempires.com,
picturesoffline.com,
imagesmonitor.com,
pictureswall.com,
coolimagepro.com,
portalpics.com,
imagescolor.com,
picturehappiness.com,
picturephotoweb.com,
thenewpic.com,
images-smile.com,
picturephotoweb.com,
theimagesstudio.com,
imageheadphones.com,
pixphotos.com,
imgesinstudioonline.com,
yourimagesstudio.com,
isyouimageshere.com
It is not a DNS.Changer infection (can't remember the blog where I read this). It's a Trojan Downloader. See the previous post about it here.
Thursday, July 9, 2009
Trojan-Downloader.Win32.FraudLoad
Trojan-Downloader.Win32.FraudLoad (exe-site.com/streamviewer.#.exe) is an "old" infection but I read many times as it is new. It looks new because of the bad AV detections, and because of some tips used by creators.
- The DNS is changing quickly (aroud every 24 hours):
exe-profile.com
load-exe-soft.com
exe-xxx-file.com
exe-box.com
exe-box.com
let-exe-2009.com
exe-4free.com
...
Filenames are composed like necessary software to watch streaming videos: streamviewer.#.exe, flashplayer.v10.#.exe, TubeViewer.ver.6.#.exe (where # is a number of 4/5 caracters).
- File used to be an UPX packed infection and was easy to detect. For some weeks, it is using a stub to bypass Antivirus detection. File is still UPX packed but creators add the stub to cypher it (stub -> UPX -> infection code). The stub code is also quickly modified. This is why a lot of AV are late to detect it.
- At the end of the file there is 8 bytes:
4 bytes for a key (again, quickly modified),
4 bytes for the affiliate ID.
Last 4 bytes is an XOR operation based on # numbers in the filename/webpage and the 4 bytes key. The same file downloaded from a different affiliate website has a different hash...
- Downloaded files used to be executables hidden behind a picture filename. They are now real GIF pictures but the size is too heavy for simple pictures. The infection is cyphered behind the picture data (remember tibs infection ? Where tibs was using a simple XOR encryption routine, this trojan-downloader uses a more sophisticated rout.). Extracted executables are using the same Trojan-Downloader stub method to cypher their code.
- The DNS is changing quickly (aroud every 24 hours):
exe-profile.com
load-exe-soft.com
exe-xxx-file.com
exe-box.com
exe-box.com
let-exe-2009.com
exe-4free.com
...
Filenames are composed like necessary software to watch streaming videos: streamviewer.#.exe, flashplayer.v10.#.exe, TubeViewer.ver.6.#.exe (where # is a number of 4/5 caracters).
- File used to be an UPX packed infection and was easy to detect. For some weeks, it is using a stub to bypass Antivirus detection. File is still UPX packed but creators add the stub to cypher it (stub -> UPX -> infection code). The stub code is also quickly modified. This is why a lot of AV are late to detect it.
- At the end of the file there is 8 bytes:
4 bytes for a key (again, quickly modified),
4 bytes for the affiliate ID.
Last 4 bytes is an XOR operation based on # numbers in the filename/webpage and the 4 bytes key. The same file downloaded from a different affiliate website has a different hash...
- Downloaded files used to be executables hidden behind a picture filename. They are now real GIF pictures but the size is too heavy for simple pictures. The infection is cyphered behind the picture data (remember tibs infection ? Where tibs was using a simple XOR encryption routine, this trojan-downloader uses a more sophisticated rout.). Extracted executables are using the same Trojan-Downloader stub method to cypher their code.
Friday, June 5, 2009
Wednesday, October 29, 2008
Autorun Plasma
Yesterday, I received 2 new PC from my supplier. 2 computers with Windows and last updates. Nothing more, nothing less. Before delivering them to my customer, I checked if everything was Okay.
One of them was infected by VBS.Solow.b. This infection who spreads from USB keys and modifies IE title.
A brand new PC already infected !
I decided to code a quick and dirty program, AutorunPlasma, to place on USB keys root with its autorun.inf file. If the message is displayed when the key is insert, it is Virus Free...
One of them was infected by VBS.Solow.b. This infection who spreads from USB keys and modifies IE title.
A brand new PC already infected !
I decided to code a quick and dirty program, AutorunPlasma, to place on USB keys root with its autorun.inf file. If the message is displayed when the key is insert, it is Virus Free...
Wednesday, October 15, 2008
Malwarebytes' Anti-Malware (MBAM)
I have joined Malwarebytes' team as Malware Researcher.Malwarebytes' Anti-Malware is a new easy-to-use, simple, powerful cleaning application against Malwares.
Sunday, July 20, 2008
MO5.com in danger.
A post in French, for once, about one of my hobby (vintage 8-bit computers): A non-profit association, MO5.com, is in danger. A collection of 30.000 items composed of old school computers might be scattered or disappear.
Suite à la visite d'une commission de sécurité , les locaux où sont entreposés plus de 30.000 pièces (ordinateurs, consoles, magazines, CD et diverses geekeries) ont été jugés dangereux.
Cette commission demande le départ de cette fabuleuse collection, seulement l'association n'a pas les moyens logistiques et financier pour rebondir.
C'est pourquoi MO5.COM demande un coup de main à tous les geeks/geekettes de France, pour sauver de l'anéantissement tout ce travail.
Pour plus d'informations, rendez-vous sur leur lettre de soutien.
Suite à la visite d'une commission de sécurité , les locaux où sont entreposés plus de 30.000 pièces (ordinateurs, consoles, magazines, CD et diverses geekeries) ont été jugés dangereux.Cette commission demande le départ de cette fabuleuse collection, seulement l'association n'a pas les moyens logistiques et financier pour rebondir.
C'est pourquoi MO5.COM demande un coup de main à tous les geeks/geekettes de France, pour sauver de l'anéantissement tout ce travail.
Pour plus d'informations, rendez-vous sur leur lettre de soutien.
Subscribe to:
Posts (Atom)
