Sunday, August 24, 2008

IE Defender, Files Secure, Malware Bell, IE Antivirus

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs a file with semi-random filename composed from a dictionary:
z, d, y, a, w, r, o, v, l, 32i, 2, k

Possible filenames are:
zao32i.dll, dao32i.dll, yao32i.dll, zwo32i.dll, dwo32i.dll, ywo32i.dll, zro32i.dll, dro32i.dll, yro32i.dll, zav32i.dll, dav32i.dll, yav32i.dll, zwv32i.dll, dwv32i.dll, ywv32i.dll, zrv32i.dll, drv32i.dll, yrv32i.dll, zal32i.dll, dal32i.dll, yal32i.dll, zwl32i.dll, dwl32i.dll, ywl32i.dll, zrl32i.dll, drl32i.dll, yrl32i.dll, zao2.dll, dao2.dll, yao2.dll, zwo2.dll, dwo2.dll, ywo2.dll, zro2.dll, dro2.dll, yro2.dll, zav2.dll, dav2.dll, yav2.dll, zwv2.dll, dwv2.dll, ywv2.dll, zrv2.dll, drv2.dll, yrv2.dll, zal2.dll, dal2.dll, yal2.dll, zwl2.dll, dwl2.dll, ywl2.dll, zrl2.dll, drl2.dll, yrl2.dll, zaok.dll, daok.dll, yaok.dll, zwok.dll, dwok.dll, ywok.dll, zrok.dll, drok.dll, yrok.dll, zavk.dll, davk.dll, yavk.dll, zwvk.dll, dwvk.dll, ywvk.dll, zrvk.dll, drvk.dll, yrvk.dll, zalk.dll, dalk.dll, yalk.dll, zwlk.dll, dwlk.dll, ywlk.dll, zrlk.dll, drlk.dll, yrlk.dll

It displays alert messages with popups that download IE Antivirus:

Use SmitfraudFix to remove the infection.