ZeroAccess Part 3: How to stop it.

If you have read Part 1 and Part 2, you should have a pretty good idea of what ZeroAccess is and how dangerous it is. In this post, I will go through multiple methods of removal that I have found while searching the web.

1. Tools
1. cleanpcguide.com has a removal tool that you can download here
2. Use ESET's removal tool downloaded here
3. Use McAfee's RootkitRemover, available here
2. Manual Removal (as Provided by   http://www.cleanpcguide.com/remove-zeroaccess-removal-guide-how-to-remove-zeroaccess/ )
1. Stop ZeroAccess process using the windows task manager. (This will most likely be some random name, if you see a process that you do not recognize, right click and view location to find files associated with it, this will be needed in step 4, then end it.)
2. Uninstall ZeroAccess program from windows control panel Add/Remove Programs. (control panel --> Programs --> Remove/change, then find something you think looks fishy, or do not remember installing)
3. Open windows registry using regedit.exe command. Find and Remove all ZeroAccess Registry Files. (will usually be under the HKLM or HKCU run directory (startup registry))
4. Search for ZeroAccess Files on your computer and delete it. (files found in step 1)

If none of these work, the malwarbytes community is very helpful. You can ask for help here.

Tell me what you thought of this three part series, and remember to comment what I should blog about next.

ZeroAccess Part 2: What does it do?

First off, sorry this took so long. It is finals week so I have been quite busy.

Overview


ZeroAccess will install 2 different versions of itself depending on the system architecture (32 or 64 bit). Once it has dropped the correct version, and elevated it's privileges, it starts talking with other infected machines to get  instructions. Most of the time, it is used to "Sell Installs". That is, other "hackers" can pay someone to install their virus onto the already infected machines. One of the most popular viruses that is installed with ZeroAccess is Zeus (see Zeus Continues to Evolve and New Variant of Zeus includes Ransomeware). Once that is installed, the "hacker" can steal your personal data including, but not limited to, your credit card number, login credentials to different sites (including banking sites) etc.

Installation

• 32 bit
• When file dropper is executed, it checks whether it is on a 32 or 64 bit computer, then installs the corresponding kit. If it is on a 32 bit machine, it drops a kernel mode or Ring-0 rootkit. It drops itself into a hidden folder. It adds itself to startup, and checks it's list of predetermined C&C (Command and Controls). it then attempts to connect to them on TCP port 13620 and awaits commands.
• 64 bit
• The 64 bit version of ZeroAccess does not have a Ring-0 rootkit. It does, however, have a Ring-3 or User-mode kit. When initiated, it attempts to raise it's privileges as described in part 1. Once that is done it protects its process (makes it harder to kill) and waits for commands.

Communication

The virus comes with a list of known IPs of infected machines. If these machines have UPNP enabled and the ports are properly opened, they become server nodes. If not, then they are just clients. Once it has succesfully made a connection, it is added to the other bots list, and updates its own list. It then periodically checks in with the other servers to see if any new commands were issued. The bot uses TCP port 13620 to connect to others. All communication is encrypted with RC4 encryption. 

Monetizing

The virus is most commonly used to install other viruses like Zeus. It also downloads a click fraud virus. This virus is almost always seen with ZeroAccess, so it is thought that it may be authored by the creator of ZeroAccess. And finally, it downloads a spam bot. This is a virus that is used to send spam, junk, or infected links via e-mail.

Conclusion

This is a very sophisticated piece of malware, and while it may not yet be on par with the TDL family, it is definitely getting there. While it is already dangerous now, imagine what it could become capable in 5 or 10 years from now. As soon it is detected, this must not be ignored. the only way to stop it effectively is to completly remove it from the system. While it is currently only used to download malware to monetize, this could and most likely will change as the owner rents out space and allows other files to be downloaded.

Credits to McAfee labs, Sophos, and PrevX

ZeroAccess Part 1: What is it

ZeroAccess is quickly becoming one of the go to rootkits, and may surpass the TDL family in the coming years. Machines are most commonly infected using 2 techniques, the first being through an exploit kit, the second being Social Engineering.

BlackHole Exploit Pack
Infection Statistics

Let's first take a look at how the exploit kit infection works. First, an Exploit Pack, is a webpage that is designed to exploit software commonly installed on computers, such as Flash, Java, Internet Explorer, etc. It tries to find loopholes to let it silently download and execute a program on the victims computer. Most Exploit Packs use outdated exploits that are already patched, although, a few extremely high-end packs use what are known as "0-Day" exploits. This means that it works for the newest version of exploited software, and is not yet know/detected. To drive traffic to these exploits, "hackers" find holes in legitimate websites, and embed a small code into the pages that will direct the user to their site unknowingly. This is most often done through an "IFrame" set to be 0px wide and 0px high. Since the user does not need to see or interact with the exploit site, this works perfectly. Sometimes a JavaScript is embedded, although this is less common as some web hosts have JavaScript disabled, and it is more noticeable. The exploit then goes through its list of exploits, and, if one is found working, downloads and executes the payload (ZeroAccess).

Figure 1.1

Sometimes, the "hacker" uses Social Engineering techniques to try and get the user to willing download and execute the file. This is usually done by attaching the file to some sort of program crack or keygen. The "hacker" will bind his virus (ZeroAccess) to the crack, and then upload it to a filehost, or torrent host. The user will download and execute this file and, since it works, won't be very suspicious. The "hacker" can also use something called a "Java Drive By". This is more of a mix of exploit and Social Engineering. The "Hacker" sets up a site where there is a browser game or camera that needs Java to run. When the victim goes to the website, he will first be prompted to allow java to run (see Figure 1.1), then he will be asked to download and install an "update". This update, of course, is actually the "hackers" virus. Then, once the user clicks ok, the page will "refresh" and the application that required Java will work. The user, being satisfied that it works, will not suspect a thing.

Figure 1.2

When the virus is executed, it first checks what architecture the computer is (32 or 64). It then drops the related file and dies. Once the file is dropped, if execute on a non-admin account, it will require a UAC popup window . It does this by acting as if it is an official adobe update. It replaces a .dll inside of the adobe installer folder, and prompts the user to download the update (see Figure 1.2). This "update" actually downloads the latest flash player, but also gives the virus admin permissions. It then goes on to connect to other infected computers, and await orders.

Stay tuned for Part 2: What does it do
then later, the final part Part 3: How to stop it

Credits to McAfee labs, Sophos, and PrevX

Open Source Malware: Is It Worse?

Lately alot of malware has been released "Open Source" meaning that it comes with the source. some bots that come this way are:

• µBOT
• Aldi Bot
• vnLoader
• osRat
• Darkflame
• Zeus 2.0.8.9

Now, why would these be more trouble, open source means easier to detect correct? While this is true, it also means that it can be easily modified without the need of s program called a "crypter." This means that any average joe can come along, download these sources, change the string names and it will be harder to detect. While this alone will not make the file FUD (fully un-detected), there are a few other tricks that more well-versed users can use. This also means that the "hacker" can create modifications to the code, and have a virus that is a lot "deadlier", if you will, than it originally was. Granted this requires that the "hacker" has at least some basic coding knowledge, but there are plenty of tutorials out there that can make most people into malware coders in no time (although don't expect to code the next Zeus anytime soon). 

So, you might ask yourself, what is a good Anti-Virus to protect us from these mods?

• ESET SMART SECURITY is a pretty good AV.
• Malwarebytes Anti-Malware is also pretty good.

I also mentioned some coding tutorials,

• Coding for Penetration Testers: Building Better Tools
• Malware, Rootkits & Botnets A Beginner's Guide

Those two are some very basic books for those who want to learn more.'

So, what do you think? Is Open Source worse for us? Why or why not?

also remember, tell me what you want to hear about next!

McAfee Labs Threat Report for Q1 2012

Here is just a brief overview of what is happening in the cyber underworld according to McAfee;

1. People are starting to use rootkits more
• almost 200,000 new rootkit samples in this quarter
• Koutodor is at about 50,000 new samples
• TDSS is falling (about 100,000, down from 120,000)
• ZeroAccess is still becoming more popular (about 170,000 new samples)
2. Fake AVs are still going strong (690,000 new samples)
3. Autorun samples are about the same as last quarter (480,000)
4. Password stealers are extremely popular it seems. (1mil new samples)
5. Signing malware is also becoming more of a habit for "Hackers" (about 325,000 total samples of signed binaries, about 200,000 new)
6. Mac malware is once again dwindling (280 new samples)
7. fake AV for Mac is a little higher than last quarter, but still fairly low (about 150 new samples)
8. Spam is Extremely low, and still falling (a little over a trillion messages per month)
9. Large botnets are on the rise again (about 5mil infections)
• Cutwail net is leading the rest by a fairly large margin
10. Bad rep URLs are down again (about 7,500 new URLs)
11. Drivebys and silent infection sites are up (about 800,000 malicious URLs)
12. phishing sites are still down, but quickly rising (about 4,100 new sites)
13. Hacktivism is also on the rise as many are taking up their cyber-arms to stick it to the man

Read the full report Here
Remeber to comment what I should post about next.

New variant of Zeus includes ransomware.

Ransomware is quickly becoming one of the more popular malware features. It encrypts all the users files, disabling them from doing anything unless a certain sum of money is sent to a specified account, usually via liberty reserve. A new Zeus variant has been discovered that also has this feature. Some of the code is shown below in Figure 1.

Figure 1

While this is dangerous, and probably still not yet fully implemented, it is very simple to unlock your computer. Once you make the payment, a new registry entry is created that prompts Zeus to un-encrypt your files. This makes it quite simple to remove the encryption. Here are steps to follow.


1. boot the system in safe mode
2. add a new key named syscheck under HKEY_CURRENT_USER
3. create a new DWORD value under the syscheck key
4. set the name of the new DWORD value to Checked
5. set the data for the Checked value to 1
6. reboot

This should cause Zeus to un-encrypt all your files and you can remove it from there (simply run a virus scan using something like: Norton AntiVirus 2012 or Malwarebytes Anti-Malware

thanks for reading, remember to comment on what I should post next.
credits to The Hacker News for images and un-encryption steps and research data

Adware is making a comback

Browser extensions are now being used by adware developers to inject ads into websites. Many Wikipedia users have been complaining of ads being displayed on its site, while Wikimedia has stated that they will not put up adds. Wikimedia is a non-profit and will never display ads on their site, so if you see them, you most likely have a bad browser extension.

Not only do these adware extensions cause annoying ads, some of them are even used for more sinister purposes. One extension mentioned by wikimedai called "IWantThis!" is spyware that is masquerading as adware. In its privacy policy it states:

Examples of the information we may collect and analyze when you use our website include the IP address used to connect your computer to the Internet; login; e-mail address; password; computer and connection information such as browser type, version, and time zone setting, browser plug-in types and versions, operating system, and platform; the full Uniform Resource Locator (URL) clickstream to, through, and from the Site, including date and time; cookie; web pages you viewed or searched for; and the phone number you used to call us.

Some of these extension may come bundled with freeware downloaded from other sites, and be installed involuntarily. Many of these extensions target Chrome as the go to browser, but are very capable of being installed on other browsers as well. Few antivirus software will actually scan or detect faulty or malicious browser extensions so it is up to you to keep yourself secure. Never install toolbars or extensions that promise "free cursors", "free games", etc. Regularly check through your extension/toolbars/addons and disable/remove those that you are not using or did not install. And, as always, do not download or install anything fishy.

Remember to post in the comments what you would like to see next.

Zeus continues to evolve.

Zeus, a popular banking bot, continues to evolve.  It now has a feature called "web-fakes", it mirrors a website. such as bank of america, and now, rather than just stealing your info, prompts the user to use a "secure mobile app". The app, nicknamed "Zitmo" acts as an official app but steals your info and is capable of hijacking your account. SpyEye, a competitor to Zeus, also has a feature like this now, nicknamed "Spitmo". The source for Zeus v2.0.8.9 is available on many sites, and will be linked at the conclusion of this blog for those interested in studying it. SpyEye, on the other hand, is more protected, and while there are tutorials on how to crack it, it is not as simple, and only works on windows XP as it exploits a faulty timer. Both of these bots have been modified many times into many different versions, and there are even rumors of a p2p version of these bots. A tutorial on how to crack SpyEye can be found on http://xylibox.blogspot.com/2011/08/cracking-spyeye-13x.html (A link to SpyEye will also be added to the end of this post for those who want to study it). Both of these bots have been used by huge banking and carding rings and are not to be used for any illegal purposes.

• Zeus (password: zeus)
• SpyEye

As always, post in the comments what you would like to see next.

Android malware spreads through bogus apps

Android is quickly becoming a very popular OS for malware developers. Android apps can be coded in java, a very simple language that can be picked up by anyone. Recently, many viruses have been created and put up for download on third party android app stores. These "apps" mimic there intended clone but add malware functionality such as connecting to a webpage and waiting for orders. This can cause high wireless web traffic causing your phone bill to go up drastically if you are not so fortunate as to have an unlimited data plan. Let's try to make this a little simpler. Lets say you don't want to pay for angry birds, so you go find someplace to download it free. What you don't know is that this is not only angry birds, but it also has a virus attached. The virus can be so small (under 100kb) that you don't even notice the difference in size. Once angry birds is initialized, your phone connects to a website and awaits further instruction.
Some ways that you can prevent this is by

• Get an Android antivirus (such as Symantec Mobile Security )
• Make sure you trust the source you are downloading from (if it seems too good to be true, it is)
• Download only from the legitimate source (Android marketplace)

As always, post a comment for what I should post about next

Source:

Bogus Facebook apps spreading Android malware : The Hacker News ~ http://thehackernews.com/2012/05/bogus-facebook-apps-spreading-android.html

Downloads to watch out for

Hello again everyone,
It has come to my attention that many people are looking for a Diablo III crack. I know the game looks amazing, and I myself can't wait for one to come out so I can try it. I urge you DO NOT download any "crack" links you find, they are fake and filled with malware. I assure you that as soon as I find a crack and confirm it works and is not infected, I will tell you all about it and where to get it. If you have downloaded a "crack" and found it to not be working, please run Malware Bytes to remove any and all possible viruses attached to it. Here is a picture depicting a "hacker" bragging about how many virus installs he got.


I also urge to scan all downloaded files before executing them.

 If you have any link you would like me to check out, or any safety tips, please post them in the comments.
And, as always, comment if you have suggestions on topics for my next post.

New worm, spreads through IM

A new worm has been detected that spreads through things like facebook private messages. It is detected as WORM_STEKCT.EVL the malicious file name is "May09-Picture18.JPG_www.facebook.com" . The actual link to the malicious file is shortened using the popular shortening service called TinyURL. Once executed, the file disables all process associated with anti-virus. It then downloads another worm called WORM_EBOOM.AC. This worm monitors your internet usage and attaches itself to messages you post or send. Both these worms connect to a website and send/receive data from it.


How to prevent getting infected:

• Scan all files before running. Most viruses will be detected, I recommend Malware Bytes
• When you run a file downloaded, use a VM
• Regularly scan your system for viruses, and clean your cache, many viruses drop themselves here
• Don't download anything you don't fully trust, chances are, it's a virus.

That's all for now, be sure comment with other suggestions on how you keep yourself secure and what I should talk about next.