S!Ri.URZ

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-24T23:02:00.000+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: dom, hom, sof, ie, bho, iebho

Files could look like: domie.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-23T13:32:00.001+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: bho, bho2, ie, ext, extn, _e

Files could look like: bho2extn.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

Zlob

2008-07-22T12:08:00.001+02:00

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\uszhv.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{629340b5-8df6-4211-9245-a86563a35792}"="cramping"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-20T22:13:00.000+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: ie, iex, IE_, filter, flt, fil

Files could look like: iefilter.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

MO5.com in danger.

2008-07-20T18:11:00.009+02:00

A post in French, for once, about one of my hobby (vintage 8-bit computers): A non-profit association, MO5.com, is in danger. A collection of 30.000 items composed of old school computers might be scattered or disappear.

Suite à la visite d'une commission de sécurité , les locaux où sont entreposés plus de 30.000 pièces (ordinateurs, consoles, magazines, CD et diverses geekeries) ont été jugés dangereux.
Cette commission demande le départ de cette fabuleuse collection, seulement l'association n'a pas les moyens logistiques et financier pour rebondir.

C'est pourquoi MO5.COM demande un coup de main à tous les geeks/geekettes de France, pour sauver de l'anéantissement tout ce travail.

Pour plus d'informations, rendez-vous sur leur lettre de soutien.

Zlob

2008-07-19T23:45:00.000+02:00

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\xevhbpw.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{201a14d7-b5b4-422c-816f-5f2a1e92e0e7}"="incorrectnesses"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-19T16:12:00.002+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: tb, toolbar, tbr, srch, s, sch

Files could look like: toolbars.dll, tbrsrch.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-12T17:47:00.001+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: ie, iexp, inte, fltr, fl, _f

Files could look like: iefltr.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-09T08:48:00.001+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: nav, nvg, nv, filter, flt, f

Files could look like: nvgflt.dll, nvgf.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-07T22:15:00.001+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: eps, epson, eps, drv, bho, 32

Files could look like: epsdrv.dll, epsondrv.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

Fake Cracks/Keygen Video

2008-07-06T23:50:00.006+02:00

Following the serie Zlob for dummies, MAD made a video of the consequences of running a Trojan from a Fake Crack Blog. (MAD Article)

Zlob

2008-07-04T23:44:00.000+02:00

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\hkushdr.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d1577581-2ed7-469f-99b1-72c1339e0ee0}"="doctordom"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-04T20:08:00.002+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: avg, ant, avira, safe, _sr, _ss

Files could look like: avg_sr.dll, avirasafe.dll, ant_ss.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-03T10:46:00.001+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: agin, snop, wdol, _bho, tas, o32

Files could look like: agintas.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-07-02T13:36:00.001+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: sl, ps, dig, a32, onyx, arox

Files could look like: slarox.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

Zlob

2008-07-02T13:23:00.001+02:00

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\blbpeoy.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{ecc974ae-6ede-44a2-90da-93b996d8eaf8}"="frizzed"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.

Zlob for dummies.

2008-07-01T09:01:00.005+02:00

MAD wrote a topic (french) about Zlob infections.

The second part is less technical and speaks about infected victims. Some users have irresponsible comportments that lead to infection. This can sometimes be resumed as: I have an Antivirus suite, I'm ~~safe~~ still vulnerable.

Image Copyright: IKARUS Security Software GmbH.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-06-23T23:36:00.000+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: opus, sigma, nada, 64, 32, 16

Files could look like: sigma64.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

Zlob

2008-06-23T23:01:00.000+02:00

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\sgntu.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c27abdde-8a43-4a7f-81c0-3fc3c952284f}"="chicot"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.

Zlob, fake download

2008-06-19T12:08:00.003+02:00

Fake site proposing software download (or Keygen/Crack) installing a Zlob Malware.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-06-18T15:29:00.000+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: da, co, i, def, pol, ni

Files could look like: dadef.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

Zlob

2008-06-18T00:07:00.000+02:00

Zlob fake codec has been update. It drops the following file:

%SYSTEM%\funfsnv.dll

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{99f8405b-63d1-421a-83bb-7b4b0642ac28}"="eulogical"

It also installs Toolbar, BHO, Antispycheck Rogue software...

SmitfraudFix removes the infection.

IE Defender, Files Secure, Malware Bell, IE Antivirus

2008-06-17T13:40:00.004+02:00

IE Defender/Files Secure/MalwareBell/IE Antivirus Codec has been update, it installs files with semi-random filenames, composed from fragment words: x, c, s, edif, osys, ecol, ns, pd, gd, a, o, y

Files could look like: cosysnsy.dll, xecolgda.dll ...

and displays alert messages with popups:

Use SmitfraudFix to remove the infection.

VideoAccessCodec (VAC)

2008-06-16T23:51:00.001+02:00

VideoAccessCodec has been update, it installs the following files:

%WINDOWS%\ksendlbt???.dll (where ? is a random caracter)
%WINDOWS%\vrmdtneg.dll
%WINDOWS%\xvorfwbd.dll
%WINDOWS%\wpvmqosg.dll
%WINDOWS%\neltabxw.exe
%WINDOWS%\e???.exe (where ? is a random caracter)

Use SmitfraudFix to remove the infection.

Zlob, fake download

2008-06-16T13:19:00.006+02:00

Zlob infections are related to p0rn sites !
This used to be true but it is not anymore. After Fake Codec Errors , Fake Flash Errors, Fake Flash Version, Faked MP3 Download.
Zlob infections familly (Rogue installer Antispycheck/IEAntivirus, DNS Changer, VAC) is also spread on Fake Cracks/Warez Blogs or Fake Softwares Downloads WebSites.

Notice the "*100% checked by Antivirus" comment ;)