ok , so we know spywareno and spysherrif are the exact same program only with a diff name now ..
Spyware Blog:
http://netrn.net/spywareblog/archives/2005...eno-has-a-twin/
Lavasoft Research:
http://www.lavasoftresearch.com/spywareno.shtml
Just a few of the most recent additions to the excellent spywarewarrior rogues gallery:
http://www.spywarewarrior.com/family_resemblances.htm#15
Well here's a closer look at the hijack methods they use to infect unprotected people with their junk , and try and trick them into buying a program to fix the infection that was caused by the installation of their program , not to mention the trojans that come with it.
Looks extremely similar to the searchterror hijack logged by the webhelper here:
http://www.webhelper4u.com/CWS/Research/sc...rordesktop.html
Thanks to the Webhelper for his help with the hijack links.
You will need to log in if you want to see the hijack pics on the page instead of clicking on and opening each one ..
These are the results of the second infestation log
-----------------
File details:
-----------------
C:\WINDOWS\System\svchost.exe
C:\WINDOWS\System\svchost.dll
C:\WINDOWS\System\svchosthook.dll
C:\WINDOWS\System\loader.dll
C:\WINDOWS\System32\web.exe
C:\WINDOWS\System32\kernels32.exe
C:\winstall.exe
------------------------
files in system32 folder:
------------------------
web.exe
vxgame4.exe
thun32.dll
thun.dll
vxgame3.exe
init32m.exe
vxgame1.exe
maxd.exe
vx.tll
vxh8jkdq7.exe
bre32.dll
bre.dll - http://www.sophos.com/virusinfo/analyses/trojdloaderof.html
vxh8jkdq6.exe
vxh8jkdq5.exe
vxh8jkdq2.exe
vxh8jkdq8.exe
vxh8jkdq1.exe
sys3157.exe
rundll32.exe
---------
Trojan Files identified with TDS-3 :
---------
Scan Control Dumped @ 13:44:57 05-06-05
RegVal Trace: RAT.Glacier: HKEY_LOCAL_MACHINE
File: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
[ WindowsUpdate=C:\WINDOWS\System\svchost.exe /s ]
Positive identification (DLL): RAT.Agent.iw1 (dll)
File: c:\windows\system\svchost.dll
Positive identification (DLL): RAT.Agent.iw2 (dll)
File: c:\windows\system\svchosthook.dll
Positive identification (embedded in file): TrojanDownloader.Win32.Agent.ho4
File: c:\windows\system32\init32m.exe
Positive identification: TrojanDownloader.Win32.Agent.ho4
File: c:\windows\system32\init32m.exe
Positive identification: TrojanDownloader.Win32.Small.aqu
File: c:\windows\system32\kernels32.exe
Positive identification (DLL): TrojanProxy.Win32.Small.bk2 (dll)
File: c:\windows\system32\thun32.dll
Positive identification: TrojanDropper.Win32.Small.wv1
File: c:\windows\system32\vxgame1.exe
Positive identification (embedded in file): TrojanDownloader.Win32.Agent.ho4
File: c:\windows\system32\vxgame3.exe
Positive identification: TrojanDownloader.Win32.Agent.ho4
File: c:\windows\system32\vxgame3.exe
Positive identification: TrojanDropper.Win32.Small.wp1
File: c:\windows\system32\vxh8jkdq1.exe
Positive identification: Hoax.Win32.Renos.a1
File: c:\windows\system32\vxh8jkdq2.exe
Positive identification: TrojanDownloader.Win32.Small.aqu
File: c:\windows\system32\vxh8jkdq6.exe
Positive identification: TrojanDownloader.Win32.Small.aqu
File: c:\windows\system32\vxh8jkdq7.exe
Positive identification: TrojanDropper.Win32.Small.wp1
File: c:\windows\system32\vxh8jkdq8.exe
Positive identification: TrojanDownloader.Win32.Small.aqu
File: c:\windows\system32\web.exe
------------------------------------------------------------------------------
Hidden svchost.exe system trojan :
= 04 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System\svchost.exe /s
Name: WindowsUpdate
Type: Machine Startup
Path: c:\windows\system\svchost.exe
Registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
= C:\WINDOWS\System\svchost.dll -
= C:\WINDOWS\System\svchosthook.dll - terminates / denies program execution
Seems to be mostly covered on this symantec page.
http://securityresponse.symantec.com/avcen...r.shellbot.html
well the svchosthook.dll hooks into all running processes from what I could see , and it prevents any new processes from running , including spysheriff lol , which tried to run and crashed.
It even killed my Regrun process manager...
If anyone of my security programs werent already running then it was usless , just wouldnt start. Some that were already running wouldnt work properly until I killed svchosthook.dll.
Hijack this could scan but would crash trying to save a log each time.
svchosthook.dll wasnt a hidden file so I could find it easily. I unloaded the .dll from most processes that it was hooked into and all my programs were working again. 8)
Then removed the hidden, system and read only attributes from the svchost.exe and .dll files before I could get a copy and then kill them.
The svchost.exe I had to delete on reboot , couldnt kill it any other way.
They kill the taskmanager and hosts file really easy.
----------------
= 04 - HKCU\..\Run: [Windows installer] C:\winstall.exe
Inside the winstall.exe file is the desktop hijack html file:
---------------------------------------------------------
html
head
title SYSTEM STOPPED title
script lagnuage javascript
SYSTEM STOPPED
System has been stopped due to a serious malfunction. Spyware activity has been detected.
It is recommeded to use spyware removal tool to prevent data loss.<br>
Do not use the computer before all spyware removed.
GET /trial.php?rest=%u&ver=%u&a=00000002 HTTP/1.0
Host: www.spysheriff.com
69.50.170.83
GET /notifydownload.php?a=00000002 HTTP/1.0
Host: www.spysheriff.com
WallpaperLocalFileTime
WallpaperFileTime
ComponentsPositioned
TileWallpaper
WallpaperStyle
SOFTWARE\Microsoft\Internet Explorer\Desktop\General
Wallpaper
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ForceActiveDesktopOn
ClassicShell
NoDesktop
NoActiveDesktop
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoHTMLWallPaper
NoEditingComponents
NoDeletingComponents
NoAddingComponents
NoComponents
NoChangingWallpaper
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
%s\desktop.html
C:\Program Files\SpySheriff\SpySheriff.dvm
C:\Program Files\SpySheriff\%s
C:\Program Files\SpySheriff
C:\Program Files
Windows installer
C:\winstall.exe
SNInstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
C:\Program Files\SpySheriff\SpySheriff.exe
C:\Program Files\SpywareNo\SpywareNo.exe
----------------------
= 04 - HKCU\..\Run: [SpySheriff] C:\Program files\SpySheriff\SpySheriff.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpySheriff
[Applications] SpySheriff=C:\Program Files\SpySheriff\Uninstall.exe
-----------------------
= C:\Windows\System\Loader.dll : LModule0002
Name: Loader Class
Type: BHO
Path: c:\windows\system\loader.dll
Registry: {2E246FAE-8420-11D9-870D-000C2917DE7F}
-----------------------
Once the spysheriff program is installed , clicking on anything in the program will bring up a prompt to buy the program...
- hxxp://www.spysheriff.com/license.php?
even says it offers an application firewall as part of the features lol.
-----------------------
And shortly after , the popups start to appear , identical to spywareno:
------------------------