Posted on 03/03/2005 1:39:36 PM PST by holymoly
Security experts issued a warning this morning after detecting infections caused by Searchmeup, the first adware to use the Exploit/LoadImage vulnerability which downloads itself onto computers without the user's permission.
Panda Software's PandaLabs warned that the pages from which Searchmeup are downloaded also contain a series of exploits to download other malware onto the computer, such as the Tofger.AT Trojan, which steals banking passwords, Dialer.BB and Dialer.NO, and adware called Adware/TopConvert.
Searchmeup is downloaded onto the computer when the user visits maliciously coded web pages. Once installed it changes the home page to that of a search engine that displays pop-ups every time it loads with the aim of installing spyware and diallers on infected computers.
Searchmeup affects computers running Windows 2003, XP, 2000, NT, Me and 98, and allows arbitrary code to be run.
It could be exploited by an attacker hosting a specially crafted cursor or icon on a malicious web page or HTML email. Microsoft has released a patch to correct this problem, and users are advised to install it immediately.
The web pages from which Searchmeup is downloaded also drop Tofger.AT onto computers, a Trojan which runs every time Internet Explorer is opened.
Tofger.AT keeps track of the user's internet activity, logging passwords for secure 'https' connections which are often used for connections with online banks. Once it has collected this information, Tofger.AT sends it to a remote server.
Searchmeup can also generate an error in the 'services.exe' file, informing users that the computer will be restarted in one minute.
After the restart, the computer operates perfectly. On some occasions Searchmeup can also display blue screen errors, and Tofger.AT can actually update itself to a new version.
"The Exploit/LoadImage vulnerability can be used on web pages or HTML email by crafting a special icon or image file that causes a buffer overflow that in turn can be used to take control of the user's computer," said Patrick Hinojosa, chief technology officer at Panda Software US.
"This can be very serious as the user does not have to do anything unusual like opening a suspicious attachment. This is what is sometimes referred to as a 'drive by' attack."
Luis Corrons, director of PandaLabs, added: "The appearance of Searchmeup is a sign of the continuous evolution of malware, and of spyware and adware in particular.
"The first stage was that adware reached computers as a component of a freeware application, then web pages appeared that installed adware on users' computers using ActiveX.
"Now they have gone a step further, as Searchmeup exploits a vulnerability that even virus creators had not used until now."
And that clear plastic packaging that is so impossible to get into.
BS.
Note that IE doesn't need to be running to be vulnerable; that's just one of the many benefits derived from tight OS/browser integration.
Maybe using a variation of Internet goat hunting, but with a robotic boxer we can take turns controlling? After sentencing, of course.
bttt
Mozilla and Firefox have two features which I value.
The first is cookie management, which allows you to prohibit the sites you choose from placing cookies on your system.
The second, of course, is tabbed browsing, where you may have any number of sites open within the browser.
There are probably others I'm forgetting.
I have nearly 300 cookies, is that bad?
Whatever. Fact is that Firefox Downloaded 4, not 1, not 2, not 3, but FOUR trojans.
Fact is that with Norton, the same sites failed to penetrate IE. But I see this kind of blind fanboyism all the time online by hyped pseudo 'experts'. Excuse me whilst I roll my eyes at you.
There.
Your opinion doesn't change my log files, nor the fact that Firefox was wide open. I call BS on your assertion - because where I'm from facts speak louder than fanboyism.
If you aren't able to secure IE then I suggest that you don't have the backing of your so ineloquent and sophomoric barb.
When I scanned at Panda I got a virus alert from AntiVir and the scan did not complete.
So I deleted the virus, dumped the cache and aborted the Panda scan.
Has this ever happened to anyone?
Excuse my ignorance but what is cache?
If I may horn in for a moment, two well-recommended free antiviruses, which install on your drive, are:
AVG 7.0 free edition
http://free.grisoft.com/freeweb.php/doc/2/
Free avast! 4 Home Edition
http://www.avast.com/eng/avast_4_home2.html
In addition, it doesn't hurt to run an onlinescan, which sometimes catches things- this one:
HouseCall
http://housecall-beta.trendmicro.com/en/start_corp.asp
has been upgraded to scan for viruses, trojans, spyware, and security holes.
In Nazi Germany, this was the case.
Of course, the Nazi's all used Macs.
I love WinPatrol for many things, but the ability to see and discard the cookies you don't want is the greatest.
Thanks holymoly for Scotty the WinPatrol dog!!
Others can be less nice, tracking your surfing habits, etc.
They must think I am the most boring person on the planet. :-)
Cautionary notice: I just did an auto-update from Trend Micro.
New Virus Pattern Release
Pattern Version: 2.466.00
Release Type: New Malware Threat
Notes: WORM_AGOBOT.AMH, WORM_AGOBOT.AMI, WORM_AGOBOT.AMK
March 03, 2005, 06:04:24 (GMT -08:00)
Nice speech.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.