C.I.S.R.T.

Really No Storm Codec on Your PC?

Wed, 09 Apr 2008 12:13:44 +0000

Zhelatin gang has updated its tactic again today. We've received its new spams. In the latest spams, a malicious domain "supeas.com" was contained. Besides spams, we also found this malicious domain was posted on lots of blogs.

Two files, "StormCodec.exe" and "StormCodec8.exe", will be downloaded. Kaspersky detects them as Email-Worm.Win32.Zhelatin.wt.

Here is the screenshot of this malicious site:
............

Tags - email-worm.zhelatin , stormcodec.exe , stormcodec8.exe , zhelatin.wt

Adobe Flash Player Bulletin: APSB08-11

Wed, 09 Apr 2008 11:30:44 +0000

Adobe released a security bulletin: APSB08-11.

According to Adobe summary:

Critical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities. It is recommended users update to the most current version of Flash Player available for their operating system.

Affected software versions:

Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier

............

Tags - adobe , flash , player , vulnerability , 9.0.124.0

Microsoft April 2008 Patch Day

Wed, 09 Apr 2008 11:15:38 +0000

It's April 2008 Microsoft patch day today.

Microsoft released 8 bulleins for this month. Five of them are Critical, three of them are Important. Please update at once.

MS08-018:Vulnerability in Microsoft Project Could Allow Remote Code Execution (950183)

MS08-019:Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (949032)

MS08-020:Vulnerability in DNS Client Could Allow Spoofing (945553)

............

Tags - vulnerability , microsoft , bulletin , patch

Storm Worm, Blogspot.com

Mon, 07 Apr 2008 11:41:22 +0000

Storm Worm changed its tactic again. It began using Blog tactic now.

We received its latest spams which contained the links that point to Blogspot.com.

Here is the sample of spams body:

Open in new window
http://www.cisrt.org/enblog/attachment/200804/zh...

............

Tags - email-worm.zhelatin , withlove.exe , love.exe , zhelatin.ww

April Fools Day, Storm Worm Comes Back

Tue, 01 Apr 2008 11:00:43 +0000

Today is the April Fool's Day. More friends like joking on this day. The Storm Worm gang also like this day, and they come back after being inactive for a long time.

The new spams began being spread earlier today. We've received lots of spams in our mailbox. The subject lines are as the following:

April Fools' Day
Happy All Fools!
Doh! April's Fool.
I am a Fool for your Love
Gotcha! All Fool!
Happy April Fool's Day.

............

Tags - funny.exe , kickme.exe , foolsday.exe , email-worm.zhelatin , foolday , email-worm.win32.zhelatin.wt

Storm Worm Began Reactive

Mon, 03 Mar 2008 12:19:03 +0000

The last time Storm Worm active was Valentine Day.

Today, we monitored the Storm Worm gang began reactive. The file "postcard.exe" or "e-card.exe" will be downloaded automatically in a few seconds after users visit these websites.

The spams are like the following:
............

Tags - email-worm.zhelatin , postcard.exe , e-card.exe , zhelatin.vg

Rising Antivirus Online Scanner Insecure Method Flaw Exploit

Wed, 27 Feb 2008 04:31:27 +0000

A exploit about Rising Antivirus Online Scanner Insecure Method Flaw was published on milw0rm.com.

- Rising is a popular anti-virus product around China.
- there's an insecure method flaw inside its free online scanner.
- it's quite easy to exploit the bug which leads to a remote execution.
- clsid:E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153

Rising company released a bulletin last night to fix the vulnerability in Chinese. The users of Rising Antivirus Online Scanner should visit the Rising Antivirus Online Scanner webpage to install the latest ActiveX control.

Tags - rising antivirus online scanner

Fake Hizer Mills Video

Sat, 16 Feb 2008 11:20:05 +0000

In recent two days, we found similar spams to the Hillary Clinton video spams. The following malicious URLs are inaccessable now:

http://bibber.bi.funpic.de/test/bild/images/gallery/susy/rdown.php?ugeih
http://www.neufeld-media.de/Neufeld-Media/Re/news/rdown.php?lEtEmwn
http://bibo1981.bi.funpic.de/b/movie/rdown.php?ojfbG

We received another spam about Hizer Mills video today. The subject lines are such as "Sensation.Video New - make haste to look!!!".

The screenshot of spams:
............

Tags - pousadarecantonatureza.com.br , news m.exe , vshost.exe , loca.exe , trojan.win32.agent.exq , trojan.win32.agent.epo

Hillary Clinton Full Video?

Wed, 13 Feb 2008 06:57:11 +0000

The United States 2008 presidential election is underway. Hillary Clinton and Barack Obama already eyeing another Super Tuesday - March 4,2008.

As while, the bad guys also eyeing the United States 2008 presidential election. We received a new trojan spam about it today. The subject lines of these spams are such as "Hillary Clinton Full Video !!!".

The screenshot of spams body:
............

Tags - mpg.exe , inst526.exe , hillary clinton , barack obama , trojan.win32.agent.epo , canotajetrilly.com

Microsoft February 2008 Bulletin

Wed, 13 Feb 2008 05:52:33 +0000

Today Microsoft released its biggest batch of monthly patches, releasing 11 security updates to patch 17 vulnerabilities, six of which are Critical, five of which are Important.

The critical bulletins are include the following:

MS08-007: Vulnerability in WebDAV Mini-Redirector Could Allow Remote Code Execution(946026)

MS08-008: Vulnerability in OLE Automation Could Allow Remote Code Execution(947890)

MS08-009: Vulnerability in Microsoft Word Could Allow Remote Code Execution(947077)

MS08-010: Cumulative Security Update for Internet Explorer(944533)

MS08-012: Vulnerabilities in Microsoft Office Publisher Could Allow Remote Code Execution (947085)

MS08-013: Vulnerability in Microsoft Office Could Allow Remote Code Execution (947108)

............

Tags - vulnerability , microsoft , bulletin , patch