 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 02:24 Titlul subiectului: Trojan.Proxy.Xorpix.B |
 |
|
Trojan.Proxy.Xorpix.B
( Xorpix )
Raspandire : mediu
Dauna : mediu
Size: 16 kb
Descoperit : 2008 May 13
SYMPTOMS:
Increased network activity.
The presence of an instance of Internet Explorer process that does not show any user interface.
The presence of a file named msvcp.exe in %WINDOWS%\System32
A registry key named "Microsoft Office" in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run which contains a path to the above mentioned executable file, thus enabling the malware to run automatically every time the computer starts.
TECHNICAL DESCRIPTION:
The autentic malware file is packed with FSG packer. After unpacking it does an interesting trick to avoid being detected by H.I.P.S systems or any other application that has some kind of firewall action.
The malware desquises itself as an Internet Explorer process. It creates a suspended instance of Internet Explorer, it decrypts and injects it's malicious code into the executable image of the newly created process and resumes the instance of IE modifying the instruction flow to point to the injected code. Now the malicious code runs as a legitimate Internet Explorer serving itself of all the rights and firewall exceptions of such a process.
After installing itself into the infected computer, Xorpix opens a backdoor connection inviting the attacker to use this computer as a proxy for other malicious activities. The attacker is announced of the infection with a http request using a carefully crafted URL that contains the host's address, open port and other information about the infected computer such as the version of the operating system.
Trojan.Proxy.Xorpix.B is part of a family of trojans that allow a remote attacker to control the infected machine and use it to direct traffic to the internet without the user's knowledge, making it part of a large network of infected computers.
Xorpix opens up a large security hole on your computer and is a very dangerous threat to the security of your personal and financial data. Xorpix installs as a hidden system file and can be extremely difficult to manually remove. |
|
FAQ 
Mesaje private 
