PC Defender Antivirus rogue update system registry

The criminals who are behind the development of PC Defender Antivirus rogue in the last few hours have updated the registration system for the false application.

The record in the first version was to send a text message SMS rate telephone number located in Russia, while this new version requests a serial number (supposedly under the hardware-locked system) generated using as part of a activation key.

It also adds a button (Buy) that redirects to a form hosted on Plimus, and updated the malware into English. The first version was only in Russian.

This action makes it quite evident that behind the spread of these threats, lies across an organization intended to develop malware to accommodate an underground economy that feeds, increasingly, fraudulent methods.

Ver más

Phoenix Exploit's Kit and Pay-per-Install via PC Defender Antivirus

Pay-per-Install is one of the business models by which an affiliate system provides a set of "clients" one or more malicious code, paying each a percentage of money as a commission for each installation the malicious application successful.

Phoenix Exploit's Kit is a crimeware by which intelligence is done collecting statistical information related to each of the infected computers. You enter through an access panel via the http protocol as we see in the screenshot.

PC Defender Antivirus is a rogue Russian origin whose spread is being made through Phoenix Exploit's Kit, reporting at the same time to an affiliate system that records the installation of each downloaded copy.

In addition to collaborating with the criminal circuit feeding back the fraudulent business through Pay-per-Install, the rogue has the grain of usual business whereby it’s intended that the fraudulent application is purchased, also via the web, this action involving form information stored somewhere confidential credit card. The cost of the rogue is USD 59.95.

Through Phoenix Exploit's Kit spreads a trojan downloader called exe.exe, in this case MD5 e49be7ef82250a36cf7410004ac3d69c that, after it establishes a connection to fordkaksosat.info (193.105.207.45 - AS50793 "ALFAHOSTNET") from which it downloads and executes the rogue (PCDefenderSilentSetup.msi - ecff63c1f983858dfd7fb926738cb478).

In this instance, the rogue is reported to the affiliate system to load the information on successful installation through count_installs.php file, and begins a malware scan issuing alerts about alleged attempts to connect infections and also false. This activity is usual in this type of malware to be one of their employers.

The release system for the alleged security application is similar to that used by some families of ransomware through the business model that involves sending a text message SMS to a specific type of phone number.

In this case, the information should be sent to the number 5711000002209 with the message 6681.

The threat has a timer which generates a false statement Blue Screen of Death (BSoD), in which shows the incentive to record the program, exerting a fear (psychological warfare) on the user that after reading this information might think register/buy what you think, this is a real antivirus solution.

Countermeasures
Terminate the processes called prockill32.exe, proccheck.exe and rundelay.exe. You can use the ProcessExplorer to view and terminate processes.

Remove PC Defender folder (which houses six files) located in C:\Program Files\Def Group\

Delete the system registry PC Defender key from HKLM\SOFTWARE\Microsoft\Windows\ CurrentVersion\Run, which refers to c:\program files\def group\PC Defender\pcdef.exe. You can use the Autoruns to view and delete the key.

Related Information

Copyright violation: copyrighted content detected

Campaign infection through Phoenix Exploit's Pack

New variant of ransomware through porn sites IV
New variant of ransomware through porn sites III
New variant of ransomware through porn sites  II
New variant of ransomware through porn sites
Dangerous trojans, keyloggers and Spyware detected in you computer!!!
Another very active SMS Ransomware
SMS Ransomware for Windows In-the-Wild
Desktop Hijack by Internet Security 2010. Your System Is Infected!
LockScreen. Your computer is infected by Spyware!!!

Ver más

SMS Ransomware porn template update

A new variant of ransomware type blocker that promotes pornographic sites is In-the-Wild, with the inner slightly modified. Basically you have changed the number to which the victim must send messages like SMS. Now the number is 86571252 and the message remains the same: 6005.

Another change is in the location which holds the copy of the threat. In this case, the path is C:\Documents and Settings\Default User\Media\ under the name run32.exe. The first image shows the previous version, while the second corresponds to the new variant of the SMS Ransomware.

The ransomware is distributed, as in previous cases, through porn sites. This variant uses the same name as cover (flash_player.exe), its MD5 is 2e8f56ce39270e10f7082a35d13a735a and as I write this update has a detection rate average, 12/42 being detected by antivirus engines.

Countermeasures
Identify and terminate the process called "run32.exe." At this time ransomware window disappears.
** The name of the process can also be process32.exe.

*** To kill the process you can use Task Manager or the native Windows application ProcessExplorer.

Delete the following system information
Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Module
Value:
AModule
"C:\Documents and Settings\Administrador\Media\run32.exe"
*** You can also use Autoruns application to view the record in an orderly manner.

Folders:
C:\Documents and Settings\Default User\Media

Files:
C:\Documents and Settings\All Users\Media\run32.exe
C:\Documents and Settings\All Users\Media\rdb.bat

Related information

New variant of ransomware through porn sites IV
New variant of ransomware through porn sites III
New variant of ransomware through porn sites  II
New variant of ransomware through porn sites
Another very active SMS Ransomware
SMS Ransomware for Windows In-the-Wild

Ver más

New variant of ransomware through porn sites IV

This summary is not available. Please click here to view the post.

Ver más

New variant of ransomware through porn sites III

Another variant is ransomawre In-the-Wild. Like previous variants, it spreads through porn sites. The case presented axporno.ru page uses a vector of propagation.

When infecting the computer displays a window that overlaps any other, and by showing the information needed to theoretically unlock the system.

When you try to close the image is displayed in a new window that provides information on how to eliminate it. The maneuver, as is usual in the latest generation of ransomware type blocker, is to encourage the user to send a text message SMS rate to a certain number (162772132) and certain information (3381).

Create files sc.ini and delself.bat, both housed in the System32 folder. The first stores information equivalent to the number of infection and route where the malware binary, while the second saves the information to remove some tracks.

sc.ini
600
C:\Documents and Settings\All Users\Media\module.exe

delself.bat
…
del C:\Documents and Settings\All Users\Media\module.exe
if exist C:\Documents and Settings\All Users\Media\module.exe goto try
del C:\WINDOWS\system32\sc.ini
del C:\WINDOWS\system32\delself.bat

The malware uses the service SmsCost (smscost.ru) to provide information on the cost of the SMS message.

In addition to promoting another page with sexually explicit material through which also spreads malware (amporno.ru).

Countermeasures
Remove the "module" process through task manager (Ctrl + Alt + Del).
Search and delete the following processes:

• module.exe (MD5: 4D6C1F95ED90DDEE122FC749FCE1084E)
• sc.ini (MD5: FEADA1AF5309D97A537D02DD6678E847)
• delself.bat (MD5: E327DE8BC4BC1183CC9A60776717DA38)

Delete the folder hosted on Media C:\Documents and Settings\All Users\Media

Delete the following registry key:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Module > c:\documents and settings\all users\media\module.exe

Install an updated antivirus security program and perform a deep scan mode.


Related information

New variant of ransomware through porn sites II

New variant of ransomware through porn sites

Another very active SMS Ransomware

SMS Ransomware for Windows In-the-Wild 

Ver más