Spyware hitting my web servers?

[ric-o]

Does anyone know why I would be seeing lots of snort alerts for spyware hitting my web servers? Doesn't make any sense to me.

See examples: (x.x.x.x = Internet addr; y.y.y.y = internal web server)

Apr 13 00:09:58 internet-ids snort: [1:2001855:12] BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (1) [Classification: A Network Trojan was detected] [Priority: 1]: {TCP} x.x.x.x:2647 -> y.y.y.y:80

Apr 13 00:14:35 internet-ids snort: [1:2001043:7] BLEEDING-EDGE Malware Fun Web Products MyWay Agent Traffic [Classification: Potential Corporate Privacy Violation] [Priority: 1]: {TCP} x.x.x.x:60773 -> y.y.y.y:80

Apr 13 00:14:35 internet-ids snort: [1:2001855:12] BLEEDING-EDGE MALWARE Fun Web Products Spyware User Agent (1) [Classification: A Network Trojan was detected] [Priority: 1]: {TCP} x.x.x.x:60773 -> y.y.y.y:80

Apr 13 00:14:43 internet-ids snort: [1:2001034:13] BLEEDING-EDGE Malware Fun Web Products Agent Traffic [Classification: Potential Corporate Privacy Violation] [Priority: 1]: {TCP} x.x.x.x:50074 -> y.y.y.y:80

[SirDice]

Some malware modify the UserAgent the client is sending.. These snort rules trigger on that.. Look at the rules themselves to see why they trigger..

[phishphreek]

Originally posted here by SirDice
Some malware modify the UserAgent the client is sending.. These snort rules trigger on that.. Look at the rules themselves to see why they trigger..

Just wondering... why would malware writers do that? So they can see how sucessful their code is? It seems to me that it's one more way for people to identify their malware and then remove it?

They modify the browser user agent? Or, do they have their own mechnism for retreiving the offending content... such as wget or other perl libraries, etc?

(similar to useragent switcher extention for firefox or proximon for windows?)

[SirDice]

Not sure about the how or why but I can imagine a malware BHO is able to capture all requests and modifying them before sending it to the "real" website and the malware's logging site..