December 21st, 2006, 12:18 AM
Malware via Adbrite
An interstitial ad running on my site for IOSCO (oicu-IOSCO.com) seems to be causing the web browser to ask to download a file from lawcons.info called c.wmf that contains malware. I fear this is trying to use the previously know Windows WMF vulnerabilities. I've contacted Adbrite to get the ad campaign paused. Just wanted to let you know that this malware is not from my site. My guess is someone defaced the "International Organization of Securities Commissions" website and inserted the malware.
December 21st, 2006, 06:23 AM
A likely excuse
Just wanted to let you know that this malware is not from my site. My guess is someone defaced the "International Organization of Securities Commissions" website and inserted the malware.
\"Those of us that had been up all night were in no mood for coffee and donuts, we wanted strong drink.\"
December 21st, 2006, 06:26 AM
Yep, that's a nasty critter: shows up as WMF exploit trojan downloader from most of the AV vendors on VirustTotal.com.
I downloaded and ran it on a test PC and didnt do anything other than bring up empty picture in Picture Viewer. Packet sniffing shows no traffic. Hrm...what the heck is it supposed to do?!?
December 21st, 2006, 11:11 AM
When it's active, it's supposed to serv up advertisements that will lead you to more sinister malware sites. It will DL content then pitch it at you right between the eyes. If you follow some of them, you'll find yourself part of a botnet faster than you can say, ho, ho ho!
I've played with several variants of this nasty, all did about the same thing. The differences between them was the download locations for the dropper.
By the sound of it, someone nuked the DL servers where the content was being served. Also, many times these things are abandoned by criminals once they are deemed ineffective and you may be seeing the remnants.
Note to self. Iron Geek == Malware King.
Last edited by thehorse13; December 21st, 2006 at 11:17 AM.
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden