Sunday, January 4, 2009

Anatomy of a malware scam: How everclipz.com infects people and evades the good guys

Hundreds of thousands at risk daily

In my previous posts, I have talked about malware downloaded from everclipz.com and how they keep the anti-malware vendors guessing. The downloaded malware is not detected by a majority of the anti-virus software. Also of interest is how the site operates, since it gives us knowledge as to how malware distribution actually works.

How is the attack carried out: Search engine results are infiltrated by pages which purportedly show sex videos. These sites themselves do not have any malware, but the pictures link to another different webpage, the pictures of which then link towards a subdomain of everclipz.com which downloads a trojan disguised as an active X video player. The execution (running) of this file causes download of other files, which may, among other things, lead to disclosure of financial information and computer takeover by a remote person.

So, there are two “buffer sites” which lead on to the main exploit site. This is to guard against link scanners getting wise. The main site, full of explicit pictures, then gives the option of a codec, which then installs the malware.All the time, the main site,www.everclipz.com is never active, and never appears in any search results. This helps in keeping the site anonymous.

A search by whois showed the ip number to be 212.95.55.61, with the ip hosted in china.and two more domains associated Bestimagez.com and selectingz.com. What is frightening is that the ip address was registered just on the 29th of December, and within a space of 1 week, it has moved up to a daily Alexa traffic ranking of 2797. That means a traffic of a few hundred thousand per day. A few hundred thousand potentially infected computers per day. It is high time this site was put to an end.

 

 

Pictures: How to get infected: Click on the link



First link: Not infected, pictures link to a second non infected site



Picture: As you can see, the link scanner in the search engine did not pick up the site because it really did not have any exploits, nor was linked to one

 

 

Second link: Still no exploits, but the pictures link to a third site

 

 

The main exploit site: Note how precisely the picture simulating the pop up window is placed.

Clicking on the "window" leads to the appearance of a download dialog for the actual malware (setup.exe).

 

 

Finally, the frightening aspect: Notice how rapidly the Alexa traffic rank is going up. The number of people reaching the site now is estimated to be hundreds of thousands daily

21 comments:

jimi said...

You'll be able to now recover data from pen drive simply. Pen drive brings us unpredictable risk and nice convenience. the site is always accustomed to save lots of our handy files in a very pen drive rather than in a pc.
windows 7 boot disc

Rebecca Lopez said...

Your site is very informative and your articles are wonderful.

www.c2logix.com

Isolde Alexeyeva said...

You completely match our expectation and the variety of our information.
price per head company

Isolde Alexeyeva said...

I sent your articles links to all my contacts and they all love it including me.
cost per head

Antic_Hero said...

Your site is very informative and your articles are wonderfuwebsite

Anonymous said...

Author is the professional webeditor who working in the USA, she has written most of article about the tips and tricks of the iPhone to computer transfer and iPhone to mac transfer, and for the iPhone, iPod and iPad users, they can use their devices as a disk mode with the help of the iPhone disk mode.

Anonymous said...

[url=http://remroom.ru]стоимость ремонта квартиры под ключ[/url] Ремонт и отделка офисов, комнат или домов – это насущная сейчас проблема большинства людей, решившихся, наконец, привести в порядок свой дом. Мало того, что улучшение – это занятие трудоемкое и напряженное, еще и найти заслуживающую доверия фирму, занимающуюся ремонтом комнат или домов сейчас практически невозможно. Дело в том, что все меньше и меньше в России существует фирм, делающих свою работу хорошо, эффективно и недорого. [url=http://remroom.ru]прайс отделочные работы 2011[/url]
Однако наша фирма является приятным исключением из этого неприятного правила. Мы вот уже много лет занимается улучшением помещений, комнат, дач и еще ни разу нам не приходило от наших клиентов ни неприятных отзывов, ни каких-либо жалоб. [url=http://remroom.ru]дизайн и ремонт квартир[/url] Богатый опыт наших специалистов, а также высокий профессионализм всех без исключения наших сотрудников, поможет сделать хорошо, качественно и – главное - доступно как косметический, так и капитальный ремонт. [url=http://remroom.ru]частный ремонт квартир[/url] Современное оборудование, новые технологии планировки и дизайна, а также индивидуальный подход к каждому клиенту и гибкая система скидок сделали нашу фирму самой успешной на сегодня фирмой, оказывающей услуги реставрации и отделке офисов, комнат или загородных домов. [url=http://remroom.ru]ремонт квартир частные мастера[/url]
[url=http://remroom.ru]ремонт квартир[/url] [url=http://remroom.ru]ремонт квартиры[/url]

Anonymous said...

[url=http://global15.com/3e39][b]ugg outlet[/b][/url] SEWCFW
[url=http://5th.li/ef][b]ugg sale[/b][/url] JKPVSD
[url=http://la7.org/154][b]ugg boots outlet[/b][/url] KJOUDE
[url=http://jdivert.com/3dnu][b]sale ugg boots[/b][/url] DQMENO
[url=http://wmle.com/2k0][b]uggs boots sale[/b][/url] QAZKDT

Anonymous said...

top [url=http://www.c-online-casino.co.uk/]casino online[/url] hinder the latest [url=http://www.realcazinoz.com/]realcazinoz[/url] unshackled no consign reward at the best [url=http://www.baywatchcasino.com/]redeem casino
[/url].

Anonymous said...

top [url=http://www.c-online-casino.co.uk/]uk online casino[/url] hinder the latest [url=http://www.realcazinoz.com/]free casino bonus[/url] unshackled no set aside bonus at the best [url=http://www.baywatchcasino.com/]casino games
[/url].

Anonymous said...

[b][url=http://www.ucm.es/BUCM/wiki/index.php?title=Birkin_Hermes_at_fashionbagshub.com_xiDY24_at_bagsseala.com]birkin bag prices[/url][/b] after you set your most loved uggs clearance there are plenty of it skilled ever been intended to often be truly happy, now this ignite-unwanted and additionally to help shifting avoi outsole definitely hopefully maintain adult men and women supports all the time all the time. glow a truth sheepskin sock of which wards on paper eating water which implies personal elegant legs just isn't going to in all likelihood see saturated, place on the uggs boot styles settlement holding male extensive leg denim jeans with a blazer so you are donning completely regarding your trip on the city.


[b][url=http://gonur.co.cr/wiki/index.php?title=Designer_Bags_For_Less_at_fashionbagshub.com_ueAV02_at_bagsseala.com]green handbags[/url][/b] McKinnon aware up against reading the material a great deal of into choices on hand, even so.


[b][url=http://www.snmnam315.com/thread-123471-1-1.html]hermès handbag[/url][/b] A renal infectivity nicely concern much more discomfort, introducing vomiting, Chills, or nausea. could also be uncertain and even weakling pee, stubborn belly nuisance and as a consequence routine urination. people with elimination dirt perhaps experience back problems basically higher than specific waistline.

Anonymous said...

At our store, we can drill holes all through tools to allow
for freer airflow in the tool. Domains and were saved, set to dispose of
custom Airmax. The outcome definitely is inevitably broken ensures about universal obtain
and quality treatment. That this air max.1 started i would say the
reign of Air Max. http://www.glejme.com/moodle/user/view.
php?id=58069&course=1

Feel free to surf to my web blog - air max shop

Anonymous said...

Heya i'm for the primary time here. I found this board and I in finding It truly helpful & it helped me out much. I am hoping to give something again and help others such as you aided me.

Feel free to surf to my blog post ... soraya.com

Anonymous said...

What a data of un-ambiguity and preserveness of valuable
experience regarding unexpected emotions.


Take a look at my web site ... download 7Zip

Anonymous said...

Awesome blog! Do you have any recommendations
for aspiring writers? I'm hoping to start my own website soon but I'm a little lost on
everything. Would you advise starting with a free platform like Wordpress
or go for a paid option? There are so many choices out there that I'm totally overwhelmed .. Any tips? Cheers!

Feel free to surf to my page dry scalp Treatments

Anonymous said...

WOW just what I was searching for. Came here by searching for Diarrhea remedies

Iftekhar Ahmed said...

I stumbles the post, that are beneficial, and your post is one of them. Neat and clever content, keep it up.
Water Filters

SEO Expert said...

Glad to read your post :). It is very informative!

Radiator Covers UK said...

I appreciate your blog post, beautifully expressed and well written.

Free Online Games said...

Very value able post, I read the whole story when I start reading it.

Anonymous said...

I drop a leave a response each time I appreciate a article on a website or
I have something to contribute to the conversation. It's
a result of the passion displayed in the post I read.
And on this article "Anatomy of a malware scam: How everclipz.com infects people and evades the good guys".

I was excited enough to drop a thought :-P I do have 2 questions for you if it's okay.

Is it only me or does it give the impression like some of the
remarks look as if they are coming from brain dead individuals?
:-P And, if you are writing at other online sites, I'd like to follow you.
Could you make a list every one of your communal sites like
your twitter feed, Facebook page or linkedin profile?

Visit my web blog :: Angry Birds Go money hack gratuit telecharger