"Internet Explorer 7 Downloads" - IE7.0.exe

Another bit of malware this time masquerading as a terse email message to encourage the downloading of a fake version of IE7. It's a simple graphic pointing to an executable called IE7.0.exe - it looks like the graphic and executable are hosted on compromised Apache servers.

VirusTotal indicates that detection is a bit thin at the moment.

Antivirus	Version	Update	Result
AhnLab-V3	2007.3.30.0	03.29.2007	no virus found
AntiVir	7.3.1.46	03.29.2007	TR/Proxy.Agent.CL
Authentium	4.93.8	03.29.2007	no virus found
Avast	4.7.936.0	03.29.2007	no virus found
AVG	7.5.0.447	03.29.2007	no virus found
BitDefender	7.2	03.29.2007	no virus found
CAT-QuickHeal	9.00	03.29.2007	(Suspicious) - DNAScan
ClamAV	devel-20070312	03.29.2007	no virus found
DrWeb	4.33	03.29.2007	no virus found
eSafe	7.0.15.0	03.29.2007	no virus found
eTrust-Vet	30.6.3522	03.29.2007	no virus found
Ewido	4.0	03.29.2007	no virus found
FileAdvisor	1	03.29.2007	no virus found
Fortinet	2.85.0.0	03.29.2007	suspicious
F-Prot	4.3.1.45	03.28.2007	no virus found
F-Secure	6.70.13030.0	03.29.2007	Virus.Win32.Grum.a
Ikarus	T3.1.1.3	03.29.2007	no virus found
Kaspersky	4.0.2.24	03.29.2007	Virus.Win32.Grum.a
McAfee	4995	03.29.2007	no virus found
Microsoft	1.2306	03.29.2007	no virus found
NOD32v2	2154	03.29.2007	no virus found
Norman	5.80.02	03.29.2007	no virus found
Panda	9.0.0.4	03.29.2007	Suspicious file
Prevx1	V2	03.29.2007	Covert.Sys.Exec
Sophos	4.16.0	03.29.2007	no virus found
Sunbelt	2.2.907.0	03.29.2007	VIPRE.Suspicious
Symantec	10	03.29.2007	Trojan Horse
TheHacker	6.1.6.080	03.23.2007	no virus found
UNA	1.83	03.16.2007	no virus found
VBA32	3.11.3	03.29.2007	suspected of Trojan-PSW.Pinch.1 (paranoid heuristics)
VirusBuster	4.3.7:9	03.29.2007	no virus found
Webwasher-Gateway	6.0.1	03.29.2007	Trojan.Proxy.Agent.CL

"The system is not fully installed": Windows XP, WMP 11 and Sysprep

Kudos to lizardking009 for this post at the 2cpu.com forums.

After using Sysprep to prepare a new Windows XP build for distribution to some Dell laptops, I got the a message saying The system is not fully installed when trying to restart the machine.

It turns out that this is due to the presence of Windows Media Player 11 which screws up the Sysprep process somehow. I can't say that I'm a big fan of this DRM-laded stuff, but generally speaking you always load the latest version of everything before resealing the machine to take an image from it.

Microsoft have this knowledgebase article showing how to recover from the problem, although I discovered that this does not work very well on machines that have already been built from a Sysprep (such as Dells). If you're working in a reasonably well equipped environment with another XP machine and a suitable external USB drive enclosure then it's probably easier to edit the registry on the affected PC's hard disk by plugging it into the USB port of another machine, i.e.:

• Load REGEDIT
• Select HKEY_USERS
• Go into File.. Load Hive..
• Browse to the \WINDOWS\System32\Config\System file on the USB connected drive
  
• Name the hive "system" or whatever you like
• Find the Setup key on the newly loaded hive and locate SystemSetupInProgress.
• Change the data from 1 to 0.
• Unload the Hive

Then, once the hard disk is reinserted into the original machine, bring it up in Safe Mode, deinstall Windows Media Player 11 and reboot. This should start the setup process (you can choose to take an image at this point, if you wish).

Fake "BlueMountains Greetings" message with a trojan

Fake greetings cards are a common way of spreading trojans, and this latest Fake Bluemountain.com Email is a case in point.

The message looks similar to the following one:

From:
BlueMountains Greetings <greetings@BlueMountain.com>
Subject:
You just received an Electronic Greeting.

Hello,
you just received an electronic greeting from a
friend !

To view your eCard, please click
on the following link :

http://www.bluemountain.com/view.pd?i=164213761&m=2435&rr=z&source=bma999

(Your postcard will be available for 60 days.)

If you
have any comments or questions, please visit http://www.bluemountain.com/customer/emailus.pd?source=bma999

Thanks
for using BlueMountain.com.

In fact, the links actually lead to bluemountains.kokocards.com (do not visit this site). A more detailed writeup can be found here.

There's very little need to accept this type of "greetings card" into corporate environments, and this seems to be a common vector for malware attacks.

If you use Postini, you can create a custom content filter:

• Select Match Any
• Sender | contains | bluemountain.com
• Body | contains | kokocards.com
• Body | contains | bluemountain.com
• Set message disposition to Quarantine Redirect
• Don't forget to copy it to sub-orgs if you need to!
  

Lunar Eclipse

Clear skies and not too chilly, and the best lunar eclipse in years. This one taken at about about 2230 GMT (click the image to enlarge).