RavMon.exe virus on new Toshiba Satellite laptop

A few days ago I bought a very inexpensive Toshiba Satellite L40-18Z laptop from Comet in the UK. It's a basic laptop running Windows Vista, and it is certainly good enough for web browsing and wordprocessing.

But this particular laptop came with something extra. Despite the security seals being intact, and the OS having never been activated, the laptop came with a file called RavMon.exe on the C: and E: partitions.

RavMon.exe is an insidious virus that spreads on USB keys and drives, so it seems likely that this laptop was infected during the manufacturing process, despite having Symantec Anti-virus installed.

Of course, the first thing I did was remove Symantec and install ZoneAlarm, and ZA's Kaspersky anti-virus engine found RavMon.exe pretty much straight away. Thinking it was a false positive, I sent it to VirusTotal and the results speak for themselves.

File RavMon.exe received on 03.03.2008 20:38:32 (CET)
Antivirus	Version	Last Update	Result
AhnLab-V3	2008.3.4.0	2008.03.03	Win-Trojan/Xema.variant
AntiVir	7.6.0.73	2008.03.03	TR/Agent.Abt.33
Authentium	4.93.8	2008.03.02	W32/Trojan.NAT
Avast	4.7.1098.0	2008.03.02	Win32:Agent-EDN
AVG	7.5.0.516	2008.03.03	Generic3.NKU
BitDefender	7.2	2008.03.03	Trojan.Downloader.Chacent.A
CAT-QuickHeal	9.50	2008.03.03	Trojan.Agent.abt
ClamAV	0.92.1	2008.03.03	Trojan.Agent-3327
DrWeb	4.44.0.09170	2008.03.03	Win32.HLLW.Autoruner.198
eSafe	7.0.15.0	2008.02.28	Suspicious File
eTrust-Vet	31.3.5582	2008.03.03	Win32/Compfault.C
Ewido	4.0	2008.03.03	Trojan.Agent.abt
FileAdvisor	1	2008.03.03	-
Fortinet	3.14.0.0	2008.03.03	-
F-Prot	4.4.2.54	2008.03.02	W32/Trojan.NAT
F-Secure	6.70.13260.0	2008.03.03	W32/Agent.CUTV
Ikarus	T3.1.1.20	2008.03.03	Trojan.Win32.Agent.abt
Kaspersky	7.0.0.125	2008.03.03	Trojan.Win32.Agent.abt
McAfee	5243	2008.03.03	New Malware.eb
Microsoft	1.3301	2008.03.03	Worm:Win32/RJump.F
NOD32v2	2918	2008.03.03	Win32/AutoRun.FQ
Norman	5.80.02	2008.03.03	W32/Agent.CUTV
Panda	9.0.0.4	2008.03.03	Generic Malware
Prevx1	V2	2008.03.03	Generic.Malware
Rising	20.34.02.00	2008.03.03	Trojan.DL.MnLess.n
Sophos	4.27.0	2008.03.03	Troj/QQRob-ADL
Sunbelt	3.0.906.0	2008.02.28	-
Symantec	10	2008.03.03	W32.Nomvar
TheHacker	6.2.92.231	2008.03.02	-
VBA32	3.12.6.2	2008.02.27	Trojan.Win32.Agent.abt
VirusBuster	4.3.26:9	2008.03.03	Packed/nPack
Webwasher-Gateway	6.6.2	2008.03.03	Trojan.Agent.Abt.33
Additional information
File size: 48640 bytes
MD5: 5557dd0fd5565f12a71c92e6aad7088f
SHA1: 1dd1be78715ff68354967adadc8b6990706caafa
PEiD: -
packers: NPack
Prevx info:

Luckily, the machine wasn't actually infected, but the .exe file was sitting there waiting to be clicked. Symantec would have detected this if it had updated in time, and as it is most AV products will detect the virus.

It just goes to show that you can't necessarily trust a PC straight out of the box.

Dating Scam Sites VI

The return of a persistent spam.. which means that plenty of people are falling for it.

Hello! I am bored today. I am nice girl that would like to chat with you. Email me
at Ebba@ThePaganDoorway.info only, because I am using my friend's email to write
this. If you would like to see my pictures.

Of course, the nice girl is going to be a hideous troll or some ugly middle aged chickenboner. Whoever you are talking to, the aim is usually to bilk you out of a large pile of cash.

Current domains in this run are as follows:

• Oldgloryshirts.info
• Prideboundx.info
• Selfhealdirect.info
• Shineplug.info
• Shinestick.info
• Shinyglowstick.info
• Superdoorway.info
• Thedoorwaybeyond.info
• Thedoorwaydomain.info
• Thedoorwaygenerator.info
• Theglowpup.info
• Thegoldendoorway.info
• Thehealcare.info
• Thepagandoorway.info
• Unitedimprove.info

All hosted on 218.23.28.100 in Anhui, China.

Another dating scam

Dating scams are increasingly common and are something that I've blogged about before. It's really just a variation of the 419 Advanced Fee fraud scam, except the bait this time is usually a pretty Russian girl.

Hi! I'm a single girl and I'm 26 years old. Please take a look at my pictures and let me know if you like them! I live in Russia and I'm going to come to your country and work over there very soon! I don't know anybody over there and I thought it would be great to meet someone who is open to anything (as I am!). I would be happy to be friends, lovers or create a serious relationship! We will see what happens!

I hope you will write me back and I will write more info about myself and send more
photos!!!!!!!!!!!

I am writing from my friend's email address, so please make sure you do not reply directly to this email. Email me at nrochestetd0@yahoo.co.uk only.

if you don't use my personal email address then I won't be able to read your
reply and write you back. So it is very important that you get it
right.

Ok, I guess it is now your turn. Hope to hear from you today. Bye!!

btw, i got your email from dating website

Of course, the email is going to be from some ugly middle aged Russian bloke rather than an attractive young lady, but at least this one has the decency to include a couple of photos of someone who will have nothing to do with the scam at all.

DAIYA PR Co Scam

Scammers can be quite funny - this one is from someone pretending to be DAIYA PR of Japan.

Job opportunity from DAIYA PR Co., Japan

Job Location World
Company Location Japan
Employment Type Employee
Salary $7,500.00/month + BONUS system

Send your profile/resume/CV to this e-mail only:
smith.is.dennis@gmail.com

DAIYA PR Co., Japan is expanding! This is job opportunity from famous Japan Corporation. Not just any opportunity but one that can make your career fun and rewarding. We have various positions over all US. You don’t need to move out from US, this job located in USA. If you are have all requirements you NEED to send us your resume or profile or CV for qualification. You will receive back our opinion in 1-2 days. Hurry up, this job opportunity is limited.

Requirements and skills:

1. Higher Education/College
2. 1+ Sales/Management (desired but optional)
3. Strong communicative skills
4. Must have MS Office installed (MS Word)
5. Must have U.S. citizenship
6. Adult age

This is original e-mail letter from DAIYA PR Co. This not any kind of: MLM, scam, spam. We will never ask to you to provide any kind of investments.

Gotta love the bit that says "This not any kind of: MLM, scam, spam." Clearly a big company like DAIYA PR would be soliciting replies to a Gmail address (only.. don't send it to the real company by mistake, will you?). In this case the email originates from 88.233.203.233 which is a compromised machine in Turkey.. not Japan.

It isn't absolutely clear what the scam is, but they are usually money laundering operations or sometimes setting up fake companies or identities. The best thing to do is steer clear.

Note: DAIYA PR is a real company and is not connected with this scam email being sent out in its name.

"Metrix Ventures" scam email

Some sort of modelling scam, sent to an email address from a data breach at an online retailers so you KNOW that it's a fraud. Company name given is Metrix Ventures which appears to be completely bogus, and is not related to any company of a similar name.

Subject: Job Offer
From: "Gary Pole"
Date: Thu, February 7, 2008 1:41 pm



Hello,

My name is Gary Pole. Am freelance modeling agent working for Metrix Ventures which
is based in the US and has branches also in Europe.I would like us to do some works
together. I presently have good offer for you.I want to know if you are interested
in modeling because I need pictures of a good looking person (male or female) who
will be on the magazine cover of one of my clients. Please let me know if you are
interested in the deal. You stand a chance of making reasonable money and 150 Pounds
from this deal to start, and even a noticeable fame. Let me know if you are
interested in my offer and I would give you further details.

Best Regards,
Gary.

Originating IP is 194.126.173.16, which is probably a compromised server. It amusingly identifies itself as project-crime.com in the email headers!

Fake "Benjamin Vincent Solicitors" mail

Another money mule fraud, this time using the name "Benjamin Vincent Solicitors".

Subject: Business Proposal
From: "Benjamin Vincent"
Date: Mon, February 4, 2008 11:13 am
To: undisclosed-recipients:;
Priority: Normal

Dear Sir/Ma’am,
I want to ask your attention to receive money on my behalf and it will
be for our mutual benefits.

Please call me if you are interested and on your response, I will send
you the full details and more information about myself and the funds.

Yours sincerely,

Benjamin Vincent
Benjamin Vincent Solicitors
49, High Street Wanstead
London
E11 2AA
Tel: +44 771 719 0188.

Now, Benjamin Vincent Solicitors are a real company and have nothing whatsoever to do with this fraud (you can see their details here). The scammers have used the correct address, but the "+44 7717" number is a mobile phone, not a landline. In other words, this fraud is attempting to trade of the name of a wholly innocent firm. The email addresses bvsolicit@yahoo.com and bvsolicitors@hotmail.co.uk are associated with this scam.

Tsk tsk.

moneybookers.com / xcitinggames.com phish

It's unusual to see a moneybookers.com phish, but perhaps it shows that the phishers are moving on to different targets. This particular phish reads:

Greetings from moneybookers.com! We would like to inform you that you have received a payment from banking@xcitinggames.com.

Payment details

Amount: . 147.00
ID: 89089098
Subject: received payment
Note: Click here to accept this payment

Your money is waiting for you in your Moneybookers account.

Use this link to accept payment- www.moneybookers.com.

We hope you enjoy your cash.

One other notable feature of this phish is the use of an AOL redirector to attempt to fool spam filters, in this case eventually pointing to http://195.234.171.86/app/login.pl/index.htm which is a server in Italy, probably rented with stolen credit card details.

Neither moneybookers.com nor xcitinggames.com are involved in this phish. I understand that AOL have been told about their redirector problem several times but have not acted.

River Great Ouse, Bedford: 19/1/08

I know that it's winter, but in the UK we've had nothing but rain, rain and more rain. Our local river is right up to banks and with nothing but rain forecast for the next few days.. well, I'm just glad I don't live next to it.

"Colls Solution Company" Scam Email

This is a UK-target scam, using email addresses harvested from an online retailer who had a security breach.

This one appears to be more that just the usual advanced fee fraud or money laundering though.

Subject: JOB OFFER
From: "COLLS SOLUTION COMPANY"

Hello

We are offering a temporary job which really do not
require any professional skills.

You really don't have to have any professional skills
for this. All we are looking for right now is Uk based
individual to handle paper work, file documents and
handle payroll administration to our clients in Uk.

What will be required from you is few hours a day and
also to pay very close attention to all instructions
given to you.

Your Job will be; Handling all applications with
regards to new clients that will like to register a
company in uk and what you will be doing is Filing all
papers from these individual companies which will be
sent over to you under that companies name.

Salary terms; 120 pounds per job Get back to
us through the email address below if you are
interested in the job offer.

Please get back to me with the following details.

FULL NAME

FULL ADDRESS

E-MAIL ADDRESS

AGE

SEX

PRESENT EMPLOYMENT

MARITAL STATUS

WHEN WOULD LIKE TO START

All replies should to be forwards to the company e-mail address.

private_solutions@representative.com

Regard,

DEBRA COLLINS

Note that they say the job is "Handling all applications with regards to new clients that will like to register a company in uk and what you will be doing is Filing all papers from these individual companies which will be sent over to you under that companies name." In other words, the victim will be used as a front to create bogus offshore companies. And when those companies do something criminal, then the UK-based victim will be the one to get into trouble.

If you get one of these, forward it to abuse -at- mail.com who handle email for the representative.com domain.

The BBC iPlayer in a corporate environment

The BBC have spent a lot of time and money developing the BBC iPlayer it turns out that it's just another P2P application running on Kontiki.

So, I've written a guide for corporate IT departments giving them a pointer as to what the iPlayer is all about and how to block it - which it turns out should be easy enough!

Blocking BBC iPlayer, 4OD and Sky-by-Broadband

CA PestPatrol false positive - NeoSpy / rarsfx0 directory / WinRAR

Another false positive doing the rounds, this time in CA's PestPatrol software which is incorrectly identifying %profile%\local settings\temp\rarsfx0 as being part of part of the rogue NeoSpy package (see here for CA's description).

In fact, the rarsfx0 directory is just a temporary folder created by RARLAB's WinRAR application - that's a harmless commercial file packager. This folder looks to have been included accidentally in a PestPatrol signature released on 9th January.

Note that if you have PestPatrol installed with the faulty signature, then WinRAR archives may not unpack properly.

Arcanely Worded Scam of the Month Award

OK, so I don't really have an Arcanely Worded Scam of the Month Award, but if I did then this rather bizarre email would count. It is, of course, a standard Advanced Fee Fraud pitch, but the almost Shakespearean wording is something else..

Subject: PLEASE RESPOND ASAP!!
From: "Timms David"

Hello,
It gives me a great deal of pleasure to write you this mail and even when it might
come to you as a surprise, I hope you find it of interest. Let me first introduce
myself. My name is David Timms. I am an Executive Auditor with a Bank here in Europe
, I would like to use this means to ask your assistance in moving some fund over to
your country. I have in the course of my duties come in contact with a good amount
of Fund that have been inactive for some years now and careful investigation proved
the original depositor of the fund died five years ago and all attempt to reach the
suppose beneficiary of the deposit were fruitless and before it is forfeited to the
state I decided to move it. It is of interest to inform you also that I have already
moved this fund out of the Establishment and now in safe keeping with a Finance and
security house, I will like to move it outside now and this is were I need your
assistance. After legal consultation, I have established modalities for!
a secured way for a perfect transaction., but be most assured that for your
assistance and partnership you will get a good percentage of the fund, it is
important to let you know that fifty percent of the rest will be invested over
there under your management for a negotiable period of time and we will open a
fruitful dialog very soon to that effect. I look forward to our working closely in
practically seeing this transaction come to a perfect end. For effective
communication, please kindly include in your reply, your complete Names, Address,
Occupation, Age and most especially your contact number and I will contact you as
soon as I get your reply. I look forward to hearing from you and my gratitude for
your Patience.
Respectfully yours,
Timms David.

Eh? "I have established modalities for a secured way for a perfect transaction"?

eTrust ITM 8.1 fails to update

I've been grappling with a strange problem with eTrust ITM 8.1 for a couple of weeks - the software installs just fine, but the signature updates never apply. The problem occurs on a whole batch of machines that aren't exactly related, but which were all bought in early 2005.

The eTrust Distribution log shows the following:

Completed Time Type Code Description
09-Jan-2008 08:46:11 Information 0 1) Selected component "eTrust Antivirus Arclib Archive Libra...
09-Jan-2008 08:46:11 Information 0 2) Selected component "eTrust Antivirus Base"
09-Jan-2008 08:46:11 Information 0 3) Selected component "eTrust Antivirus Realtime Drivers"
09-Jan-2008 08:46:11 Information 0 4) Selected component "iGateway"
09-Jan-2008 08:46:11 Information 0 5) Selected component "eTrust ITM Common"
09-Jan-2008 08:46:11 Information 0 6) Selected component "eTrust ITM Agent GUI"
09-Jan-2008 08:46:11 Information 0 7) Selected component "CAUpdate"
09-Jan-2008 08:46:11 Information 0 8) Selected component "eTrust PestPatrol Base"
09-Jan-2008 08:46:11 Information 0 9) Selected component "eTrust PestPatrol Clean"
09-Jan-2008 08:46:11 Information 0 10) Selected component "eTrust PestPatrol Engine"
09-Jan-2008 08:46:11 Information 0 11) Selected component "eTrust PestPatrol Realtime"
09-Jan-2008 08:46:11 Information 0 12) Selected component "eTrust PestPatrol Signatures"
09-Jan-2008 08:46:11 Information 0 13) Selected component "eTrust Vet Engine"
09-Jan-2008 08:46:11 Information 0 Checking updates for "eTrust Antivirus Arclib Archive Librar...
09-Jan-2008 08:46:11 Information 0 Downloading from "SERVERNAME:42511"
09-Jan-2008 08:46:09 Information 0 The distribution program started the download process.
Show 10 Show 25 Show 50 Show All Page 1 « ‹ 1-16 of 16 › »

Note that there are always 16 lines in the log.. the update process starts but never completes, and there's no error message.

After working with our reseller we discovered the problem - it's not a problem with eTrust, but instead a very strange permissions issue that has happened with those PCs. What has happened is that the computer's SYSTEM account (which the eTrust services run under) doesn't have access to write to that part of the disk, despite having permissions explicitly set.

In the case of eTrust, the fix is to open up the Services control panel (Start.. Run.. services.msc), and then.

• Double-click on the eTrust ITM Job Service
  
• Click the Log On tab
• Change the credentials from the "Local System account" to the local Administrator account on the PC (i.e. username Administrator, password to whatever you set it to).
• Restart the service
• Either reboot the machine, or terminate the ITMDist service
• Tell the machine to download updates again.

In the cases I have seen, the update works correctly after the Administrator account has been specified. There does seem to be some problem with the SYSTEM service not working properly.

Of course, you can also do this all remotely with the Computer Management tool and something like PSKILL (from PSTools), so you don't have to be sitting at the machine to do it.

As I said, I don't believe that this is an eTrust problem, it looks as though Windows is borked somehow, possibly an issue with SIDs or something. I have a feeling that other software misbehaves, possibly including Active Directory policies. I have no solution other than a complete rebuild, but if you're struggling to get eTrust updating properly, then I would definitely look at the user rights for the service.

CA.com compromised / Zero-day RealPlayer flaw

The ISC reports that several websites have been compromised by a zero-day vulnerability in RealPlayer. The halware is hosted or routed via uc8010.com (currently down).

Surprisingly, one of the compromised web sites (since cleaned up) is ca.com (Computer Associates), who make the eTrust anti-virus product.

A Google search for uc8010.+com site:ca.com comes up with several dozen hacked pages, mostly press releases.



A look at a cached copy of the code shows a link to n.uc8010.com/0.js (don't visit this url) which then loads the exploit.



Note that everything here is a .gif to stop virus scanners freaking out.

To be fair, a lot of sites are compromised including government bodies and large corporations. It just goes to show that there's no such thing as a "safe site" any more.

JS/Exploit-BO false positive in McAfee

In what looks like a re-run of a recent false positive from eTrust, McAfee Anti-Virus is detecting JS/Exploit-BO in a number of innocent javascript applications, including Mootools. It's likely that McAfee is detecting the Dean Edwards Packer Tool as malware, although that's just an innocent application. Pattern 5197 has the problem, upgrading the signatures to pattern 5198 or later should fix it.

Unfortunately I guess this goes to show that packer tools can be a menace. There have been reports of this tool being used to obfuscate malware, so the smart advice to javascript developers is probably to not encode, compress or encrypt your code in any way if you want it to be trusted.

Js/snz.a - likely false positive in eTrust / Vet Anti-Virus

It appears that CA's eTrust Anti-Virus product (also known as Vet Anti-Virus, often bundled with other security applications such as ZoneAlarm) is coming up with a false positive for js/snz.a for several complex javascript applications.

As far as I can tell, the javascript uses complex encoding but is not malware. These javascript elements are widely used on the web. As far as I can tell, they are not harmful in any way and this is a mis-identification by eTrust / Vet.

The signature that has the problem is 31.3.5417 dated 31/12/07

Some of the Javascript files that seem to trigger an alert are named:

• jquery.js
• mootools.js
• ifx.js
• show_ads.js
• relevancead.js
• submodal.js
• iutil.js
• ifxslide.js

There may be other javascript apps that show the same problem - of course, filenames are arbitary and can be absolutely anything at all.

If you're running Internet Explorer, then you may see an alert for an individual .js file as above, in a Mozilla-based browser (such as Seamonkey or Firefox) you may get a virus alert for a file named something similar to C:\Documents and Settings\USERNAME\Application Data\Mozilla\Profiles\Default\xxxxxxxx.SLT\CACHE\xxxxxxxxxxx

Usually, these false positives are fixed by CA pretty quickly. For most people this should just be a temporary nuisance that will be fixed with the latest virus update.

You can submit suspect files to CA here for analysis, that may well help them to fix the problem.

Follow up: this problem has now been fixed. It turns out that the javascript had been compressed using this packer tool which itself is harmless, but it does appear that the packer has been used for malicious javascript applications in the past as well as legitimate ones. Perhaps the lesson is.. don't pack or obfuscate your javascript!

Dating Scam Sites V

Another bunch of dating scam sites, to follow on from these. Hosted on 210.14.129.25.

• Engineride.info
• Enginewreck.info
• Glorylandusa.info
• Glorywaychurchx.info
• Honordays.info
• Honorholes.info
• Honorministries.info
• Morninghonor.info
• Oldgloryshirts.info
• Simoldglory.info
• Usoldglory.info
• Theredglow.info

Sample email:

Hey you
I read your profile on-line a few minutes ago and you seem intresting
email me at Nikki@GloryWayChurchx.info and I will reply with a Picture and Info
about me right away
I will stay online and wait for your email
Talk to you soon

Highly targeted phish - frauddept@ustreas.gov

This is a highly targeted phish aimed at senior management in a company. The manager (typically a principle officer or other named contact) is named in full, along with the full name of the target company. Attached is a file called complaint.zip with a trojan.

In this case, the email comes from frauddept@ustreas.gov but it could potentially come from any government agency. The bottom line.. exercise caution with unsolicited email attachments.

Dear [Real Name],

A complaint has been filled against the company you are affiliated to [Company Name] in regards to the possibillity of tax avoidance and money laundering schemes.

The complaint was filled by Mr. Benjamin Kent on 12/10/2007 and contains refferences that link your company and another 4 companies in an attemt to gain illegal proffit.

Registration : [Reference] Date: 12/10/2007

A copy of the initial complaint and claims has been attached to this e-mail.Please print and keep this copy for your personal records.

Disputes involving consumer products and/or services may be arbitrated. Unless they directly relate to the contract that is the basis of this dispute, the following claims will be considered for arbitration only if all parties agree in writing that the arbitrator may consider them:

Claims based on product liability;

Claims for personal injuries;

Claims that have been resolved by a previous court action, arbitration, or written agreement between the parties.

The decision as to whether your dispute or any part of it can be arbitrated rests solely with the US Department of Treasury.

The Department of Treasury offers a binding arbitration service for

disputes involving marketplace transactions. Arbitration is a convenient, civilized way to settle disputes quickly and fairly, without the costs associated with other legal options.

Dating Scam Sites IV

More domains that seem to be associated with this dating scam, this time hosted on 210.14.129.25 in China.

• Alpenshine.info
• Bunlight.info
• Charmshine.info
• Comfortshine.info
• Glowballproducts.info
• Glowlightstuff.info
• Glowplugfuel.info
• Goldenglowinc.info
• Healthyglowusa.info
• Lightbal.info
• Lightplugs.info
• Shinebal.info
• Shinecandles.info
• Shineplug.info
• Shinestick.info
• Shinyglowstick.info
• Thebestglow.info
• Theglowpup.info
• Theglowpuppy.info
• Theredglow.info

The basic approach is unchanged:

Hello! I am tired this afternoon. I am nice girl that would like to chat with you.
Email me at fbhk@GlowBallProducts.info only, because I am writing not from my
personal email. I will reply with my pics

Well, I'm pretty tired this afternoon too but that doesn't make me want to email pics of myself to strangers!

Yourmusic.com ad banners sering up malware

For at least a week, Virgin Media (and probably other sites) have been serving up compromised ads for Yourmusic.com that direct their users to a fake anti-spyware site called MalwareAlarm.com (via malware-scan.com) - which is actually a trojan designed to scare people into parting with their cash, while infecting their machines at the same time.

How the banners got compromised is a mystery, but it's clearly the work of a third party. More here.