|
Trojan Mespam
It has been observed that a Trojan named Mespam is circulating widely. It gets dropped by Storm Worm /Trojan Peacomm Variants
or propagates through malicious links which are embedded within Internet Messenger, e-mails, forum posts.The Trojan communicates via HTTP to certain remote websites to download the message body. This message body appears to be legitimate which tricks users to click upon the link provided within the abovesaid mediums to download malware onto the system.
After execution, the Trojan registered itself as Layered Service Provider which allows it to run each time the network device gets initialized.
A Layered Service Provider is a DLL that uses Winsock APIs to insert itself into the TCP/IP stack. Once in the stack, a Layered Service Provider can intercept and modify all inbound and outbound Internet traffic. It could be used by a computer security program, which analyzes the traffic in search for viruses or other threats before transferring it to the final application of the traffic.
The below mentioned contents can be within the body of e-mail, Internet Messenger, Web Forums
LOL ;-) http://66 DOT 148 DOT 74 DOT 7/ag.[REMOVED]
have you seen this? http://mailfreepostcards DOT com/funvid[REMOVED]
Dont forget to see http://mailfreepostcards DOT com/funvid[REMOVED] !
Aliases: Troj/SpamToo-U [Sophos], Spam-Mespam [McAfee], WORM_ZHELATIN.CH [Trend], Troj/SpamToo-X [Sophos]
Upon execution, the Trojan :
References
http://www.symantec.com/security_response/writeup.jsp?
docid=2007-020915-2914-99&tabid=2
http://www.sophos.com/security/analyses/viruses-and-spyware/
trojspamtooz.html
http://www.sophos.com/security/analyses/viruses-and-spyware/
trojspamtoou.html
http://vil.nai.com/vil/content/v_141590.htm
http://www.precisesecurity.com/computer-virus/tms-feb0709.htm
|
