Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protections against Recent Malware Threats (25-May-08)

Subscribe

Check Point Reference: CPAI-2008-071
Date Published:
Severity:
Source: http://www.spywaresignatures.com/details.php?spyware=find.fmtoolbar
http://www.spywaresignatures.com/details.php?spyware=ezreward
http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453090717
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
  • NG with Application Intelligence R55
VSX
  • NGX
  • NGX R65
InterSpect
  • NGX
Connectra
  • NGX R62
  • NGX R61
Who is Vulnerable?
Microsoft Windows clients
Vulnerability Description
Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network access to intrude upon organizations, destroying or stealing data.

Spyware is computer software that is installed without the user's informed consent on a personal computer to intercept or take partial control over the user's interaction with the computer. Spyware programs can collect various types of personal information, install additional software, redirect Web browser activity, or divert advertising revenue to a third party.

Adware is an advertising-supported software package which automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used.

A Trojan horse is a program that installs malicious software while under the guise of doing something else.  Trojans are known for installing backdoor programs which allow unauthorized non permissible remote access to the victim's machine by unwanted parties with malicious intentions.

Vulnerability Details
The update includes new protections against 3 recent malware threats:

Toolbar: Find FM - Find.FM is a toolbar that hijacks the address bar, changes the Internet Explorer search bar and redirects all traffic to its own server.

Spyware: EzReward - EzReward is a Plug-in that changes the browser settings by redirecting error page and address bar to its own search engine. It may also install other malicious adware and display advertising without user's consent.

Toolbar: MySearch Bar - MySearch Bar is a search toolbar that sets tracking cookies on a user's computer, and redirects the user's search keywords.

Protection Overview
The update enables the Header Rejection protection and the HTTP Worm Catcher to detect and block the malware based on pre-defined header names and worm signatures.

In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Web Intelligence > HTTP Protocol Inspection > Header Rejection.
2. In the Header Rejection configuration pane, under Settings > Mode, check Active.
3. Enable the following protections:

Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

4. In the SmartDefense tab, click Web Intelligence > Malicious Code > General HTTP Worm Catcher.
5. In the General HTTP Worm Catcher configuration pane, under Settings > Mode, check Active.
6. Enable the following protection:

Toolbar: MySearch Bar

7. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar

Attack Name: Header Rejection
Attack Information:
Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the Web Intelligence tree, click HTTP Protocol Inspection > Header Rejection.
2. Enable the following protections:

Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

3. In the Web Intelligence tree , click Malicious Code > General HTTP Worm Catcher.
4. Enable the following protection:

Toolbar: MySearch Bar

5. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar

Attack Name: Header Rejection
Attack Information:
Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

VPN-1 NG with Application Intelligence R55

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Web > HTTP Protocol Inspection and enable Peer to Peer.
2. Enable the following protections:

Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

3. In the SmartDefense tree, click Application Intelligence > Web and enable General HTTP Worm Catcher.
4. Enable the following protection:

Toolbar: MySearch Bar

5. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar

Attack Name: Header Rejection
Attack Information:
Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Web Intelligence > HTTP Protocol Inspection > Header Rejection.
2. In the Header Rejection configuration pane, under Settings > Mode, check Active.
3. Enable the following protections:

Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

4. In the SmartDefense tab, click Web Intelligence > Malicious Code > General HTTP Worm Catcher.
5. In the General HTTP Worm Catcher configuration pane, under Settings > Mode, check Active.
6. Enable the following protection:

Toolbar: MySearch Bar

7. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar

Attack Name: Header Rejection
Attack Information:
Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

VPN-1 VSX NGX

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Web > HTTP Protocol Inspection and enable Peer to Peer.
2. Enable the following protections:

Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

3. In the SmartDefense tree, click Application Intelligence > Web and enable General HTTP Worm Catcher.
4. Enable the following protection:

Toolbar: MySearch Bar

5. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar

Attack Name: Header Rejection
Attack Information:
Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the Web Intelligence page of the profile.
2. In the Web Intelligence tree, click HTTP Protocol Inspection > Header Rejection.
3. Enable the following protections:

Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

4. In the Web Intelligence tree, click Malicious Code > General HTTP Worm Catcher.
5. Enable the following protection:

Toolbar: MySearch Bar

6. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar

Attack Name: Header Rejection
Attack Information:
Toolbar: Find FM 1
Toolbar: Find FM 2
Spyware: EzReward
Toolbar: MySearch Bar 1

Connectra NGX R62 & R61

How Can I Protect My Network?
1. In the navigation tree, click Web Intelligence. In the Malicious Code Protection pane click General HTTP Worm Catcher.
2. Enable the following protection:

Toolbar: MySearch Bar

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Attack Name: HTTP Worm Catcher
Attack Information: Toolbar: MySearch Bar