Check Point Advisories

Update Protections against Recent Malware Threats (7-Nov-07)

Check Point Reference: CPAI-2007-129
Date Published: 7 Nov 2007
Severity: Medium
Last Updated: Monday 01 January, 2007
Source: http://www.spyany.com/program/article_ad_rm_NewDotNet.html
http://www.spywareguide.com/spydet_2839_trojan_media_codec.html
http://www.sophos.com/virusinfo/analyses/trojtrolla.html
Protection Provided by:
Who is Vulnerable? Microsoft Windows clients
Vulnerability Description Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network access to intrude upon organizations, destroying or stealing data.

Spyware is computer software that is installed without the user's informed consent on a personal computer to intercept or take partial control over the user's interaction with the computer. Spyware programs can collect various types of personal information, install additional software, redirect Web browser activity, or divert advertising revenue to a third party.

Adware is an advertising-supported software package which automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used.

A Trojan horse is a program that installs malicious software while under the guise of doing something else.  Trojans are known for installing backdoor programs which allow unauthorized non permissible remote access to the victim's machine by unwanted parties with malicious intentions.

Vulnerability DetailsThe update includes new protections against 3 recent malware threats:

Trojan: Troll - Troll is a downloader program which can be configured to fetch files from malicious URLs and save them to the Windows folder, System folder or temporary folder. The downloaded files will then be executed. It also sends a notification message to a an ICQ account when run.

Trojan: Zlob Media - Zlob Media Codec is a downloader Trojan that prompts users to upgrade to Windows Media Player to view adult oriented videos. However, Zlob actually downloads and installs additional malware on the user's machine. Upon installation, the browser settings may be altered with additional buttons installed on the Internet Explorer toolbar. Pop ups of unwanted advertisements and alert messages are displayed to scare users into purchasing these software.

Spyware: New Net - New Net is a company that sells domain names for "non-standard" top-level domains. Upon installation of the software, other file sharing clients and other free downloads are bundled with it. It also hijacks the user's address bar and redirects all searches to another server where automatic updates may be downloaded without the user's consent.

Protection Overview

×
  Feedback
This website uses cookies for its functionality and for analytics and marketing purposes. By continuing to use this website, you agree to the use of cookies. For more information, please read our Cookies Notice.
OK