[SecConnex]

Damn epic...

infected services.exe on x32 - 2 / 42 - Virus:Win32/Sirefef.R https://www.virustotal.com/file/4c1096f ... 340263629/

Quick question...

Anyone have a record of four infected files from ZA (XP test machine)?

-user32.dll (verified problem with ZA)
-services.exe (" once again verified)
-explorer.exe (unverified...?)
-volsnap.sys (unverified...?)


If that means volsnap.sys is really infected, then it would be nearly impossible for ComboFix to replace services.exe using Volume Shadow Copy?

[EP_X0FF]

Anyone have a record of four infected files from ZA (XP test machine)?

-user32.dll (verified problem with ZA)
-services.exe (" once again verified)

Please attach dropper that infects user32.dll (as it verified). How do you managed to infect services.exe on XP, when latest dropper has no such code (authors were unable to find a space inside XP services.exe for shellcode injection).

volsnap.sys (unverified...?)

This was a target of PRAGMA TDL3 modification.

[SecConnex]

Ha...funny how I misplace droppers.

This dropper is almost a month old, tbh.

Totally clean XP box...infected with ZA obtained on May 27.

No other malware was installed. I understand about the Pragma issue resulting from TDL3, but there's no way that happened.

However, I imagine if we gathered the droppers from near that date... I'll see if I can find them posted and gather a quick link-column.

[SecConnex]

HERE: http://www.kernelmode.info/forum/viewto ... =20#p13448

Seeing the same import again as saw in first test of GMER: CreateProcessAsUserW in API-MS-Win-Core-ProcessThreads-L1-1-0.dll

Services.exe MD5 - 2B336AB6286D6C81FA02CBAB914E3C6C

[EP_X0FF]

HERE: http://www.kernelmode.info/forum/viewto ... =20#p13448

Seeing the same import again as saw in first test of GMER: CreateProcessAsUserW in API-MS-Win-Core-ProcessThreads-L1-1-0.dll

Services.exe MD5 - 2B336AB6286D6C81FA02CBAB914E3C6C

Windows 7 x86 test.

The only payload it contain - n32 and n64.

https://www.virustotal.com/file/073b1f9 ... /analysis/
https://www.virustotal.com/file/0f6e12d ... /analysis/

It not infects services.exe (https://www.virustotal.com/file/d7bc4ed ... /analysis/ - file copied in real time with help of low level disk access) and not performs CreateProcessAsUser hooking - verified twice - after infection and after reboot with different tools. Additionally there is no sense in such hook. Investigate your case with debugger, gmer is sh*tload of bugs. In attach decrypted dropper, all extracted payload (except configs) and decrypted n32 (p2p.32.dll).

[R136a1]

http://blog.eset.com/2012/06/25/zeroacc ... chronicles

Nothing what rkhunter has already discovered except the Affiliate program part that distributes the new ZeroAccess version...

[EP_X0FF]

http://blog.eset.com/2012/06/25/zeroacc ... chronicles

How slow and superficially. Doubt they decided to post this without blog post from hitmanpro.

[thisisu]

Looks like MSE is tagging the infected services.exe but still isn't able to cure it.

Code: Select all

2012-06-25 09:28 - 2012-06-25 09:28 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.FE5EF61116C70C30
2012-06-25 09:24 - 2012-06-25 09:24 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B78730FE88D98AC9
2012-06-25 09:21 - 2012-06-25 09:21 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.F86C05175A0C4934
2012-06-25 09:18 - 2012-06-25 09:18 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.ACAC1DFE013303CD
2012-06-24 19:14 - 2012-06-24 19:14 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.8C07C03A2F624688
2012-06-24 19:12 - 2012-06-24 19:12 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.4347C6D8DABD5423
2012-06-25 09:33 - 2012-06-25 09:33 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.138C64E1626E5C19

Thread source: http://forums.majorgeeks.com/showthread.php?t=260886

[Tigzy]

Is the service.exe protected?
I mean is it readable with high level APIs? (ReadProcessMemory or Read on disk)

EDIT: I can't load infected service.exe into Olly; Error message saying "unable to start name_of_file.exe"
EDIT2: Ok with IDA

[rkhunter]

Is the service.exe protected?
I mean is it readable with high level APIs? (ReadProcessMemory or Read on disk)

It without rootkit and not hide itself.