Effects
Spybot.AKB carries out the following actions:
- It reaches the computer in a file with the following icon (the name of the file can be different):
- Once run, it drops a file which installs an extension for Firefox and Chrome browsers, as can be seen in the image below:
- In spite of choosing the Disable (Desactivar) or Uninstall (Desinstalar) option, the extension is disabled or uninstalled, but the file that has installed it remain memory resident.
- This extension is used to redirect certain seraches carries out by the user to websites that can contain malware.
- When users do searches that contain any of the following text strings, the extension is activated and starts redirecting to other websites:
A: Airlines, Amazon,Antivir, Antivirus.
B: Baseball, Books.
C: Casino, Chrome, Cialis, Cigarettes, Comcast, Craigslist, Credit.
D: Dating, Design, Doctor.
E: Explorer
F: Fashion, Finance, Firefox, Flifhts, Flower, Football
G: Gambling, Gifts, Graphic.
H: Health, Hotel.
I: Insurance, Iphone.
L: Loans.
M: Medical, Military, Mobile, Money, Mortgage, Movie, Music, Myspace.
O: Opera.
P: Pharma, Pocker.
S: School, Software, Sport, Spybot, Spyware.
T: Trading, Tramadol, Travel, Twitter.
V: Verizon, Video, Virus, Vocations.
W: Wallpaper, Weather. - For example, if users do a search that contain the word "Antivirus" or "Virus", it attempts to connect to a website like the following whose address contain the keyword entered by the users:
http://searchnx.com/se.php?pop=1&aid=YmxhY<blocked>D8&sid=1912146&key=antivirus
http://searchnx.com/se.php?pop=1&aid=YmxhY<blocked>D8&sid=19121941&key=virus - These addresses are no longer available: therefore users are not redirected to any malicious website, but to the legitimate website of the Bing searcher.
- The real purpose was to redirect users to malicious websites from which more malware would be downloaded.
On the other hand, Spybot.AKB carries out other actions to reduce the security level of the computer:
- It adds itself to the list of authorized applications by the Windows firewall in order to bypass it.
- It disables the Windows error reporting service.
- It disables the User Access Control service (UAC). It is a service which, on Windows 7/Vista computers, informs users of any program that attempts to be run or access the computer.
Infection strategy
Spybot.AKB creates the following files in the Windows system directory:
- GOOGLEUPDATES.EXE, which is a copy of the worm.
- GNOTE.EXE.
Spybot.AKB creates the following entries in the Windows Registry:
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Google Update3 = %sysdir%\GoogleUpdates.exe
where %sysdir% is the Windows system directory.
By creating this entry, Spybot.AKB ensures that it is run whenever Windows is started. - HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ SharedAccess\ Parameters\ FirewallPolicy\ StandardProfile\ AuthorizedApplications\ List
%sysdir%\GoogleUpdates.exe = %sysdir%\GoogleUpdates.exe:*:Enabled:Explorer
By creating this entry, Spybot.AKB adds itself to the list of authorized programs by the Windows firewall. - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
EnableLUA = 00, 00, 00, 00
It disables the User Access Control (UAC).
It is a Windows 7/Vista feature that warns users of any program that attempts to be run or access the computer. - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
DeleteFlag = 01, 00, 00, 00 - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
FailureActions = 0A, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 54, 00, 41, 00, 00, 00, 00, 00, B8, 0B, 00, 00
By creating these two entries, it disables the Windows error reporting service. - HKEY_CURRENT_USER\Software\Microsoft\Google3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Google3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
google5 = 02 - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
google6 = 10
Spybot.AKB modifies the following entry from the Windows Registry so that the Windows error reporting error is not automatically run:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
Start = 02, 00, 00, 00
It changes this entry to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc
Start = 04, 00, 00, 00
Means of transmission
Spybot.AKB uses several means to spread itself in order to infect as many computers as possible.
Spybot.AKB spreads via email messages and P2P programs.
1.- Email messages
It reaches the computer in an email message that seems to be an invitation to Twitter sent by some friend. The message contains the Twitter logo and several links that point to the real Twitter website.
However, in order to accept the invitation or know who has sent it, the attached file has to be run. This file contains a copy of the worm, so if it is run, the computer will be affected by Spybot.AKB.
The email message used to distribute the worm is like the following:
If the attached file called INVITATION CARD.ZIP is decompressed, users will see that i contains a file that seems to be an image, as it has a JPG extension. However, after several blank spaces the EXE extensions can be seen:
2.- P2P programs
In order to do so, it follows the routine below:
- The worm creates copies of itself in the shared folders of the following P2P programs:
eMule
LimeWire
Morpheus
Tesla
Winmx
eDonkey
Bearshare
Grokster
Icq
Kazaa - It uses the following names, passing itself off as interesting applications:
Absolute Video Converter 6.2.exe
Ad-aware 2010.exe
Adobe Acrobat Reader keygen.exe
Adobe Illustrator CS4 crack.exe
Adobe Photoshop CS4 crack.exe
Alcohol 120 v1.9.7.exe
Anti-Porn v13.5.12.29.exe
AnyDVD HD v.6.3.1.8 Beta incl crack.exe
AOL Instant Messenger (AIM) Hacker.exe
AOL Password Cracker.exe
Ashampoo Snap 3.02.exe
Avast 4.8 Professional.exe
BitDefender AntiVirus 2010 Keygen.exe
Blaze DVD Player Pro v6.52.exe
Brutus FTP Cracker.exe
CleanMyPC Registry Cleaner v6.02.exe
Counter-Strike KeyGen.exe
Daemon Tools Pro 4.11.exe
DCOM Exploit.exe
DivX 5.0 Pro KeyGen.exe
Divx Pro 7 + keymaker.exe
Download Accelerator Plus v9.exe
Download Boost 2.0.exe
DVD Tools Nero 10.5.6.0.exe
FTP Cracker.exe
G-Force Platinum v3.7.5.exe
Google SketchUp 7.1 Pro.exe
GoogleUpdates.exe
Grand Theft Auto IV (Offline Activation).exe
Half-Life 2 Downloader.exe
Hotmail Cracker.exe
Hotmail Hacker.exe
ICQ Hacker.exe
Image Size Reducer Pro v1.0.1.exe
Internet Download Manager V5.exe
IP Nuker.exe
Kaspersky AntiVirus 2010 crack.exe
Kaspersky Internet Security 2010 keygen.exe
Keylogger.exe
K-Lite Mega Codec v5.5.1.exe
K-Lite Mega Codec v5.6.1 Portable.exe
L0pht 4.0 Windows Password Cracker.exe
LimeWire Pro v4.18.3.exe
Magic Video Converter 8 0 2 18.exe
McAfee Total Protection 2010.exe
Microsoft Visual Basic KeyGen.exe
Microsoft Visual C++ KeyGen.exe
Microsoft Visual Studio KeyGen.exe
Microsoft.Windows 7 ULTIMATE FINAL activator+keygen x86.e
Motorola, nokia, ericsson mobil phone tools.exe
Mp3 Splitter and Joiner Pro v3.48.exe
MSN Password Cracker.exe
Myspace theme collection.exe
Nero 9 9.2.6.0 keygen.exe
NetBIOS Cracker.exe
NetBIOS Hacker.exe
Norton Anti-Virus 2005 Enterprise Crack.exe
Norton Anti-Virus 2010 Enterprise Crack.exe
Norton Internet Security 2010 crack.exe
Password Cracker.exe
PDF password remover (works with all acrobat reader).exe
PDF to Word Converter 3.0.exe
PDF Unlocker v2.0.3.exe
PDF-XChange Pro.exe
Power ISO v4.2 + keygen axxo.exe
Rapidshare Auto Downloader 3.8.exe
RapidShare Killer AIO 2010.exe
sdbot with NetBIOS Spread.exe
Sophos antivirus updater bypass.exe
Sub7 2.3 Private.exe
Super Utilities Pro 2009 11.0.exe
Total Commander7 license+keygen.exe
Trojan Killer v2.9.4173.exe
Tuneup Ultilities 2010.exe
Twitter FriendAdder 2.1.1.exe
UT 2003 KeyGen.exe
VmWare 7.0 keygen.exe
VmWare keygen.exe
Website Hacker.exe
Winamp.Pro.v7.33.PowerPack.Portable+installer.exe
Windows 2003 Advanced Server KeyGen.exe
Windows 2008 Enterprise Server VMWare Virtual Machine.exe
Windows 7 Ultimate keygen.exe
Windows Password Cracker.exe
Windows XP PRO Corp SP3 valid-key generator.exe
Windows2008 keygen and activator.exe
WinRAR v3.x keygen RaZoR.exe
Youtube Music Downloader 1.0.exe
YouTubeGet 5.4.exe - This way, the users that are looking for this type of programs could download and run them thinking they are inoffensive applications when they are copies of the worm.
Further Details
Spybot.AKB is written in the programming language Visual C++ v5. This worm is 419,328 bytes in size.
Research carried out by Aitor Crespo.
>