The Emsi Software malware research team has discoverd a new outbreak of the TrustFighter adware. a-squared Anti-Malware detects this malware as Adware.Win32.TrustFighter.

TrustFighter is a rogue scanner program, it will act like antivirus program. It show misleading scan results, and fake security alerts to convince the user that their computer infected with malware. The author of TrustFighter also made TheDefend, GuardPcs, IGuardPc, SiteAdware, AntiTroy, AntiKeep, AntiAdd, RESpyWare, REAnti, KeepCop, SecureKeeper, LinkSafeness, AntiAid, SystemFighter, SystemVeteran, BlockProtector, BlockKeeper, BlockScanner, BlockWatcher, SoftStronghold, ShieldSafeness, SoftVeteran, SoftSoldier,  SoftCop, TrustSoldier, SafeFighter, SecureVeteran, etc. To more convince users, TrustFighter will also create numerous files on your computer that will be detected as malware when the program scans your computer, but will not allow you to remove them until you purchase it.

This application try to contacts trustfighter.com, to download the latest update of this rogue.

Create new files:

• %ProgramFiles%\TrustFighter Software\TrustFighter\TrustFighter.exe
• %ProgramFiles%\TrustFighter Software\TrustFighter\uninstall.exe
• %AllUsersProfile%\Desktop\TrustFighter.lnk
• %AllUsersProfile%\Start Menu\Programs\TrustFighter\1 TrustFighter.lnk
• %AllUsersProfile%\Start Menu\Programs\TrustFighter\2 Homepage.lnk
• %AllUsersProfile%\Start Menu\Programs\TrustFighter\3 Uninstall.lnk

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\TrustFighter
• HKEY_LOCAL_MACHINE\software\TrustFighter
• HKEY_CURRENT_USER\software\TrustFighter
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run, TrustFighter

Malware screenshots:

How to remove the infection of Adware.Win32.TrustFighter?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

The Emsi Software malware research team has discoverd a new outbreak of the Windows Enterprise Defender adware. a-squared Anti-Malware detects this malware as Adware.Win32.WindowsEnterpriseDefender.

Windows Enterprise Defender is an rogue scanner program, it will act like antivirus program. It show misleading scan results, and fake security alerts to convince the user that their computer infected with malware. The author of WindowsEnterpriseDefender is still the same as that made Windows PC Defender (Adware.Win32.WindowsPCDefender). To more convince users, WindowsEnterpriseDefender will also create numerous files on your computer that will be detected as malware when the program scans your computer, but will not allow you to remove them until you purchase it.

This application try to contacts WindowsEnterpriseDefender.com, to download the latest update of this rogue.

Create new files:

• %SystemRoot%\system32\drivers\etc\hosts
• %AllUsersProfile%\Application Data\e5d1\47.mof
• %AllUsersProfile%\Application Data\e5d1\unins000.dat
• %AllUsersProfile%\Application Data\e5d1\WED.ico
• %AllUsersProfile%\Application Data\e5d1\WindowsEDefender.exe
• %AllUsersProfile%\Application Data\e5d1\BackUp\HyperSnap-DX.lnk
• %AllUsersProfile%\Application Data\e5d1\WEDDSys\vd952342.bd
• %AllUsersProfile%\Application Data\WEDDSys\wed.cfg
• %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Enterprise Defender.lnk
• %UserProfile%\Application Data\Windows Enterprise Defender\Instructions.ini
• %UserProfile%\Cookies\virus demo@windowsenterprisedefender[2].txt
• %UserProfile%\Desktop\Windows Enterprise Defender.lnk
• %UserProfile%\Start Menu\Windows Enterprise Defender.lnk
• %UserProfile%\Start Menu\Programs\Windows Enterprise Defender.lnk

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\Classes\WindowsEDefender.DocHostUIHandler
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Enterprise Defender

This rogue also try to modify hosts file:

74.125.45.100 4-open-davinci.com
74.125.45.100 securitysoftwarepayments.com
74.125.45.100 privatesecuredpayments.com
74.125.45.100 secure.privatesecuredpayments.com
74.125.45.100 getantivirusplusnow.com
74.125.45.100 secure-plus-payments.com
74.125.45.100 www.getantivirusplusnow.com
74.125.45.100 www.secure-plus-payments.com
74.125.45.100 www.getavplusnow.com
74.125.45.100 www.securesoftwarebill.com
74.125.45.100 secure.paysecuresystem.com
74.125.45.100 paysoftbillsolution.com

Malware screenshots:

How to remove the infection of Adware.Win32.WindowsEnterpriseDefender?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

The Emsi Software malware research team has discoverd a new outbreak of the TrustSoldier adware. a-squared Anti-Malware detects this malware as Adware.Win32.TrustSoldier.

TrustSoldier is a rogue scanner program, it will act like antivirus program. It show misleading scan results, and fake security alerts to convince the user that their computer infected with malware. The author of TrustSoldier also made TheDefend, GuardPcs, IGuardPc, SiteAdware, AntiTroy, AntiKeep, AntiAdd, RESpyWare, REAnti, KeepCop, SecureKeeper, LinkSafeness, AntiAid, SystemFighter, SystemVeteran, BlockProtector, BlockKeeper, BlockScanner, BlockWatcher, SoftStronghold, ShieldSafeness, SoftVeteran, SoftSoldier,  SoftCop, TrustFighter, SafeFighter, SecureVeteran, etc. To more convince users, TrustSoldier will also create numerous files on your computer that will be detected as malware when the program scans your computer, but will not allow you to remove them until you purchase it.

This application try to contacts trustsoldier.com, to download the latest update of this rogue.

Create new files:

• %ProgramFiles%\TrustSoldier Software\TrustSoldier\TrustSoldier.exe
• %ProgramFiles%\TrustSoldier Software\TrustSoldier\uninstall.exe
• %AllUsersProfile%\Desktop\TrustSoldier.lnk
• %AllUsersProfile%\Start Menu\Programs\TrustSoldier\1 TrustSoldier.lnk
• %AllUsersProfile%\Start Menu\Programs\TrustSoldier\2 Homepage.lnk
• %AllUsersProfile%\Start Menu\Programs\TrustSoldier\3 Uninstall.lnk
• %Cookies%\username@trustsoldier[2].txt

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\TrustSoldier
• HKEY_LOCAL_MACHINE\software\TrustSoldier
• HKEY_CURRENT_USER\software\TrustSoldier
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run|TrustSoldier

Malware screenshots:

How to remove the infection of Adware.Win32.TrustSoldier?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

The Emsi Software malware research team has discoverd a new outbreak of the SafeFighter adware. a-squared Anti-Malware detects this malware as Adware.Win32.SafeFighter.

SafeFighter is a rogue scanner program, it will act like antivirus program. It show misleading scan results, and fake security alerts to convince the user that their computer infected with malware. The author of SafeFighter also made TheDefend, GuardPcs, IGuardPc, SiteAdware, AntiTroy, AntiKeep, AntiAdd, RESpyWare, REAnti, KeepCop, SecureKeeper, LinkSafeness, AntiAid, SystemFighter, SystemVeteran, BlockProtector, BlockKeeper, BlockScanner, BlockWatcher, SoftStronghold, ShieldSafeness, SoftVeteran, SoftSoldier,  SoftCop, TrustFighter, TrustSoldier, SecureVeteran, etc. To more convince users, SafeFighter will also create numerous files on your computer that will be detected as malware when the program scans your computer, but will not allow you to remove them until you purchase it.

This application try to contacts safefighter.com, to download the latest update of this rogue.

Create new files:

• %ProgramFiles%\SafeFighter Software\SafeFighter\SafeFighter.exe
• %ProgramFiles%\SafeFighter Software\SafeFighter\uninstall.exe
• %AllUsersProfile%\Desktop\SafeFighter.lnk
• %AllUsersProfile%\Start Menu\Programs\SafeFighter\1 SafeFighter.lnk
• %AllUsersProfile%\Start Menu\Programs\SafeFighter\2 Homepage.lnk
• %AllUsersProfile%\Start Menu\Programs\SafeFighter\3 Uninstall.lnk

Create new registry entries:

• HKEY_LOCAL_MACHINE\software\microsoft\Windows\CurrentVersion\Uninstall\SafeFighter
• HKEY_LOCAL_MACHINE\software\SafeFighter
• HKEY_CURRENT_USER\software\SafeFighter
• HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run\SafeFighter

Malware screenshots:

How to remove the infection of Adware.Win32.SafeFighter?

To delete this malware infection, please download and install a-squared Anti-Malware. Run a full scan on all drives and move all detected items to the quarantine.

Zeus is a bad applications that can steal your important information, like online banking accounts. This is same description from the authors, “Zeus is software to steal personal user data from remote system…”.

Zeus is the most popular financial malware on the Net today. a-squared Anti-Malware detects this malware as Trojan-Spy.Win32.Zbot. Zeus is also known as Zbot, Kollah, Pakes, PWSZbot, Banker, or Wsnpoem, as seen from this VirusTotal scan results:

Zeus contains the following modules:

• Zeus Web Control Panel (to control the botnet)
• Zeus Builder (to create the bot, and to encrypt the configuration file)
• Zeus BackConnect

The screenshot of Zeus builder:

Usually, the bot spreads by email. At the infected machine, he will contact the server to request a configuration file that contains a list of sites that are mostly online banking.

Bot is written in C++, and its encrypted. From one of our sample, this malware have such as characteristics:

The bot file using fake version information:

When executed, its try to copy itself to the following location, appends a random of data (junk) at the end of the file, and also its hidden from Explorer, because its hook API NtQueryDirectoryFile:

• %SystemRoot%\System32\sdra64.exe

The bot may then create some of the following files, and its hidden too:

• %SystemRoot%\System32\lowsec\local.ds
• %SystemRoot%\System32\lowsec\user.ds
• %SystemRoot%\System32\lowsec\user.ds.lll

Using IceSword, the hidden files and directory can be seen:

It creates one of the following mutexes:

• _AVIRA_2110
• _AVIRA_2101
• _AVIRA_2108
• _AVIRA_2109
• _AVIRA_21099

Then it enumerates process to checks for the presence of the following programs:

• outpost.exe (Outpost Personal Firewall)
• zlclient.exe (ZoneLabs Firewall)

Inject its own code to the following process:

• winlogon.exe
• svchost.exe
• explorer.exe

It also modify the following registry entry, so the bot can run automatically whenever Windows starts:

Once decrypted, we seen some interesting strings:

And here’s another strings:

Asystem
Asoftware
Awinsta0
ASetErrorMode
A*%u.%u.%u.%u*
Adefault
Agdiplus.dll
Aole32.dll
Agdi32.dll
ADISPLAY
AGdiplusStartup
AGdiplusShutdown
AGdipCreateBitmapFromHBITMAP
AGdipDisposeImage
AGdipGetImageEncodersSize
AGdipGetImageEncoders
AGdipSaveImageToStream
ACreateStreamOnHGlobal
ACreateDCA
ACreateCompatibleDC
AGetDeviceCaps
ACreateCompatibleBitmap
ASelectObject
ABitBlt
ADeleteObject
ADeleteDC
Areboot
Ashutdown
Aresetgrab
Aupcfg
Akbot
Arename_bot
Agetcerts
Agetmff
Adelmff
Asethomepage
Abc_add
Abc_del
Ablock_url
Aunblock_url
Ablock_fake
Aunblock_fake
Akos
Arexeci
Arexec
Alexeci
Alexec
Aapplication/x-www-form-urlencoded
AContent-Type: %s
ZCID: %s
AKeys:
ATYPE
AFEAT
APASV
ASTAT
ALIST
Aanonymous
Ahttps://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome
ACustomerServiceMenuEntryPoint?custAction=75
AQ%u: %s
A%u: %s
AAccept-Encoding:
Agetfile
Aaddsf
Adelsf
AGRABBED TAN:
ASKIPPED TAN:
lowsec
user.ds
local.ds
sdra64.exe
SYSTEM
winlogon.exe
svchost.exe
explorer.exe
$UID
_AVIRA_2110
_AVIRA_2101
_AVIRA_2108
_AVIRA_2109
_AVIRA_21099
userinit
software\microsoft\windows nt\currentversion\network
software\microsoft\windows nt\currentversion\winlogon
software\microsoft\windows\currentversion\run
csrss.exe
%s_%08X
%08X%08X%08X%X
ntdll.dll
outpost.exe
zlclient.exe
image/jpeg
screens\%s\%04X_%08X.jpg
drivers\etc\hosts
%08X.uf
*.uf
pass
software\microsoft\windows\currentversion\explorer\comdlg32
filesearch\%06X_%s
certs\%s_%02u_%02u_%04u.pfx

How to remove the infection of Trojan-Spy.Win32.Zbot?

To delete this malware infection, please download and install a-squared
Anti-Malware. Run a full scan on all drives and move all detected items
to the quarantine.