Dangerous new trojan on the loose

I'd thought I'd draw everyone's attention to this TDS-3 Advisory.

A further reason to keep your virus/trojandefinitions updated if ever there was one.

And maybe even to invest in a good antitrojan.

TDS-3, BOClean, The Cleaner, AVG-Kaspersky, and Trojan Remover seem to be the only ones that are recognizing it at this moment.

Others will follow, no doubt.

Diamond Computer Systems Security Advisory
===============================

RELEASE DATE: Fri, 5th April 2002
RISING THREAT: Optix Pro Trojan

This advisory is being released to help raise the awareness of a new trojan that is set to become a widespread attack tool of the underground in a matter of weeks. Optix Pro poses a great threat to the security of users worldwide, and it is already being hailed by underground users and those in the trojan "scene" as one of the best trojans ever created.

Being a full-featured trojan, Optix Pro weighs in at 889,344 bytes before compression. This may be one factor that will slow the spread of this trojan. However, it will most likely be used after initial stealth infection by the small Optix Lite, a very popular "uploader trojan".


DESCRIPTION

Optix Pro has all the features common in today's Remote Access Trojans, and many more. Highly praised by the underground are the screen capture and webcam capture which are very clear and fast. The first release of Optix Pro came just 2 days ago at the time of this writing, released on the night of Wednesday April 3, 2002. Due to the stability, speed, and features of Optix Pro (not to mention its growing userbase) we anticipate that it will become the trojan of choice for many trojan users.

Like Optix Lite, the Pro version has a security program terminator feature that, when activated, will close all popular security programs down every 60 seconds (Optix Lite cycled every 45 seconds). TDS-3 easily detects Optix Pro due to precision scanning techniques with advanced routines such as the critical Process Memory Space scanning. TDS-3 also has specific routines to target Optix Pro with file scanning, it would be extremely difficult (and probably not worth the hackers effort) to infect a TDS-3 system with all protection enabled, even with highly modified Optix Pro servers. TDS-3 Execution Protection will use the advanced signatures and block the execution of Optix Pro servers, preventing the infection from occurring in the first place.

In the unlikely event that a TDS-3 protected system is infected, users can simply rename TDS-3.EXE to be able to launch the application. Even a completely unknown trojan with this ability can be detected with the Process Memory Space scan as TDS-3 looks for such suspicious process terminating characteristics.


SPECIFICATIONS


Family Name Optix
Class Remote Access Trojan (RAT)
Compiler Borland Delphi 5
Author s13az3, Evil Eye Software
Known Variants 1.0
FileSize Client v1.0
381,952 bytes (Compressed - UPX 1.20)
EditServer v1.0
367,616 bytes (Compressed - UPX 1.20)
Server v1.0
889,344 bytes - Not Compressed (before editing, editor adds 2 bytes)
Server v1.0 UPX Compressed
336,384 bytes
Default Port TCP 3410 (Configurable)
Default Install Copies itself to %windir%\spooll32.exe (Configurable)
Default Autostart REGISTRY - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr
entVersion\Run "vscanner" (Configurable)
Other Autostarts Stealth method - copies itself as wmmiexe.exe to %WINDIR% and modifies the key at HKEY_CLASSES_ROOT\exefile\shell\open\command to read wmmiexe.exe "%1" %*
This will run the server when any executable file is run.


FEATURES

Server Options - Server info, System info, steal passwords. Restart, close, remove server. Power options include Shutdown, suspend, logoff, reboot, bluescreen.

File Options - Full file manager. New folder, upload/download, execute, delete, find, copy, paste, rename, view/set attributes, get size, set as wallpaper, play .wav file, display image.
Process manager. View processes, kill processes.
Window manager. View, close windows. Show/hide, bring to front, send to back.
Registry manager. Add/delete/modify registry keys and values.


Keyboard/Chat Options - Message boxes (any)
Keylogger
Client-Client chat (Multiple client connections available)
Client-Victim chat (Matrix window)
Send keys as if typed on remote keyboard

Spy Options - Screen capture
Webcam capture

Fun options - Show/Hide clock, start button. Flash keyboard lights, open/close CDROM, monitor on/off, screensaver on/off, swap/restore mouse buttons, enable/disable keyboard/mouse, set Internet Explorer start page, send to URL, beep PC speaker 200 times.

Notify Options - ICQ Notify, CGI online list, Email notify with inbuilt relay if selected. IRC notify.

Firewall and Antivirus killing - The trojan contains an astounding 209 process names (or registry keys in special cases*) which are hard-coded into the server file, effectively covering all well known and (and some not so well known) anti-virus programs, anti-trojan programs, firewalls, and process viewers/monitors. If the option to kill these programs is enabled, on execution of the trojan the users defences are killed, and every 60 seconds the program checks the process list again for and of the names. Essentially this means all security programs known to the trojan (estimated to be around 80 programs) can be shut down and they cannot run again as the trojan will recognise them in the next scan 60 seconds later.

*In some cases a process will not be terminated correctly. In this case, the trojan deletes the vital registry key that loads the program on startup, and there is an option to then force the PC to reboot.

Infected removal instructions - Rename the filenames of your main programs (eg. TDS-3.EXE), and use that to kill the server. Stay offline while you do this. Simply run a Process File scan and TDS should detect Optix Pro, even if modified. Process Memory scan will detect the server if this fails. To disinfect, simply Kill and Delete the process. Once you have done this, run a trace scan to find the leftover files, and possibly registry entry. Be sure to check if there is a file wmmiexe.exe in the Windows folder - if there is you'll need to change the above entry in the registry. DiamondCS Support can help with this by sending a registry file which fixes the association for EXE files, or download it here (cleanrun.reg).

Check this link for Symantec. The info is dated 4/15/02
http://securityresponse.symantec.com...oor.optix.html


------------------
"Don't know where I'm goin but there's no sense being late"

BEWARE of geeks bearing gifts, (or was that Greeks??? lol)...

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Quote:

---

Originally posted by griffinspc:
Check this link for Symantec. The info is dated 4/15/02
http://securityresponse.symantec.com...oor.optix.html

---

Absolutely: however, that's an older version.

Symantec doesn't have this one yet.

Cheers, Tony




[This message has been edited by Kleinkramer (edited 04-16-2002).]

Maybe i'm not reading close enough,but i don't see anything about "how" it infects your PC?

------------------
Badges? We don'need no Steenkin'badges!!

It's like most other trojans (or viruses for that matter) in that respect, really:
You download one accidentally, or it comes in an attachment.
They come disguised as games, pictures, screen savers, holiday greetings, and other files.

It's a program that is made up of two parts , the client and the server .

The server is the evil part , once executed ( double clicked on ) it hides itself inside your computer and opens a port or ports allowing the hacker access to your computer , or information that he or she may other wise not have been able to get .




[This message has been edited by Kleinkramer (edited 04-16-2002).]

Thanks Tony,,thought it may come as something specific. Guess i'd better oil-up the ol' radar... https://discussions.virtualdr.com/

------------------
Badges? We don'need no Steenkin'badges!!

If I have Norton AntiVirus software, and update my virus definitions faithfully every few days, will NAV eventually be a defence against this Trojan?
I have always been confused how effective NAV was against Trojans. The fact that Symantec has that article on the earlier version of this Trojan suggests NAV will handle it.

------------------
Jim
WIN98, IE6, cable,
Norton AV, ZoneAlarm

Forgive my skepticism, but much of the advisory reads like an advertisement for TDS-3, whatever that is. I have no doubt that within a day or so all of the major providers of security or AV programs will have updates to catch this new variant if they haven't already.

Mowergun

------------------
God save thee Windows users, from the fiends that plague thee thus.

But how could this machine be freezing and overheating at the same time?

Well, it's a TDS-3 advisory, so waddya expect?

On the other hand TDS-3 is in security circles considered about the best on demand antitrojan you can get, so it's not as though they don't know what they're talking about.

Take a look here for some opinions: http://www.wilders.org/anti_trojans.htm

And I anticipate that Symantec and others will probably follow before long, although I'm not qualified enough to
evaluate the effectiveness of their defense compared to that of the better dedicated antitrojans.

I know that apps like TDS-3 and BOClean, unlike many others, have protection from tampering by the latest generation of antitrojan that can do a Terminate Process call.

Thank you for saying so. I was having difficulty determining if the post was a warning or a commercial advertisement also.

I did not want to say it since I am new and did not want to offend anyone. I do not know who are the players on this board and therefore do not yet recognize whom represents good info or not.

------------------
"A nod is as good as a wink to a blind horse" - Rod Stewart

About NAV's level of protection against trojans, incidentally, this is not too good.

I do run NAV as an on demand scanner myself, and NOD32 as my 'resident' antivirus, so I'm not against NAV at all, but I wouldn't rely on it 100% as far as combating trojans goes.

I also run BOCLean as an antitrojan.

Also consider the update frequency: I get 5 or 6 NOD32 and BOClean updates weekly, sometimes more, which is more than I can say about NAV through LiveUpdate.

Report_2..

I can't remember the last time I saw someone spam the boards here. In fact since I've been a member (years) I've only ever seen it once or twice. You can bet that any posts recommending specific brands of software are entirely legit and only meant for the protection or welfare of other board users. In the extremely rare case of misinfo whether it's spam or simply wrong information you can also bet that someone else will be along to point it out (politely) within a few minutes.

I'm really amazed at how little spamming goes on here. It's quite refreshing not to have to wade through numbers of posts extolling the virtues of questionable software programs. I think it's because spammers know that this is a strictly moderated BBS and just don't bother to try.


[This message has been edited by fink (edited 04-16-2002).]

Quote:

---

Originally posted by Report_2:
Thank you for saying so. I was having difficulty determining if the post was a warning or a commercial advertisement also.

I did not want to say it since I am new and did not want to offend anyone. I do not know who are the players on this board and therefore do not yet recognize whom represents good info or not.

---

I think you're absolutely right to be wary, especially when the subject is security software, where everyone has his pet program.

I happen to find this subject interesting, and therefore spend a lot of time at security-oriented boards, so as to get information on the subject from people who really know what they're talking about.

Regarding the TDS-3 article, I don't think one should be really surprised that extensive advisories like this come frome precisely from makers of antitrojan software.

They rightly should be on the cutting edge of new developments in this field, or they wouldn't be worth their salt, as far as I'm concerned.

And to further dispel the suspicion that I might be working for Diamond CS (which would be complicated in any case because they're in Australia and I live in Holland.. https://discussions.virtualdr.com/) here are two advisories from the makers of Trojan Hunter:

Analysis of BioNet 3.12

Analysis of the Buschtrommel Trojan

cheers, Tony