Dangerous new trojan on the loose

I'd thought I'd draw everyone's attention to this TDS-3 Advisory.

A further reason to keep your virus/trojandefinitions updated if ever there was one.

And maybe even to invest in a good antitrojan.

TDS-3, BOClean, The Cleaner, AVG-Kaspersky, and Trojan Remover seem to be the only ones that are recognizing it at this moment.

Others will follow, no doubt.

Diamond Computer Systems Security Advisory
===============================

RELEASE DATE: Fri, 5th April 2002
RISING THREAT: Optix Pro Trojan

This advisory is being released to help raise the awareness of a new trojan that is set to become a widespread attack tool of the underground in a matter of weeks. Optix Pro poses a great threat to the security of users worldwide, and it is already being hailed by underground users and those in the trojan "scene" as one of the best trojans ever created.

Being a full-featured trojan, Optix Pro weighs in at 889,344 bytes before compression. This may be one factor that will slow the spread of this trojan. However, it will most likely be used after initial stealth infection by the small Optix Lite, a very popular "uploader trojan".


DESCRIPTION

Optix Pro has all the features common in today's Remote Access Trojans, and many more. Highly praised by the underground are the screen capture and webcam capture which are very clear and fast. The first release of Optix Pro came just 2 days ago at the time of this writing, released on the night of Wednesday April 3, 2002. Due to the stability, speed, and features of Optix Pro (not to mention its growing userbase) we anticipate that it will become the trojan of choice for many trojan users.

Like Optix Lite, the Pro version has a security program terminator feature that, when activated, will close all popular security programs down every 60 seconds (Optix Lite cycled every 45 seconds). TDS-3 easily detects Optix Pro due to precision scanning techniques with advanced routines such as the critical Process Memory Space scanning. TDS-3 also has specific routines to target Optix Pro with file scanning, it would be extremely difficult (and probably not worth the hackers effort) to infect a TDS-3 system with all protection enabled, even with highly modified Optix Pro servers. TDS-3 Execution Protection will use the advanced signatures and block the execution of Optix Pro servers, preventing the infection from occurring in the first place.

In the unlikely event that a TDS-3 protected system is infected, users can simply rename TDS-3.EXE to be able to launch the application. Even a completely unknown trojan with this ability can be detected with the Process Memory Space scan as TDS-3 looks for such suspicious process terminating characteristics.


SPECIFICATIONS


Family Name Optix
Class Remote Access Trojan (RAT)
Compiler Borland Delphi 5
Author s13az3, Evil Eye Software
Known Variants 1.0
FileSize Client v1.0
381,952 bytes (Compressed - UPX 1.20)
EditServer v1.0
367,616 bytes (Compressed - UPX 1.20)
Server v1.0
889,344 bytes - Not Compressed (before editing, editor adds 2 bytes)
Server v1.0 UPX Compressed
336,384 bytes
Default Port TCP 3410 (Configurable)
Default Install Copies itself to %windir%\spooll32.exe (Configurable)
Default Autostart REGISTRY - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr
entVersion\Run "vscanner" (Configurable)
Other Autostarts Stealth method - copies itself as wmmiexe.exe to %WINDIR% and modifies the key at HKEY_CLASSES_ROOT\exefile\shell\open\command to read wmmiexe.exe "%1" %*
This will run the server when any executable file is run.


FEATURES

Server Options - Server info, System info, steal passwords. Restart, close, remove server. Power options include Shutdown, suspend, logoff, reboot, bluescreen.

File Options - Full file manager. New folder, upload/download, execute, delete, find, copy, paste, rename, view/set attributes, get size, set as wallpaper, play .wav file, display image.
Process manager. View processes, kill processes.
Window manager. View, close windows. Show/hide, bring to front, send to back.
Registry manager. Add/delete/modify registry keys and values.


Keyboard/Chat Options - Message boxes (any)
Keylogger
Client-Client chat (Multiple client connections available)
Client-Victim chat (Matrix window)
Send keys as if typed on remote keyboard

Spy Options - Screen capture
Webcam capture

Fun options - Show/Hide clock, start button. Flash keyboard lights, open/close CDROM, monitor on/off, screensaver on/off, swap/restore mouse buttons, enable/disable keyboard/mouse, set Internet Explorer start page, send to URL, beep PC speaker 200 times.

Notify Options - ICQ Notify, CGI online list, Email notify with inbuilt relay if selected. IRC notify.

Firewall and Antivirus killing - The trojan contains an astounding 209 process names (or registry keys in special cases*) which are hard-coded into the server file, effectively covering all well known and (and some not so well known) anti-virus programs, anti-trojan programs, firewalls, and process viewers/monitors. If the option to kill these programs is enabled, on execution of the trojan the users defences are killed, and every 60 seconds the program checks the process list again for and of the names. Essentially this means all security programs known to the trojan (estimated to be around 80 programs) can be shut down and they cannot run again as the trojan will recognise them in the next scan 60 seconds later.

*In some cases a process will not be terminated correctly. In this case, the trojan deletes the vital registry key that loads the program on startup, and there is an option to then force the PC to reboot.

Infected removal instructions - Rename the filenames of your main programs (eg. TDS-3.EXE), and use that to kill the server. Stay offline while you do this. Simply run a Process File scan and TDS should detect Optix Pro, even if modified. Process Memory scan will detect the server if this fails. To disinfect, simply Kill and Delete the process. Once you have done this, run a trace scan to find the leftover files, and possibly registry entry. Be sure to check if there is a file wmmiexe.exe in the Windows folder - if there is you'll need to change the above entry in the registry. DiamondCS Support can help with this by sending a registry file which fixes the association for EXE files, or download it here (cleanrun.reg).

Check this link for Symantec. The info is dated 4/15/02
http://securityresponse.symantec.com...oor.optix.html


------------------
"Don't know where I'm goin but there's no sense being late"

BEWARE of geeks bearing gifts, (or was that Greeks??? lol)...

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Quote:

---

Originally posted by griffinspc:
Check this link for Symantec. The info is dated 4/15/02
http://securityresponse.symantec.com...oor.optix.html

---

Absolutely: however, that's an older version.

Symantec doesn't have this one yet.

Cheers, Tony




[This message has been edited by Kleinkramer (edited 04-16-2002).]

Maybe i'm not reading close enough,but i don't see anything about "how" it infects your PC?

------------------
Badges? We don'need no Steenkin'badges!!

It's like most other trojans (or viruses for that matter) in that respect, really:
You download one accidentally, or it comes in an attachment.
They come disguised as games, pictures, screen savers, holiday greetings, and other files.

It's a program that is made up of two parts , the client and the server .

The server is the evil part , once executed ( double clicked on ) it hides itself inside your computer and opens a port or ports allowing the hacker access to your computer , or information that he or she may other wise not have been able to get .




[This message has been edited by Kleinkramer (edited 04-16-2002).]

Thanks Tony,,thought it may come as something specific. Guess i'd better oil-up the ol' radar... https://discussions.virtualdr.com/

------------------
Badges? We don'need no Steenkin'badges!!

If I have Norton AntiVirus software, and update my virus definitions faithfully every few days, will NAV eventually be a defence against this Trojan?
I have always been confused how effective NAV was against Trojans. The fact that Symantec has that article on the earlier version of this Trojan suggests NAV will handle it.

------------------
Jim
WIN98, IE6, cable,
Norton AV, ZoneAlarm

Forgive my skepticism, but much of the advisory reads like an advertisement for TDS-3, whatever that is. I have no doubt that within a day or so all of the major providers of security or AV programs will have updates to catch this new variant if they haven't already.

Mowergun

------------------
God save thee Windows users, from the fiends that plague thee thus.

But how could this machine be freezing and overheating at the same time?

Well, it's a TDS-3 advisory, so waddya expect?

On the other hand TDS-3 is in security circles considered about the best on demand antitrojan you can get, so it's not as though they don't know what they're talking about.

Take a look here for some opinions: http://www.wilders.org/anti_trojans.htm

And I anticipate that Symantec and others will probably follow before long, although I'm not qualified enough to
evaluate the effectiveness of their defense compared to that of the better dedicated antitrojans.

I know that apps like TDS-3 and BOClean, unlike many others, have protection from tampering by the latest generation of antitrojan that can do a Terminate Process call.

Thank you for saying so. I was having difficulty determining if the post was a warning or a commercial advertisement also.

I did not want to say it since I am new and did not want to offend anyone. I do not know who are the players on this board and therefore do not yet recognize whom represents good info or not.

------------------
"A nod is as good as a wink to a blind horse" - Rod Stewart

About NAV's level of protection against trojans, incidentally, this is not too good.

I do run NAV as an on demand scanner myself, and NOD32 as my 'resident' antivirus, so I'm not against NAV at all, but I wouldn't rely on it 100% as far as combating trojans goes.

I also run BOCLean as an antitrojan.

Also consider the update frequency: I get 5 or 6 NOD32 and BOClean updates weekly, sometimes more, which is more than I can say about NAV through LiveUpdate.

Report_2..

I can't remember the last time I saw someone spam the boards here. In fact since I've been a member (years) I've only ever seen it once or twice. You can bet that any posts recommending specific brands of software are entirely legit and only meant for the protection or welfare of other board users. In the extremely rare case of misinfo whether it's spam or simply wrong information you can also bet that someone else will be along to point it out (politely) within a few minutes.

I'm really amazed at how little spamming goes on here. It's quite refreshing not to have to wade through numbers of posts extolling the virtues of questionable software programs. I think it's because spammers know that this is a strictly moderated BBS and just don't bother to try.


[This message has been edited by fink (edited 04-16-2002).]

Quote:

---

Originally posted by Report_2:
Thank you for saying so. I was having difficulty determining if the post was a warning or a commercial advertisement also.

I did not want to say it since I am new and did not want to offend anyone. I do not know who are the players on this board and therefore do not yet recognize whom represents good info or not.

---

I think you're absolutely right to be wary, especially when the subject is security software, where everyone has his pet program.

I happen to find this subject interesting, and therefore spend a lot of time at security-oriented boards, so as to get information on the subject from people who really know what they're talking about.

Regarding the TDS-3 article, I don't think one should be really surprised that extensive advisories like this come frome precisely from makers of antitrojan software.

They rightly should be on the cutting edge of new developments in this field, or they wouldn't be worth their salt, as far as I'm concerned.

And to further dispel the suspicion that I might be working for Diamond CS (which would be complicated in any case because they're in Australia and I live in Holland.. https://discussions.virtualdr.com/) here are two advisories from the makers of Trojan Hunter:

Analysis of BioNet 3.12

Analysis of the Buschtrommel Trojan

cheers, Tony

Report_2

Quote:

---

I do not know who are the players on this board and therefore do not yet recognize whom represents good info or not.

---

Modesty kept me from pointing out earlier that I am the only qualified poster here, unless you count members, moderators, guests and administrators. https://discussions.virtualdr.com/

So you can count on my posts as you would Bill Gates, we have absolutly no vested interest, unless you count my ego. https://discussions.virtualdr.com/

------------------
"Don't know where I'm goin but there's no sense being late"

Tony, if something like this comes in as an attachment, will Script Sentry stop it?

I just did an update of the Tauscan anti-trojan program I have installed. It included definitions for Optix Pro Version 1.0.

------------------
The old gray matter, it ain't what it used to be.

i've been running my computer for over 2 years now without anti-virus software. all this security hype is just that. hype. the only way to get infected by trojans and viri is to 1. open unknown emails. or 2. download dubious software. if you've got your firewall up and something along the lines of script sentry, then don't worry about all the hoopla.

my 2 cents.

------------------
42.7 percent of all statistics are made up on the spot.

EXACTLY RIGHT!!! its all marketing hype...

GOT /root
--------------------------------------------
(quote)
i've been running my computer for over 2 years now without anti-virus software. all this security hype is just that. hype. the only way to get infected by trojans and viri is to 1. open unknown emails. or 2. download dubious software. if you've got your firewall up and something along the lines of script sentry, then don't worry about all the hoopla.

my 2 cents. (unquote)
----------------------------------------
I AGREE 100%!!!

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Quote:

---

Originally posted by indigowindow:
the only way to get infected by trojans and viri is to 1. open unknown emails. or 2. download dubious software

---

indigowindow, you make it sound as though everyone can just delete email which does not carry a "from" name or address you recognize. That isn't the case. If you use your computer for business at all or an officer in many volunteer organizations, there will be a lot of return addresses you won't recognize. Not every business is a large corporation with hardware firewall, either.

------------------
The old gray matter, it ain't what it used to be.

(quote)
If you use your computer for business at all or an officer in many volunteer organizations, there will be a lot of return addresses you won't recognize. Not every business is a large corporation with hardware firewall, either. (unquote)
------------------------------------------------------
kindof makes Linux sound better & better, i can do anything on a Linux OS that i can do with a winders box, also Linux has some nice email clients too that can handle large accounts and multiple accounts, also Linux is not affected by winders virus' trojans & worms, if i owned a business i would ban windows from my office, and Linux would be on all desktops & servers...
http://www.linux.org/

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Quote:

---

Originally posted by kenlinzee:

if i owned a business i would ban windows from my office, and Linux would be on all desktops & servers...

---

I know of no quilt design software for use with Linux. In a small part-time home business such as mine, only one computer is in use, so "banning Windows" is not an alternative. There are thousands of other part-time home businesses, and I am sure many others also have reasons to use Windows.

One size doesn't always fit all. Solutions are going to be different for different people because situations are different. Thus, I don't think you should pass off security concerns as "just so much hype."



------------------
The old gray matter, it ain't what it used to be.

Quote:

---

Originally posted by DVOM:
Tony, if something like this comes in as an attachment, will Script Sentry stop it?

---

Hi DVOM,

It's not a script, so if you happen to download it you need to have an antivirus or antitrojan installed that either has it in its database, or recognizes it by its behavior.

And unlike Kenlinzee and IndigoWindow, I don't recommend you uninstall your antivirus because it's unneccerary, although Russian Roulette does have it's charms. https://discussions.virtualdr.com/

I do agree with them that lack of common sense is the major reason why people get infected.

However, as you know, even stuff included in attachments or downloads from sources you trust absolutely can contain viruses or trojans, so that you should never consider yourself immune to things like that.

Thanks for the objective feedback.

------------------
"A nod is as good as a wink to a blind horse" - Rod Stewart

Indigowindow, there's at least one other way of contracting viri. They can come in with a web page loading. I've had JS.exception.exploit show up in my temp files while just surfing. No software download or email attachment needed.

kenlinzee,

Linux isn't 100% imune to virii and trojans.. just less targeted
u need to keep it as well patched as any Win system..

Glenn


------------------
The Name is not my Job..
It is my driving style..

[This message has been edited by Undertaker02 (edited 04-17-2002).]

i have been running Linux Redhat7.1 and Slackware 8 since they were released, and with my install of both OSs i had to install only one update, it was the zlib update and it was only a 34 kilobyte download, it downloaded and installed faster than most webpages load in to the fastest webbrowser...


there are VERY few virus for Linux and they only exist in some computer laboritory somewhere, and with strong passwords used for root access even the best hackers are lost puppys when i comes to cracking a Linux box...

there are a lot of updates for Linux, but you have to know if you need them or not, for example if you do not have any server software running such as Samba, Apache or sendmail, you wont need most of the patches that are available, just install the patches that are required for your particular install of Linux, thats what seperates Linux from Windoze is that Linux does take more user knowledge and Windoze is a dumbed down OS that is burdened with way too much third party security and antivirus apps that in my opinion just about cripples the OS...


believe what you want about Linux, i know for a fact that Linux & BSD OSs are much more secure than ANY Windoze box ever thought about being...

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

hmmm ok, I will close after this..
first played with SCO Unix then linux kernal 1.2.. and various Red Hat, Suse, Mandrake..
And YOU can believe what you please as to how safe you Linux box is from virii and trojans.. But you had better frequent a few more linux sites, especially those that deal with security... and open your eyes a bit more.. I don't need to believe anything about Linux, I just want to stay 2 steps ahead of the script kiddy lamers who hone their skills with "secure" systems like yours.. linux virii only in the labs..... dream on..

Glenn


------------------
The Name is not my Job..
It is my driving style..

ok Mr. Undertaker, i have Redhat7.1 & Slackware8 & Win9x all multibooting behind a hardware firewall, plus both Linux' have a firewall compiled in to the kernel, and a couple of other tricks i need not mention, and if you can crack it and leave a file that confirms you did then i will admit it right here on this VirtualDr BBS...

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Mr. Kenlinzee,
I'm new here, but interested in the Linux, Care to share you experience??
or startup and Linux site?

Appreciate you reply.

Hmmm - flex your muscles guys. Tony, it is easy to get carried away with the enthusiasm of the other posters on a security site. I once had the same thing happen to me. I went to Wilders (pre Mr Blaze) and was most impressed (in my ignorance) until Paul Wilder, and other posters started congratulating themselves on their wisdom on a certain subject. As it turned out they knew less than I did.
I dont wish to disenchant you, the old board is gone but if you can find my posts - my name was AnnieFriday

------------------
Moderator at Suggest A Fix



[This message has been edited by AnnMarie (edited 04-19-2002).]

Hi IndigoWindow,

Quote:

---

i've been running my computer for over 2 years now without anti-virus software. all this security hype is just that. hype.

---

You are surely entitled to operate your computer as you choose. FWIW, in my humble estimation, your stance is a very precarious position to take. I have a friend who has scoffed in the same manner when I've urged her to obtain antivirus software to protect her system. I don't know the particulars, but she recently had a large number of scanned photos that were destroyed by something that filled all of her .jpg files with zeroes. I guess it all depends upon the value that one places upon one's data. If suddenly finding that your stuff has been wiped out, and if that position is only a minor inconvenience to you, then your stance may make sense. Granted, you may be sharper, smarter, more wary and alert than others, but even so, I would encourage you to re-think this issue.

Limerick

Trainer, if you are interested in Linux, i can only suggest a few websites that are both informative and can save a few bucks ordering products, the rest is up to you...
http://www.linux.org/
http://www.linuxcentral.com/
http://www.linuxiso.org/

there are several Linux distributions that can be downloaded free or purchased at a very low price at linuxcentral.com, also Linux can be downloaded free at some websites & ftp sites directly from the distributer but they can be quite large downloads, (so i personally opt to order Linux on CDrom)...

for a newbie Linux user o reccomend Redhat 7.1 or Redhat 7.2 (nothing older) as Redhat is a good & stable user friendly distro...

good luck & happy trails https://discussions.virtualdr.com/

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Hi Ken (I assume that is your first Name)

I have a bad habit of getting off on the wrong foot with people. I realy am stupid for defending my original comment, and now we look like a pair of pre-pubescent's boasting of how mine is bigger than yours etc.

My original comment was to add balance to the thread, and is based on my own experience as I am sure Ken's comments are as well.

I appreciate your offer of your system as a honeypot, I will decline, I am not a 1337.

It seems we have degraded this forum with our exchange and I appologise to all..
I have found that more is learnt helping/teaching than showing off your awards.. now for me to practice..

OBTW.. Ken your profile says you have worked in radio HF..are you a Ham also?

Glenn


------------------
The Name is not my Job..
It is my driving style..

not a ham, i do have a HF two way radio and i use the freeband parts of 10 & 11 meters, I have communicated on it from the USA allover north & south America, Australia (Alice Springs and a few major cities) western Europe, Bermuda & the Carribian islands, lots of places to numerous to mention...

i will say no computer is ABSOLUTLY crack-proof but with good knowledge and proper configuration it can be hardened against most attacks, but a determined professional level of attack can possibly get thru...

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)

Yes Ken,

I appreciate your comments.
We can return to helping and learning from these boards..

regarding Radio.. Held an Australian Limited Call for some 10years, played 2m, 70cm's FM/SSB as well as 10m&6m, I would have liked to have played on the Freebands.

Cheers

Glenn


------------------
The Name is not my Job..
It is my driving style..

i look at it this way...

Windows is not perfict and secure out of the box, and costs a lot of money for a copy of Windows in the store, needs updating, needs third party anti-virus & firewall =more money...

Linux is not perfict either, needs a few updates too, (depending on what you have installed & running), but it is free or much less expensive, anti-virus is not necessary, firwall can be compiled in to the kernel, or configured during install of the OS (free)...

since both Linux & Windows needs updates & security patches i may as well pick the one that has a lower "total cost of ownership" overall, Linux wins on my desktop...

i started with just win98se, then when WinME came out i seen it on my brother's computer, and said to myself, "why bother upgrading to that" and stuck with Win98se, then when WinXP came out, i read about Product Activation and REFUSE to buy in to it, and give Linux a try and i was suprised at how good and easy to use Linux really is, sure it takes a little learning, but that is the same with anything new, remember when you first got on a windows computer, how it took some learning, same with Linux, it will take a little bit of learning too...

no hard feelings & happy trails https://discussions.virtualdr.com/

------------------
MSI K7T266-RU Pro2
AMD Athlon 1600+
(the mother of all motherboards)