Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: A trojan that deletes spyware? - More botnet fun - World record attempt SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
A trojan that deletes spyware? - More botnet fun - World record attempt
Anti Spyware Trojan?

As reported by ISC Handler Pat Nolan, a new trojan has been released into the wild that seems to terminate processes and delete files and registry keys known to be associated with adware products. More details are available at


We've received reports of a few new botnet infestations of the same critter Deb Hale reported in . Botnets are a perfect example of why you need to know what's normal on your network and what's not. Great job Dan and Mr. Anonymous Senior Analyst. ;)

Speaking of botnets ...

The ISC was alerted to a .jpg image file (thanks Mark!) that had an MS04-028 overflow which caused the machine to download and run an executable, jpeg.exe

jpeg.exe silently installs a service on the PC as well as a registry key to autorun at reboot, then goes out to an IRC site, notifies of the compromise and waits for commands.

Actions have been taken to have the offending site blocked.

AV scan results of jpeg.exe are as follows (from ):

Antivirus Version Update Result

BitDefender 7.0 10.05.2004 Backdoor.Hackarmy.1.Gen

ClamWin devel-20040922 10.05.2004 -

eTrust-Iris 10.04.2004 Backdoor/AZV.Variant

F-Prot 3.15a 10.05.2004 W32/Hackarmy.AJ@bd

Kaspersky 10.05.2004 Backdoor.Hackarmy.gen

McAfee 4396 09.29.2004 BackDoor-AZV.gen

NOD32v2 1.884 10.04.2004 probably unknown NewHeur_PE

Norman 5.70.10 09.30.2004 W32/Backdoor

Panda 7.02.00 10.04.2004 Bck/HackArmy.T

Sybari 7.5.1314 10.05.2004 Backdoor.Hackarmy.gen

Symantec 8.0 10.04.2004 -

TrendMicro 7.000 10.04.2004 -

Bellhops and luggage carts and sheets, oh my!

While SANS NS Las Vegas 2004 will remain firmly engraved in many people's memory, it hopefully won't be remembered for the record attempt mentioned previously, that eventually failed. We're happy to report that there were no serious injuries and that all handlers have (apparently) survived unharmed. It should be noted however that the handler attempting the record has not been heard from since just after the attempt when he was seen with several statuesque showgirls. Good luck Tom, wherever you are. ;)

Chris Carboni

Handler on Duty


140 Posts
Oct 6th 2004

Sign Up for Free or Log In to start participating in the conversation!