A new method to monetize scareware

[SysAdMini]

http://blog.fireeye.com/research/2009/03/a-new-method-to-monetize-scareware.html

http://voices.washingtonpost.com/securityfix/2009/03/antivirus2009_holds_victims_do.html

Code: [Select]

filefixpro.com/public/download.php?cmd=doDownload
http://www.virustotal.com/analisis/5ef5aed888af841fdff7bb38fa413da0 1/39
NOD32   3952   2009.03.20   Win32/Adware.FileFixProfessional2009

[SysAdMini]

Some hints for making a decrypter:

The last 4 bytes of the file contain the key. Xor each 4 bytes of the file with the key.

http://forums.devshed.com/antivirus-protection-117/filefix-professional-2009t-595267-4.html

example code:

http://blog.fireeye.com/files/file-2.pl

online decrypter :

https://filefix.fireeye.com/

[bobby]

http://malzilla.org/anti_filefix/anti_filefix.exe
or
http://www.malzilla.org/anti_filefix/anti_filefix.exe

[MysteryFCM]

Nice one bobby

I've posted a linky to your post here, over at Malwarebytes

[bobby]

Tool updated twice today.
Some FP fixed, fixed form showing on various DPI settings etc.

[sowhat-x]

Took the courage to also post it over at the comments section in FireEye's blog entry,
so that it is easier for infected people to find it...

[bobby]

Took the courage to also post it over at the comments section in FireEye's blog entry,
so that it is easier for infected people to find it...

Let's hope they will allow link to other sites. I do not believe they would post your comment.

[SysAdMini]

Took the courage to also post it over at the comments section in FireEye's blog entry,
so that it is easier for infected people to find it...

Let's hope they will allow link to other sites. I do not believe they would post your comment.

No problem. I posted several links to MDL in the past. The links have been published.

[sowhat-x]

It's nice of them that they published the comment...what i originally thought was,
that not that many "common" windows end-users actually have Perl installed in their boxes...

[SysAdMini]

Filefix Professional 2009 Cryptanalysis
http://blog.fireeye.com/research/2009/03/filefix-professional-2009-cryptanalysis.html