Interesting History of BOClean from Kevin himself

This one might be long, but I'll go for it before sleeping given we had to do another "intraday" as the result of a new SDBOT/PHATBOT hybrid that's about to storm the corporate realm after being released around 6AM after we'd updated. I was about to fade to sleep when the klaxon went off, "get yer butt BACK in here - check this out!" Agggh. :(

I don't know what it is with "zealots" (including some of our OWN) but I've seen it before and perhaps some background on the "antitrojan industry" (heh) might be in order. It DOES seem as though antimalware and what we do is like some stupid sporting event or the latest episode of "survival television." And I just don't get it either. Then again, I *do* ...

Back when we started Privacy Software Corp, the "internet" was just catching on with the general public and Netscape was the rage. Some folks became concerned about "tracking cookies" and how operations like "doubleclick" (I have a DVD of a few of our early interviews on teevee) were "violating people's privacy" and as the "gold rush of the internet" (heh) began in earnest and banks were throwing money at worthless "dotgone schemes" we were selling a thing called "NSClean" which made all of those privacy issues vanish in Netscape. A year later, IE came along and IEClean was made for that.

Back when we did NSClean and IEClean, I was *nearly* wealthy! I earned a little over US$110,000 one year! But as others saw that there was "gold in them thar hills" junk like "WindowWasher" and other competitors popped up. Suddenly, that windfall diminished with "too many mouths to feed and only so many interested in BUYING it."

In late 1999 as the media spread hysteria over the "end of the world" that was to come with Y2K, a *LOT* of people decided to buy new machines, and out of concern for the potential disaster of "Y2K" a LOT of people bought new snazzy "Y2K ready" machines. At the same time, there was a swell of people who got "the internet" and collected necessary tools based on various computer magazines' recommendations of "needed tools." And NSClean, IEClean and by then, BOCLEAN were "must have."

And we prospered in that "gold rush" ... sorta. But with so MANY different vendors doing "cookies" the shine was already off NSClean and IEClean and the market "diluted." However, because the AV's STILL didn't do squat about trojans (and OUR definition of "trojans" was ANYTHING unwanted - it's QUITE a susprise that after nearly ten years now we're not considered "antispyware" or "antiBOT" or "antihijack" whatever but I digress. So BOClean had already moved to the foreground of our attention by 1999 as NSClean and IEClean became "secondary functions" in a crowded "market."

BOClean came into being in 1997 when we were approached (I can say it now that the company and the contract ended a long time ago) by HUGHES and some "men in black" from "federal spook agencies" about the freebie we put out in response to a PC World article back in 1997 about "back doors" and how antiviruses failed to detect them. A contract was given to us to "develop" BOClean into a "backup for Norton" since too many things had gotten past their AV, their IDS', and their "perimeter security." From THAT contract, BOClean was created as it's known today. The ORIGINAL "BOClean" was a freebie given to our existing NSClean and IEClean customers because of their concerns about what they'd read.

Back in those days, there was US, Wayne of TDS and the Otis Vigil brothers of "The Cleaner." That was it. WE had military and government contracts whereas the other two felt the "consumer market" could use this. BOClean was *NEVER* intended for "consumers" and its odd design lives on as testimony to that. Hell ... you already HAVE an AV. If THEY missed it, what makes you possibly think that if WE do the "same old, same old" we'd have a different result? :)

But from beginning to today, BOClean was NEVER intended for "home users" or "retail" ... it was designed for a SPECIFIC purpose and that alone - to be compact, never noticed, and most IMPORTANTLY - to bypass "users." Only reason why the damned thing is visible at ALL is because of the demands of "retail customers." In our normal corporate environment, nobody knows BOClean is there in the first place. :(

So after the BIG Y2K panic, and as about as many folks who were leaping on the "internet" were going to in large numbers, all of those former collosal sales began a rather steady erosion. I mean ... HOW many "new computers" is the average person going to buy? Y2K presented a "I'd BETTER buy new" for most folks. That was all over. And yet "wall street" kept throwing money at "the internet" after the market bulge (and justification for it) was over ... heh.

So, there were THREE of us in the "business" at that time. And while NONE of us were getting rich, at least we didn't starve. (grin) Folks NEVER took "trojans" seriously, fully convinced that McAfee would save them. And then God invented HJT logs!

Gold rush was OVER! But yet, the "verve" of Y2K convinced "ontapanoors" that there was a gold mine in "anti-trojan" and "antivirus" and "anti-spyware" and so many NEW mouths to feed moved into this "killer business to get RICH!" Hahahahahaha! Morons.

So here we are today ... HOW many different antiviruses? HOW many antispywares? HOW many antitrojans? Heh. Gotta love it. NOBODY is making money at this and never HAS! And to add to it, someone buys a copy and uses it forever. On more than ONE machine at a time (at least with US anyway) ... meanwhile, it's not two new trojans a month, it's twenty a DAY! Expenses through the roof, no income ... why? Well, because some "newcomers" thought they had a "marketing advantage" because they weren't deep in debt yet with all the added responsibilities, falling sales and the need to hire more people they couldn't afford owing to the workload required as this nonsense just keeps getting MORE intense and more numerous daily.

And the MASTER of "we'll never charge a subscription but BOCLEAN WILL" is now embarking on a "subscription." LOVE it! :)

I tell ya - I wish we'd NEVER sold a retail copy of BOClean. Ordinary folks don't buy BOClean - they want to see a flashy scanner and kick back with a cocoa and watch the screen flash, build progress bars, flash "tracking cookie detected!" and so much other bullsquirt and then complain when BOClean doesn't write up a lengthy report on "nothing found that matters." :(

When we sell to a corporate environment, an appointed admin gets to ask ME any question their heart desires, and when a problem is encountered, my one answer solves 50,000 potential end users with a single "do this and it's solved" solution.

For "retail customers" each and every one wants to critique how we don't behave like ZoneAlarm with warnings, diversions to "google map of your perp" and a whole bunch of other "expectations" ... meanwhile, our CORPORATE and GOVERNMENT customers who KNOW what they need and that's why they bought BOClean in the first place. THEY want to know things like "this happened, 200 fireoffs, is it contained or do we need to do anything else?" Retail customers want to know if we can make the top of the screen red because that's their favorite color. Heh.

But there's the reality - there's too MANY "antitrojan vendors" these days, too many NEW shinies and NOBODY is making any money. So what you have here is a bunch of 20-year-olds playing "scorched earth" in hopes that if they can just destroy the credibility of others, then that "fabulous wealth" those other guys have will be mine! Heh.

WCB! was RIGHT! The commonplace mentality is that McAfee or Norton or ZoneAlarm is all you need - with all those alerts popping up with indecipherable questions about things completely over their head, they dutifully click on the "Picard option" ... "YES! I *WANT* to do that, MAKE IT SO!"

That's why admins buy BOClean and why so many of our "retail" customers who only paid once over the past ten years make me cringe. While we're happy to provide what we provide to admins to the general public (and MOST of our referrals sell friends BOClean as the alternative to "you're too STUPID to own a computer, put it BACK in the box and ship it back" ... they convince people to get a copy of BOClean and leave THEM alone. Becomes MY problem. So don't mind me if I sit here with a blog saying "GEEZ!" while our "competitors" attempt to "gain market share by negative tactics" ... I often would RATHER they bought something else and just leave ME alone. =)

Kevin's discovery of latest Vundo crap

As posted by Kevin on April 18th, 2006:

Virtumonde ("VUNDO") ramps it up

Last night, several things came together here in the BOClean lab involving the nemesis of too many people whose systems have been infected, and those who have tried desperately to help them clear the infection. A "bad actor" known as "Virtumonde" which has wreaked havoc on the unsuspecting for a couple of years now has managed to do what CWS ("coolwebsearch") and their phalanx of backdoor authors and "script kiddies" hadn't. They've now gone into "deep rootkit" mode. No longer satisified to attack "user mode" software by "injecting" into other programs in "ring three" they're now subverting "device drivers" which belong to antivirus, antitrojan and other "security software" so as to hide behind a target that most "security software" will not attempt to shut down.

Last night, we examined some new Virtumonde hijinx and were quite dismayed to find that it even attacked BOClean's driver along with the usual antivirus and antispyware drivers. What this all means for BOClean users is that for the first time, something's been able to embed in OUR code and attempt to hide (without success). And because of this new propensity, if you're ALREADY infected when you first install BOClean (rather than ALREADY being protected in which case, nothing bad ever happens) then it can be a rather bumpy ride to get rid of it. We infected several lab rats with this set of nastiness and in an unusual mode, BOClean required anywhere from 2-15 reboots before it was finally eliminated. :(

Where BOClean was already installed, it was gone the moment it landed. However, most folks don't even think of installing BOClean until after the infections are so severe that it is noticed by the non-technical and despite rumors to the effect that BOClean cannot deal with a system which is already infected - the reality is not as claimed there. However, for the first time ... BOClean is actually challenged in getting rid of this one and it took some updating of our engine as a result of tonight's "intraday" update to ensure that it can actually be gotten rid of AFTER the fact. THIS one's pretty serious.

So who ARE these guys?

Pretty much everyone who's ever gone to a site featuring HJT logs has HEARD of "Vundo" and the name given by AV's is disingenuous. There's a company out there called "Virtumundo" which is an advertising site but is actually rather legitimate in NOT infecting people's machines. And they suffer from the confusion of THEIR "good name" by the "VIRTUMONDE" bloodsuckers. Virtumonde came into being back in 2003 as best as we can tell and when the AV's discovered it in last year, they applied the usual obfuscation of the "real" name of the threat for their own reasons and harmed "VirtuMUNDO" substantially in doing so. But then again, the AV's have a vested interest in "not honoring the actual name given to malware" in order to not be caught not covering it for months/years. :(

"VIRTUMONDE" is an operation based in the Cayman islands, which is a British colony which has been given more and more autonomy in recent years after their separation from technically being "part of Jamaica sorta" ... STILL, it's technically a colony of the U.K. and has become popular among "offshore banking" and criminals of all ilk.

So ... "whois" ...
Server Used: [ whois.domainnamesales.com ]

virtumonde.com = [ 127.0.0.1 ]
Registrant:
Name Administration Inc. (BVI)
Box 10518 A.P.O.
Grand Cayman Cayman Islands B.W.I.
KY
Domain name: VIRTUMONDE.COM
Administrative Contact:
Domain Administrator admin@nameadmininc.com
Box 10518 A.P.O.
Grand Cayman Cayman Islands B.W.I.
KY
1.345.946.6879
Technical Contact:
Domain Administrator admin@nameadmininc.com
Box 10518 A.P.O.
Grand Cayman Cayman Islands B.W.I.
KY
1.3459466879
Registrar of Record: DomainNameSales
Record last updated on 24-Jun-2005.
Record expires on 28-Mar-2007.
Record created on 28-Mar-2005.
Domain servers in listed order:
NS1.15X.NET 66.199.187.170
NS2.15X.NET 66.199.187.171
Domain status: REGISTRAR-LOCK

And whois "domainnamesales?"
Server Used: [ whois.domainnamesales.com ]

nameadmininc.com = [ 216.187.103.168 ]
Registrant:
Name Administration Inc. (BVI)
Box 10518 A.P.O.
Grand Cayman Cayman Islands B.W.I.
KY
Domain name: NAMEADMININC.COM
Administrative Contact:
Domain Administrator admin@nameadmininc.com
Box 10518 A.P.O.
Grand Cayman Cayman Islands B.W.I.
KY
1.345.946.6879
Technical Contact:
Domain Administrator admin@nameadmininc.com
Box 10518 A.P.O.
Grand Cayman Cayman Islands B.W.I.
KY
1.345.946.6879
Registrar of Record: DomainNameSales
Record last updated on 03-Sep-2004.
Record expires on 01-Sep-2014.
Record created on 11-Mar-2002.
Domain servers in listed order:
NS1.15X.NET 66.199.187.170
NS2.15X.NET 66.199.187.171
Domain status: REGISTRAR-LOCK

Gee! Howzabout that!? :)

So we went (with rubber gloves) and followed the trail to www.virtumonde.com a bit closer. I *DO NOT* recommend following that train yourself with IE, or even with Opera or Firefox as the site is only TOO happy to "fudge-pack" you. :(

Pertintent data however from their own site is as follows ... I find it rather humorous that their "name" is NAI, same name as the company that owns McAfee antivirus - but then NAI hasn't done diddle about the OTHER NAI using "their good name" ... :

About NAI
Corporate

Name Administration is a privately owned company based in the British Virgin Islands and the Cayman Islands. Our core business is acquiring and managing domain names for paid search (type-in traffic) and web development purposes.
Advantage

Type-in traffic occurs when users bypass traditional search sites and find information, products and services directly. A growing number of Internet users use this form of navigation as their preferred method of locating the information they need.

For example, if a consumer was looking for a personal loan, they might go to a search engine and type "personal loans" into the search box. They would then sort through a list of links containing that term. Other users will simply type "PersonalLoans.com" into their browser's address bar, and have specialized information delivered instantly.

The popularity of individual search engines continues to change, but generic and memorable domain names have been a constant since the dawn of the commercial Internet. While search engines must invest billions to compete against one another and try to better interpret what their users are looking for; our portfolio of generic websites effortlessly connects millions of people with the products and services they are looking for each week.
Future

Name Administration adds value by ensuring that the information at each of our websites is relevant and by optimizing each visitor's search experience. We are constantly enhancing nearly 100 different verticals (from Advertising to Weddings) and thousands of subcategories to further qualify the traffic our sites generate. Advertisers can be assured that the people drawn to one of Name Administration's websites are among the most highly targeted on the Internet and in media generally.

Every day millions of visitors search Name Administration's network. Currently those people access advertising listings relevant to whatever generic term they searched for. In the future, visitors could be directed to other relevant sites, fully developed verticals, or a hybrid of both.


Uh ... yeah ... sure. Folks *WANT* this on their machines. And "NAI" even has a FAQS page with the following topics ... :(


Frequently Asked Questions

Name Administration Inc. is a responsible domain name registrant and administrator. We are in the business of administering domain names, making websites, syndicating paid search advertising and information via a network of small websites or "microportals". In an effort to reduce our email load and to save you time, here are some answers to frequently asked questions about our domain names and business:

* Is this domain for sale?
* Everything is for sale, name your price.
* What kind of business is this?
* Will you buy my domain name?
* You have a domain name that is mine and I want it!
* Your domain keeps sending me spam, phishing mail etc.
* If you guys are running this nice little business, doing the "right thing", how come you are hiding out in the Cayman Islands?
* The facts about FactCheck.com.


By ALL means, if you HAVE BOClean already, and a proper firewall of some kind, you might want to check out the FAQ's themselves. Since I'd PREFER to keep people safe, took the liberty of using a BOClean-protected machine (and that's how we caught tonight's "goodies") and grabbed that page too ... here it is ...



Is this domain for sale?
We do not sell domain names. We receive many unsolicited offers each day however our business is building and developing each domain name and website into a relevant microportal. We are constantly improving our network to offer more relevant information and advertising content.

Top
Everything is for sale, name your price.
We are not holding out for your best offer. Replying to your email and the many we receive like it each day, costs us time that could be better spent growing our business. We get so many emails with the same subject, that we do not have the time to physically reply to all of them. If you have an inquiry regarding purchasing traffic in one of our verticals or across our network please send a detailed inquiry via our Contact page.

Top
What kind of business is this?
Name Administration Inc. is building the internet equivalent of a television network. High quality generic domain names are our channels. For further information, please visit our About NAI page.

Top
Will you buy my domain name?
"Don't call us, we'll call you". Name Administration purchases generic names that have keyword value. Many generic domain names receive organic browser type in traffic from people looking for information based on the keyword weight of the domain name (i.e. www.TravelLasVegas.com). We do not purchase concept names that do not make sense (i.e. www.hot-b2b-sales-4-u-today.com). If we want your unused domain name, we will call you. If you wish to sell your domain name try www.afternic.com, www.sedo.com, or www.greatdomains.com.

Top
You have a domain name that is mine and I want it!
Name Administration Inc. operates a broad network of generic websites based on brief, popular and generically meaningful terms that have descriptive meaning to many people. We do NOT try to exploit proprietary intellectual property, knowingly administer (or purchase) inherently distinctive names or names that have "exclusive value" to a sole distinctive entity.

We try to be good corporate citizens, do the right thing and be responsible name administrators. If you feel we are administering a domain name that you have built exclusive value in, please send a detailed email via our Contact form and we will consider your claim.

Popular names often have a great deal of desirability to many different parties, due to their scarcity and generic meanings. Accordingly, we refer questions concerning claims of right to competent counsel for review and evaluation.

Top
Your domain keeps sending me spam, phishing mail etc.
a) Name Administration Inc. has never sent a single piece of unsolicited email to anyone. We do not send spam or operate phishing sites. Spammers and "phishing con artists" often select random fictitious addresses for their email (i.e. info@savingmoney.com). These parties do not own the name 'savingmoney.com', we do. They do this because they do not want to hear your complaints about their spam. In a nutshell, these parties send you spam with a fake return address incorporating one of the names we administer to cover their tracks and to look real. We have no way of controlling this activity (and it bothers us more than you) but we can assure you those emails are not coming from Name Administration. We administer domain names. That's it.

b) Name Administration often purchases generic expiring domain names. Sometimes these names have previously been used to send unsolicited email or for other nefarious activity. We buy domain names because they are generic and meaningful, NOT based on their previous activity. Always check the "created date", or "updated date" of an individual name via WHOIS lookup (i.e. www.betterwhois.com). If those dates are recent, it is likely that we newly acquired the domain name at auction, or after it expired and ANY PROBLEM YOU SEE IS FROM A PREVIOUS REGISTRANT'S ACTIVITY. To reduce spam we suggest not posting your email address publicly, not filling in free-offer emails and installing spam filtering software on your PC.

Top
If you guys are running this nice little business, doing the "right thing", how come you are hiding out in the Cayman Islands?
This is our favorite. The Cayman Islands is nothing like what you hear about in the movies. We could just as easily ask, "How come YOU are hiding-out in the USA (or Canada or Europe or Australia)?" We are in the Cayman Islands because it is a great place to live. The weather is warm, the people are friendly and there is good Internet access. Everyone lives somewhere. We live here (www.caymanislands.ky). We may be contacted via email or through the Contact form on this website.

Top
The facts about FactCheck.com.
During the 5 October 2004, debate between United States candidates for the office of vice president, the incumbent Vice President Cheney responded to an issue by referring viewers to "factcheck.com". Mr. Cheney apparently intended to refer viewers to factcheck.org instead of factcheck.com.

The website "factcheck.com" is operated by Name Administration Inc., a privately held company based in the Cayman Islands. Traditionally, Internet addresses ending in ".com" have been intended for commercial purposes, while ".org" has been intended for use by non-profit organizations, such as the "factcheck.org" website operated by the Annenberg Public Policy Center at the University of Pennsylvania.

Name Administration Inc. is a leading domain name administrator, website developer and Internet traffic syndicator. Name Administration Inc. utilizes a portfolio of generic domain names, such as antarctica.com, lipbalm.com, and others as stand alone websites which collectively form an integrated advertising network offering users relevant paid search advertisements and information. "Factcheck.com" was registered by Name Administration long before the U.S. vice presidential debate for use in providing a directory of commercial providers of information resources relevant to the generic term "fact check".

When Mr. Cheney mis-spoke, viewers heeded his advice and visited factcheck.com in staggeringly large numbers. Name Administration re-directed this traffic for several reasons - to protect our servers from the potential for damage caused by Mr. Cheney's error, and as a service to our advertisers. Our advertisers intend to pay for potential customers to their websites instead of observers of political current events.

Name Administration re-directed those visitors to a website relevant to U.S. politics. Name Administration chose the website of investor, philanthropist, and political activist Mr. George Soros, because his website is well-funded, does not seek to raise funds from visitors, and had greater capacity to absorb the load of visitors, reaching over 100 visitors per second during peak times after the debate. An administrator for the Annenberg Public Policy Center has since informed us that their web server system would have been severely crippled by the load, had we directed the traffic to them. Contrary to some imaginative rumors spun by some, our action was undertaken on a voluntary and emergency basis, with no prior communication or consultation with the Soros organization. As confirmed by our legal counsel in response to media inquiries, Name Administration Inc. has not been offered, and has not sought, any inducement, compensation, or other consideration from any individual or organization for re-directed the resulting web traffic.

Traffic to factcheck.com has begun to return to normal levels, and Name Administration Inc. has restored the website to its original and intended use. Name Administration Inc. wishes the citizens of the United States well in the selection of their leaders, whose actions can sometimes have unintended consequences beyond the borders of the United States.

Top


(NAI Websites)

Antarctica.com
BlackGold.com
CeilingFans.com
Chests.com
ChristmasOrnaments.com
CocktailDresses.com
ColoringBooks.com
ComingAttractions.com
Cupcakes.com
DeathPenalty.com
DuctTape.com
Duplication.com
EatingDisorders.com
EShopping.com
FolicAcid.com
ForeignCurrency.com
HappyNewYear.com
Hombres.com
HurricaneTracker.com
Internship.com
JapaneseFood.com
LipBalm.com
Lottery.net
Mapas.com
Mobile.net
Pears.com
PersonalLoans.com
PetPrescriptions.com
Poemas.com
Prescription.net
Promz.com
Quality.net
RazorBlades.com
RemoteControlCars.com
Sailboats.net
SavingMoney.com
ScienceProjects.com
SongDownloads.com
StockTips.com
SyntheticOil.com
TaxDeductions.com
TestDrive.com
ThongBikini.com
TravelChina.com
Triathlons.com
UsedCarsForSale.com
VegasBaby.com
WeddingReception.com
- Thousands of others -


So these birds don't just hijack COMPUTERS, they hijack SITES as well! :(

And for all of the criminal acts they've done, they're STILL free to continue. So much for the so-called "war on terrorism." And they're CLEARLY "Bush haters" as this set of sentences proves:

Name Administration Inc. wishes the citizens of the United States well in the selection of their leaders, whose actions can sometimes have unintended consequences beyond the borders of the United States.

So WHERE are the bombs? :(

I've often described how BOClean is different from anything else in our "behavior-based detection." And while some might confuse that with "heuristics" which we also use as part of our design, our MAIN "behavior" detection is based on getting into the minds of the authors of malware, and specific idiosyncracies of various malware authors. Each one of them has a tendency to "sign" their work one way or another - be it making sure that their NAME is buried in their code, a particular way of misspelling things, or other "unique" way that a malware source identifies itself.

It's ONE thing to just "MD5 hash" a new submission, it's an entirely BETTER thing to actually put the effort in to "know your cuts of meat." And "Virtumonde" has a number of unique things (not to mention their abuse of name servers and redirects to THEIR netblock which serves us VERY well in already having their NEXT move as a "variant" rather than a "unique." TONIGHT, "Vundo" threw us a curve with an absolutely NEW unique method of infection. And that scared the QWAP out of me that from out of nowhere, they've changed course. :(

I'm scared ... those who depend on vendors who just take the latest file and assign it "badthing.abd" and ignore the repercussions have me GENUINELY worried. The latest "VUNDO" is a sign of an entirely NEW course, and it's an incredibly BAD one for those who depend on "AV's ONLY" ...

For those who ALREADY have BOClean, you were protected fully as of just before 5AM Us Eastern time and have been updated by now. For those who HAVEN'T yet purchased BOClean, it'll be a rocky ride with a crash or two but we'll get it. And if you DON'T have BOClean ... my sympathies. :(

Legal requirement - These are MY thoughts and not those of Privacy Software Corp. If I've offended anybody, then another long night blown to hell was worth it. After all, ain't that what blogs are about? People venting their spleen? Heh. This blog is my own personal therapy and no one else's. Lurk if ya wanna, smoke'em if ya gottem, comments welcome but subject to roasting, void where prohibited by good taste. Favorable licensing deals available to "VUNDO" for "real cheep." Heh.

posted by Kevin at 3:36 AM on Apr 18 2006

A question was asked:

Just curious. How does one get infected with this new nastie? Are they exploiting some vulnerability in Windows, for example?

Kevins Response:

As to the "infection vector," I hate to be a bit rude - need some sleep desperately for now. I honestly don't KNOW what sites might entice people to go to "Vundo" or an "affiliate" (wouldn't it have eeb interesting if WCB had discussed "affiliates" instead of "astroturf" since that what (they) was REALLY discussing in that thread? (sorry, forget WCB - I'm just still mighty honked off about it all) ... I s'pose there's deals with "VUNDO" for cash - after all, the "crims" don't bother unless there's CASH at the end of the rainbow, and people wouldn't *HAVE* "Vundo" as "Un CADEAU!" were it NOT for "Interpol-worthy stuff" ... :(

But have NO idea of which sites are spinning this for cash ... all WE know is the PAYLOAD, and we intend to KILL it. That's what REAL folks want - STOP it ... NOW! :)

And a further response from Kevin:

And just an addition before some of our "competitors" try to twist the words - those who DON'T already have BOClean will need to go through a couple of reboots - from the time I originally posted through now, about 55 lab rats now have been infected BEFORE loading in BOClean, and typically, it's been 2-3 reboots before this particular existing infection is finally gone.

When a trojan cannot be killed by ANY means, BOClean will throw up a warning (unless configured NOT to) and then force a system reboot. If "restart" is configured on a system rather than "turn off" then memory often retains the "prior state" unless there's a "power off" as Windows USED to do prior to XPee SPee2 ... *IF* the system does a cold power-down, then one boot after installation, the nasty will be found again in its NEW place (device driver) and BOClean will force ANOTHER shutdown (whereupon it's gone) ...

But IF the system keeps restoring the nasty and "prior state" then the detection and reboot cycles will continue UNTIL the system "finally forgets" and doesn't RESTORE the nasty. THAT is the problem with installing BOClean AFTER you're infected here. But if it's any comfort ... most OTHER software won't even detect its presence at ALL! :(

Another question:

Obviously this is a new technique used by Vundo. Does the author have to be a skilled programmer to write this stuff? I have really no idea.

It will be intersting to see how the file scanners deal with this one.

Kevins response:

I'm SURE the "helpers" in the "go away with your HJT log like you're some kind of "vendah with a agendah" and they'll figure out how NORTON or SPYSWEEPER is suddenly the trojan. Folks on DSLR *get* what they paid for. :)

"PM relief" is finally here, I go home ... TEN NEW "Vundo's" (166 variants) in an update we JUST put out. Never seen anything LIKE this, but now for all of the new releases, they're finally REPACKS of what is to BOClean now, "same old same old - VARIANT!" ... looks like we're there for now or there'll be MORE "intraday updates" whilst I sleep. Moo. :)

Another question asked:

I was rereading this blog and noticed Kevin said "However, for the first time ... BOClean is actually challenged in getting rid of this one and it took some updating of our engine as a result of tonight's "intraday" update to ensure that it can actually be gotten rid of AFTER the fact. THIS one's pretty serious."

Does this mean you have updated the BOC engine we are currently running with the intraday update? Or are we gonna see an new version release soon? As it reads now it appears this is really only a factor for those who install after the new Vundo infection but was curious.

Kevins response:

Looks like I need to clarify a few things. In my mention about "if you're already infected when BOClean is installed" with this one - this particular infection has a number of components watching each other's back, some of which are already hidden. So clobbering the obvious ones the first time BOClean is run on an infected machine requires a couple of reboots - first time to get rid of the startup "backup" stuff and then expose the rootkit, second time to get that and then reveal the rest. BOClean is only at a disadvantage the first time around only because there are so many pieces. Of course if BOClean was already there on the machine, no problem. I was merely pointing out that having it on your machine from the git-go is preferable in THIS case to having to go after it at a later time because *I* don't like the idea of having to do a reboot to do a proper cleaning. That's all.

As far as the "limitation of the engine" which required the update change, BOClean is designed to allow the database to contain not only "definitions" so folks know the name of the nasty, but also allows us to include new functions which can be called when the database is loaded and overlays the existing code. As a result, there's no need for a CODE upgrade as the update takes care of the newly discovered needs. I'm just glad I designed it that way - this was the first time we've had to USE this "feature" of the design. There's a lot of "what if?" stuff in BOClean that we've never had to use and I was merely amused that for once, that stuff was actually needed for a change. :)

I also read here and elsewhere that some folks have visited the links I provided and somehow had an expectation of getting infected by doing so. Handing out "get infected, click here" links is perhaps the most irresponsible thing anyone can do, it's banned in all groups, and I'm certainly not going to do it.

As to where this stuff came from, I have no idea actually. We have a number of people across the globe who provide us samples (as well as other vendors) and this new Vundo stuff just showed up the other night. It was after letting it loose in our deliberately unprotected lab rats that it started grabbing even more stuff and that was the basis of so many updates yesterday as new stuff appeared from out of nowhere on the lab rats. Since yesterday, looks like we've collected them all - there were only two new minor BHO's seen since the "big one."

Some have indicated that they use "properly locked down" machines, and by golly - a tip of the hat to those. We deliberately run "nasty bait" here so that we can hopefully get nailed before anyone else does. "Locking down" our lab rats isn't a good idea given what we do here and what all too many "real world users" do every day.

And John ... you were right ... the zealots of other "brands" are busy spinning this all precisely as you'd predicted - "those eveil immoral BOClean people are trying to scare people again." Heh. No ... once again this blog exists solely for me to gas off about things that bother me. And that so many people continue to get infected after all that "security advice" and operations like "Virtumonde" continue to do what they do after two years now without prosecution is what honks me off and is the reason for what I wrote.

That it was a challenge for a "new install" of BOClean was also bothersome to me because it means that I have to start working on the NEXT version of BOClean all over again because what I saw here tells me that there are a number of OTHER ways into systems in the future. That we were able to handle it of course felt good, but I'm perpetually running scared myself that some day we might actually get nailed by one of these things. And that motivation is what keeps me up at night. :(

And as to how people actually get infected? Numerous ways. The most common ones are hitting sites that offer "free porn" (no surprise there) or "keygens" and "cracked versions of software" (no surprise there either) and some sites with scripts that are huge that will walk machines through every possible known exploit in scripting in hopes that one of those will "stick." And of course, those who MUST click on a link in spam.

And while it's nice to know that there are so many people who have truly locked down their systems, reality is that there's FAR too many out there who haven't and don't care HOW to. Worse yet, many of these folks really should be running a Macintosh or BSD but have Billyware. People who have a problem with their machine and reload PRE-SP1 "rescue disks" and then go online instead of going straight for all the bandaids that just aren't ON that CDROM. :(

BOClean was designed for institutional users by their admins. Places that have "lawyers" and "middle management" types who don't know the difference between a "registry" and a "vision statement." And there's an awful lot of non-technical people out there who were issued computers and have no clue as to "how to work this thing."

And for those who DO know what they're doing, then you'll never get infected anyway. :)