|
Napisano: 07 Dec 2009 12:38
ljudi sve sto ste mi rekli sam uradio, ali i dalje me blokiraju!!!!
tacnije u petak sam uspeo da deblokiram mail ali evo danas sam opet u blokadi!  ((((((((((((((
Bacite pogled na ovaj tekst (skinuo sam ga sa sajta spamcop.net jer me oni blokiraju)
Recently (April/May 2003), we have been seeing a new type of spam. It appears to originate on normal Windows computers, sometimes inside corporate firewalls. We theorize that spam-sending "malware" has been installed accidentally by careless users or even through the exploitation of security holes ((zabranjeno)ing). Thus, these Windows computers suffer yet another "infection".
There appear to be several different types of software, or modes to it's operation. In one mode, it sends directly on port-25 to recipient mailservers. In another, it uses the Microsoft Outlook proprietary mail-sending protocol to send out via Hotmail mailservers. This protocol is handled over WebDAV, and the headers will show Hotmail servers using the DAV protocol. Most common recently, the software (or more likely, it's user, the spammer) uses the mailserver provided by your own ISP.
In any case, it leaves little trace as to its origin and is undetectable from the outside. The only clue is the IP address and the date/time of the occurance. The real confusion begins when the infected system is part of a network using Network Address Translation (NAT) to proxy connections for internal hosts. It should be emphasized that some modes of operation bypass outbound mailservers and send directly to the recipient system or via Hotmail's servers.
Blocking port-25 at the firewall can stop the first mode, but it is very difficult to stop the DAV protocol method globally, since that is transmitted over normal port-80 (www) connections. It is also problematic blocking a system from the mailserver which it is authorized to use - the system can no longer send legitimate mail.
If you have any more information about this problem, please post it in the forum and it will be added to this FAQ. Specifically, it would be nice to bring this malware into "the lab" and figure out its exact operating parameters - how to remove it, how to detect it, and what it does exactly. One theory about how it is controlled - it may poll a secret URL to receive instructions on what spam to send, and who to send it to. Another theory is that it logs onto a secret IRC channel to receive commands (an tried-and-true control method).
Update:
One possible route of infection may be exploitation of a buffer overflow in Microsoft IIS 5.0. Microsoft has released a patch to correct this exploit. Information and links to the patch are available at isc.incidents.org/analysis.html?id=183
Obratite paznju na deo o "Update"-u. Ako sam dobro shvatio problem pravi IIS. Ja imam instaliran Visual Studio 2008 (naravno kao i sve u Srbiji i ova verzija je crakovana) da li je moguce da mi on pravi problem?
Dopuna: 07 Dec 2009 12:39
A evo izvestaj iz Malearebytes-a:
Malwarebytes' Anti-Malware 1.41
Verzija baze podataka: 3284
Windows 5.1.2600 Service Pack 3
7.12.2009 12:37:20
mbam-log-2009-12-07 (12-37-20).txt
Tip skeniranja: Kompletno Skeniranje (C:\|D:\
Skeniranih objekata: 267987
Proteklo vreme: 1 hour(s), 8 minute(s), 20 second(s)
Inficirani procesi u memoriji: 0
Inficirani moduli u memoriji: 0
Inficirani kljuèevi u registru: 0
Inficirane vrednosti u registru: 0
Inficirani podaci u registru: 0
Inficirane fascikle: 0
Inficirane datoteke: 0
Inficirani procesi u memoriji:
(Maliciozne stavke nisu detektovane)
Inficirani moduli u memoriji:
(Maliciozne stavke nisu detektovane)
Inficirani kljuèevi u registru:
(Maliciozne stavke nisu detektovane)
Inficirane vrednosti u registru:
(Maliciozne stavke nisu detektovane)
Inficirani podaci u registru:
(Maliciozne stavke nisu detektovane)
Inficirane fascikle:
(Maliciozne stavke nisu detektovane)
Inficirane datoteke:
(Maliciozne stavke nisu detektovane)
Dopuna: 07 Dec 2009 12:40
Ajde dajte jos neku ideju!!!!
Ne mogu da verujem da pravi ovoliki problem a gotovo sam siguran da je u pitanju neka "GLUPOST"!!!!!!!!!
|
