The Judin.ru video shows how system settings are changed and software installing without consent by exploiting a security hole in the operating system or in its accompanying software.
The video shows (05:28) that searches entered into Internet Explorer address bar forwards the browser to find-help.org and the same applies for a non-existing domain name. Three new entries appear in the "Add/Remove programs" dialog (08:32), named "MDS Search Booster", "SB Soft" and "Winds 2.4".
The HijackThis logs generated during the exploit offers additional insights into the changes carried out and the following lists some of the files and system changes that appear. Please note that multiple logs are quoted.
C:\DOCUME~1\Roger\LOKALA~1\Temp\svkhost.exe
C:\WINDOWS\System32\xabqc\dgivhmoe.exe
C:\WINDOWS\System32\jisjiyjx\yuemdyq.exe
C:\WINDOWS\System32\down0.exe
C:\WINDOWS\System32\down2.exe
C:\WINDOWS\System32\tiny\waby.exe
C:\WINDOWS\System32\yklrhhns\riquxekb.exe
C:\DOCUME~1\Roger\LOKALA~1\Temp\qalljcay.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.2020search.com/search/9884/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search--control.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web--search.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web--search.com/to.php ?ID1=1871&ID2=61832905&ID3=347245441833&ID4=0 &ID5={86BCCCFD-431B-46F0-9A34-D6DAB6F239D7}
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\webdlg32.dll
O2 - BHO: CDownCom Class - {031B6D43-CBC4-46A5-8E46-CF8B407C1A33} - C:\WINDOWS\DOWNLO~1\ipreg32.dll
O2 - BHO: Windows Resources - {2D38A51A-23C9-48a1-A33C-48675AA2B494} - C:\WINDOWS\winres.dll
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINDOWS\webdlg32.dll
O2 - BHO: Pop Class - {A9AEE0DD-89E1-40EE-8749-A18650CC2175} - C:\WINDOWS\winsx.dll
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINDOWS\webdlg32.dll
O4 - HKLM\..\Run: [dgivhmoe] C:\WINDOWS\System32\xabqc\dgivhmoe.exe
O4 - HKLM\..\Run: [yuemdyq] C:\WINDOWS\System32\jisjiyjx\yuemdyq.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [waby] C:\WINDOWS\System32\tiny\waby.exe
O4 - HKLM\..\Run: [riquxekb] C:\WINDOWS\System32\yklrhhns\riquxekb.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\fltmgr.dll
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'https' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297B} - http://start1.aaa1screensavers.com/30005.exe
Judin.ru is not the only web site that triggers the exploit documented in the video, in fact there are almost 100 additional web sites where the exploit occur, which I was able to find thanks to Fred de Vries and WebHelper's VladZone list. The following are the known domains which triggers the exploit:
The exploit will also trigger at any of the following IP addresses:
domain: JUDIN.RU
type: CORPORATE
descr: judin project
nserver: ns1.nameself.com.
nserver: ns2.nameself.com.
state: REGISTERED, DELEGATED
person: Dmitry V Shipulin
phone: +7 8120000000
e-mail: netBLOCKEDtime@jps.ru
registrar: RUCENTER-REG-RIPN
created: 2003.10.21
paid-till: 2005.10.21
source: TC-RIPN
HijackThis logs
(1,
2,
3,
4,
5,
6)
SystemSherlock log containing the names of all files and registry entries that was added, deleted or modified during the exploit.
For your reference I have generated md5 and sha1 hashes
for the files added during the exploit. Files are also available for analysis upon request.
Webhelper offers more information about the domains in the CWS and VladZone write-up.
Kephyr.com has documented a similar exploit at webbet.ru.
For your reference I've made a whois log listing detailed information about some of the domain names covered by this article.