Downloader-BBS

Downloader-BBS is a trojan that is delivered via a spammed email message claiming to be a notice from the Italian Police. This downloader is designed to pull a dialer from a website controlled by the malware author.

-- Update May 16, 2007 --

A recent spamming has been reported intended to download a dialer. The spammed email message supposedly from the Italian Police is sent as follows:

This roughly translates to the Italian Police finding illegal mp3 files on your computer and instructing the user to open the attachment for further details. A victim typically gets infected when the attached executable is run.

• This downloader does not create any auto start registry entry or a copy of itself on disk.
• Upon execution it injects itself into the svchost.exe process and downloads its payload under its context.
• Attempts to stop the following antivirus service: McShield
• Attempts to download further malware from the following URL: http://lookhere1.[Removed].ru/msupdate.exe
• The downloaded file is a dialer program and is detected as Dialer-Generic.

Note: As the website being communicated is normally controlled by the malware author, any files being downloaded can be remotely modified and the behavior of these new binaries altered - possibly with every user infection.

This downloader trojan was mass spammed on 16th, May 2007.

A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.