Hacking Virus shipped with my Acekard RPG !

[GH0ST]

As i mentionned it (... in the shout box ) few days ago a virus was embedded in the Nand memory of my ACEKARD RPG i just bought few days ago at assentek.com

Hopefully i had first run the ACE from my nintendo ( just coming back from Nintendo Services ) with a clean brand new 4 Go SDHC card and check the option to see all files and i notice a suspicious o.exe ( 0.vir renamed ) and a strange autorun.inf at root of the card.

After renaming i submit these files to an online check ( virustotal.com )... positive .... and here is the full report made from threatexpert :

http://www.threatexpert.com/report.aspx?md...765ac939959a2ab
File MD5: 0x92A4F4A3138BA16CB765AC939959A2AB
File size: 118,501 bytes

Submission Summary:

* Submission details:
o Submission received: 7 August 2008, 09:54:22
o Processing time: 5 min 2 sec
o Submitted sample:
+ File MD5: 0x92A4F4A3138BA16CB765AC939959A2AB
+ Filesize: 118 501 bytes
+ Alias: Trojan.Lineage.Gen!Pac.3 [PCTools], Trojan-PSW.Win32.OnLineGames.yxf [Kaspersky Lab], Infostealer.Gampass [Symantec], PWS-Gamania.gen.a [McAfee], WORM_AUTORUN.ASD [Trend Micro], Mal/EncPk-CE [Sophos], Worm:Win32/Taterf.gen!C [Microsoft]

* Summary of the findings:

What's been found Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.


Technical Details:


Possible Security Risk

* Attention! Characteristics of the following security risks were identified in the system:

Security Risk Description
Trojan-PWS.OnlineGames.ARun Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Rootkit.Agent.QV Rootkit.Agent.QV injects rootkit components into Windows processes and attempts to hides itself from detection. It also made changes to Windows Explorer settings and download other malicious files from external servers.

* Attention! The following threat categories were identified:

Threat Category Description
A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
A network-aware worm that attempts to replicate across the existing network(s)
A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)


File System Modifications

* The following files were created in the system:

# Filename(s) File Size File MD5 Alias
1 c:\autorun.inf 575 bytes 0x1E16FBA1A04DD9FEA40D229ECE2124AF Worm.Win32.AutoRun.ekp [Kaspersky Lab]Mal/AutoInf-A [Sophos]
2 %Temp%\bmdhu.dll 27 038 bytes 0x657A1FA9D789B7CD14DEE65BEE47CCB6 Trojan-PWS.OnlineGames.ARun [PCTools]Trojan-PSW.Win32.OnLineGames.yxd [Kaspersky Lab]Bloodhound.Packed.Jmp [Symantec]PWS-Gamania.gen.a [McAfee]TSPY_ONLINEG.JRA [Trend Micro]Mal/Generic-A [Sophos]VirTool:WinNT/Vanti.gen!C [Microsoft]
3 c:\o.exe
%System%\kavo.exe
[file and pathname of the sample #1] 118 501 bytes 0x92A4F4A3138BA16CB765AC939959A2AB Trojan.Lineage.Gen!Pac.3 [PCTools]Trojan-PSW.Win32.OnLineGames.yxf [Kaspersky Lab]Infostealer.Gampass [Symantec]PWS-Gamania.gen.a [McAfee]WORM_AUTORUN.ASD [Trend Micro]Mal/EncPk-CE [Sophos]Worm:Win32/Taterf.gen!C [Microsoft]
4 %System%\kavo0.dll
%System%\kavo1.dll 125 952 bytes 0xEAA7CFC77A34607985C3AFB37B5490AD Trojan.Lineage.Gen!Pac.3 [PCTools]Trojan-PSW.Win32.OnLineGames.yxc [Kaspersky Lab]Trojan.Packed.NsAnti [Symantec]PWS-Gamania.gen.a [McAfee]Mal/EncPk-CE [Sophos]Worm:Win32/Taterf.B.dll [Microsoft]

* Notes:
o %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
o %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).


Memory Modifications

* There were new processes created in the system:

Process Name Process Filename Main Module Size
kavo.exe %System%\kavo.exe 266 240 bytes
[filename of the sample #1] [file and pathname of the sample #1] 266 240 bytes

* The following module was loaded into the address space of other process(es):

Module Name Module Filename Address Space Details
kavo0.dll %System%\kavo0.dll Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x1B60000 - 0x1B93000


Registry Modifications

* The newly created Registry Value is:
o [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
+ kava = "%System%\kavo.exe"

so that o.exe runs every time Windows starts

* The following Registry Value was modified:
o [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
+ CheckedValue = 0x00000000

so that hidden files and folders are not displayed in explorer when browsing the file system


Other details

* The following Internet download was started (the retrieved bits are saved into the local file):

URL to be downloaded Filename for the downloaded bits
http://(donttryit...).1a123.com/hp/zz.rar %Temp%\zz.rar

I delete / reformat from linux the four partitions found on the drive and every thing is fine now ... Hopefully !!!

What do you think about that ? i wonder if somebody else encouters the same thing

 

[Smiths]

you sure that's not a virus on your computer that automatically put the files on any USB device attached to it? hooking up the RPG to a computer technically just gives you a 1GB flash drive.

 

[dib]

Good point. Although it is also feasible that the retailer received it under RMA or as a return then resold it. This happened to me when I purchased my DS-X way back, it arrived with a rom and some mp3s already stored.

 

[IOwnAndPwnU]

WOW!

Ask them why the fuc* there was a virus on the NAND.
Thumbs down for the site ... probably.

 

[Joey90]

It says it has the ability to copy itself onto any USB drives, so either you, or the person that tested it has the virus. I don't think it is intentional though...

Basically, if it appears again then you should be worried about your computer, otherwise you could try emailing the shop, though I don't know if they would care...

 

[IOwnAndPwnU]

Email them or whatever. Ask them why the fuc* you got a virus on the AKRPG. If they don't respond, or say they did it purposely (yeah right), it's probably not a good choice to buy from them anymore.

 

[GH0ST]

I leaved a message in their forums and they just answered ( they said they investigate this with acekard team ... but they doubt it is a virus ... so i copy paste the report ... http://forum.assentek.com/index.php?topic=566.0 )

The acekard was NOT connected to any of my computers at this time ... also i do not allow autorun on removable units so i am 100 % sure the 0.exe file and the autorun.inf were on the nand when i've got my card.

The package was not sealed and akmenu409_release_20080227.rar (09/04/2008) was present on the root of the card : it was even installed (dated 27/7/2008 purchase date 6th of august )

 

[Bri]

So does the store you bought it from test the carts before they send them out? If so, why would they need to investigate it with the Acekard team? If not, why was your package opened and how was the .rar file placed on the card only a few days before you purchased it? Maybe they sold you a returned cart but don't want to admit it.

-Bri

 

[Ferrariman]

I leaved a message in their forums and they just answered ( they said they investigate this with acekard team ... but they doubt it is a virus ... so i copy paste the report ... http://forum.assentek.com/index.php?topic=566.0 )

The acekard was NOT connected to any of my computers at this time ... also i do not allow autorun on removable units so i am 100 % sure the 0.exe file and the autorun.inf were on the nand when i've got my card.

The package was not sealed and akmenu409_release_20080227.rar (09/04/2008) was present on the root of the card : it was even installed (dated 27/7/2008 purchase date 6th of august )

lol the admin is all like, "it's not a virus..... ummm................................................. it's a video game!!!!!"

 

[GH0ST]

Lol yes ... they finally change their mind ...

thank you for info.
For the moment the team think it is a malicious program which was propagating at the time of testing proper functioning of the AK.

I hope this will help newbies :

- disable auto exec and auto play on USB keys and removable disks see by example http://afterlight.110mb.com/2007/06/30/worms-and-usb-flash-drives-gang-up-disable-auto-run/
- Check if there is any .exe or autorun.inf at the root of the card before plugging to a PC ( from start menu settings : show all files and from advanced settings show hidden files ) delete them ( or rename to *.vir move & archive to a subfolder )

I saw more and more professional and particular computers infected by various USB keys virii... since the autorun is enable by default on windows ... So... take care ;-)

So does the store you bought it from test the carts before they send them out? If so, why would they need to investigate it with the Acekard team? If not, why was your package opened and how was the .rar file placed on the card only a few days before you purchased it? Maybe they sold you a returned cart but don't want to admit it.

I guess so ... it was also the last one they had in stock dixit ^^ ... but now it is mine and it is clean ;-)

 

[NeSchn]

Thats odd, I am glad nothing happened to your computer or your card.

 

[IOwnAndPwnU]

Safe. Thanks for the link for "newbies." Was kinda interesting.

 

[f3l1x]

Got it on one i just ordered from deal extreme. Mine was o.exe (not a zero) so i didn't see it when I searched here for it. I inadvertently stated a new thread...

http://gbatemp.net/index.php?showtopic=100...p;#entry1345823

So yea... I'm not surprised at all. This is kind of common with flash devices coming from china and has nothing to do with acekard specifically as my packaging was obviously rifled through (still could be unrelated). Any flash device (especially ones made in china) can and has had this happen to it. http://www.google.com/search?hl=en&q=s...ith+virus+china Also, acekards aren't sealed so its pretty easy to mess with en route.

Worst case scenario, the fab or acekard (whoever loads the sw and tests each card) is infected and it IS an acekard issue.

Be on the safe side and disable autorun (http://www.engadget.com/2004/06/29/how-to-tuesday-disable-autorun-on-windows/)
... and format anything flash related before you use it.

 

[GH0ST]

Mine was o.exe (not a zero) too ... i mistakely rename the nasty thing to 0.vir but i just recheck the archive is effectively o.exe ( see Threatexpert report also )

You can compare the MD5 sign and the size from my first post i guess it is the same thing.

You may use this fix if you've got infected by Kavo variants : http://net-studio.org/application/kavo-variants.php

Here is a link to another post with some details on various tools you can use to prevent / clean such trojans : http://www.theeldergeek.com/forum/index.php?showtopic=30506

To prevent further actions you can add this line to your HOSTS file

127.0.0.1 www.1a123.com

# Kavo virus tries to connect this site ( 127.0.0.1 resolve the adress to your localhost ... not to mention this site is know for other threats DON'T TRY to ACCESS it )

 

[Renegade_R]

Most computers in China have viruses actually (I've been there and most computers are in bad shape) mostly because everyone in China uses Internet Explorer and installs tons of malware in the form of 'removal' programs.