Update Protections against Recent Malware Threats (1-Dec-08)
| Check Point Reference: | CPAI-2008-166 | |
| Date Published: | ||
| Severity: | ||
| Source: | CashOn CPush Infostealer.Banker.C AntiMalware Guard Trojan-Dropper.Small.rc |
|
| Protection Provided by: |
VPN-1
|
|
| Who is Vulnerable? Microsoft Windows clients | ||
| Vulnerability Description Malware is a software designed to infiltrate or damage a computer system without the owner's informed consent. It is a general name for a variety of forms of hostile, intrusive, or annoying programs like Viruses, worms, Adware, Trojans, and spyware that exploit unprotected clients, using network access to intrude upon organizations, destroying or stealing data. Spyware is computer software that is installed without the user's informed consent on a personal computer to intercept or take partial control over the user's interaction with the computer. Spyware programs can collect various types of personal information, install additional software, redirect Web browser activity, or divert advertising revenue to a third party. Adware is an advertising-supported software package which automatically plays, displays, or downloads advertising material to a computer after the software is installed on it or while the application is being used. A Trojan horse is a program that installs malicious software while under the guise of doing something else. Trojans are known for installing backdoor programs which allow unauthorized non permissible remote access to the victim's machine by unwanted parties with malicious intentions. |
||
|
Vulnerability Details Spyware: CashOn - CashOn is a browser hijacker and adware application. It hijacks the Internet Explorer searches and delivers popup advertisements to the user. Spyware: CPush - CPush is a browser hijacker application. It hijacks the Internet Explorer Home page, monitors the user's web activity and passes the information back to its controlling server. Trojan: Infostealer.Banker.C - Infostealer.Banker.C is a backdoor Trojan program. It monitors the user's web activity, such as bank-related websites visits, logs the user information and passes the information to its controlling server without the user's consent. Spyware: AntiMalware Guard - AntiMalware Guard is an adware application that shows false warning messages and misleading scan results that are often installed through Trojan exploits. It generates popup messages and downloads other malware to the user's computer without the user's consent. Trojan-Dropper.Small.rc - Trojan-Dropper.Small.rc acts as a carriage for backdoor Trojan programs or malware which can be used to harm a user's computer. It installs itself in the windows registry, opens TCP ports for listening and downloads and installs more backdoor Trojans or malware. |
Protection Overview
The update enables the Header Rejection protection and the HTTP Worm Catcher to detect and block the malware based on pre-defined header names and worm signatures.
In order for the protection to be activated, update your VPN-1/InterSpect product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.
To configure the defense, select your product from the list below and follow the related protection steps.