Gromozon Rootkit Removal Tool
|
Author:
Prevx
Date: 09/30/2009 Size: 720 KB License: Freeware Requires: Win 10 / 8 / 7 / Vista / XP Downloads: 31182 times 
TIP:
Click Here to Repair orRestore Missing Windows Files |
 Download@MajorGeeks Download@MajorGeeks
|
MajorGeeks: Setting the standard for editor-tested, trusted, and secure downloads since 2001. |
Join the MajorGeeks Mailing List to get the latest updates and exclusive offers!
What is Gromozon & how did it bypass my security tools?
Unfortunately, Gromozon is not a single infection, but a blended attack designed to bypass traditional anti-malware tools. The end result means that the machine is not only infected by several well-known Trojans but also a highly dangerous Rootkit. Traditional AV vendors are at the moment dealing with the known infections but overlooking the rootkit.
The path of infection is thus:
On visiting an infected website an obfuscated JavaScript is run.
The user is forwarded to another site which contains a further obfuscated JavaScript. This connects to a network of websites which are used to launch the infection routine. These websites are constantly changing and since May 2006 have become considerably more numerous
A server side script is run to analyze the user agent (web browser) under which the user is visiting. Different attack methods are then launched depending on whether the user is running Opera, Firefox or Internet Explorer.
For Internet Explorer, the victim is presented with the option to install an ActiveX control called FreeAccess.ocx This is actually copied into the Windows system32 folder as a randomly named DLL.
Firefox and Opera undergo a very clever piece of social engineering. What appears to be a link to www.google.com is presented to the victim. This, unfortunately, is not a hyperlink but in fact a cleverly hidden .com file. Once accepted and run, a randomly named DLL is again installed to the windows system32 folder.
Once the DLL agent is installed, various pieces of Adware are downloaded and installed onto the machine. Examples are the Bravesentry and LinkOptimizer Trojans. The real payload is then downloaded to the victim's computer. Both a Rootkit and service component are installed along with a hidden windows user account. The main purpose of this is to enable the Adware which was previously installed to be hidden from any Anti-malware tools installed on the machine
Unfortunately, Gromozon is not a single infection, but a blended attack designed to bypass traditional anti-malware tools. The end result means that the machine is not only infected by several well-known Trojans but also a highly dangerous Rootkit. Traditional AV vendors are at the moment dealing with the known infections but overlooking the rootkit.
The path of infection is thus:
Once the DLL agent is installed, various pieces of Adware are downloaded and installed onto the machine. Examples are the Bravesentry and LinkOptimizer Trojans. The real payload is then downloaded to the victim's computer. Both a Rootkit and service component are installed along with a hidden windows user account. The main purpose of this is to enable the Adware which was previously installed to be hidden from any Anti-malware tools installed on the machine
Limitations:
Project has been abandoned.
Screenshot for Gromozon Rootkit Removal Tool
Tactical Briefings
Comment Rules & Etiquette - We welcome all comments from our readers, but any comment section requires some moderation. Some posts are auto-moderated to reduce spam, including links and swear words. When you make a post, and it does not appear, it went into moderation. We are emailed when posts are marked as spam and respond ASAP. Some posts might be deleted to reduce clutter. Examples include religion, politics, and comments about listing errors (after we fix the problem and upvote your comment). Finally, be nice. Thank you for choosing MajorGeeks.
© 2000-2024 MajorGeeks.com
Powered by Contentteller® Business Edition