Post by Drachestahl on Sept 3, 2005 17:07:13 GMT -5
www.block-checker.com/
The website claims that the block-checker can see who blocked you on Yahoo IM, MSN Messenger and AIM. It's actually a fairly new virus. I found a thread about it.
Its so called "version check" when it starts is this:
code:
POST /version.html HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept-Language: en-us
Content-Length: 0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Host: www.block-checker.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 17 Aug 2005 15:51:18 GMT
Server: Apache
Last-Modified: Fri, 12 Aug 2005 00:00:51 GMT
ETag: "190107-b-34f0d2c0"
Accept-Ranges: bytes
Content-Length: 11
Content-Type: text/html
Age: 1
Connection: close
version 1.0
If you enter an address and click check all it does is contact blockstatus.com/msn/stchecker with the appropriate POST variables filled in. Effectively ripping off their service.
Installs these files in C:\Program Files\Block Checker
code:
08/11/2005 04:50 PM 720,896 Block Checker.exe
08/10/2005 07:46 PM 49,152 block-checker.exe
08/10/2005 07:45 PM 28,672 csrss.exe
08/17/2005 05:51 PM 2,037 setup.log
08/11/2005 04:16 PM 16,384 setup_finish.exe
10/18/2003 05:58 PM 64,512 uninstall.exe
6 File(s) 881,653 bytes
"Block Checker.exe" is the one which is the block checker, the others run in the background:
csrss.exe and block-checker.exe are executed at the end of installation. csrss.exe is the name of a critical Windows process, obviously why the file was named that.
setup_finish.exe (coded in VB) is the file which is executed at the end of installation and it executes csrss.exe and block-checker.exe. It also seems to attempt to delete "system.exe".
csrss.exe is written in VB too, and its purpose is simply to constantly scan the process list and make sure block-checker.exe is there. If it isn't, it will restart the exe.
And of course our lovely block-checker.exe's reason for running is to search for Yahoo, MSN and AIM conversation windows it can send the following messages to:
"Hey you can see who's blocking you on MSN! Download it now www.block-checker.com"
"Did you know you can find out who blocked you on MSN? Check it out, it's free www.block-checker.com"
"I know who's blocking me on MSN because I use www.block-checker.com"
"Did they block you too? Download a free MSN Block Checker www.block-checker.com"
"Find out who's blocking you on MSN, Download it free from www.block-checker.com"
"Find out who's blocking you on Yahoo, Download it free from www.block-checker.com"
"Did you know you can find out who blocked you on Yahoo? Check it out, it's free www.block-checker.com"
"I know who's blocking me on Yahoo because I use www.block-checker.com"
"Did they block you too? Download a free Yahoo Block Checker www.block-checker.com"
"Hey you can see who's blocking you on MSN! Download it now www.block-checker.com"
"Find out who's blocking you on AIM, Download it free from www.block-checker.com"
"Did you know you can find out who blocked you on AIM? Check it out, it's free www.block-checker.com"
"I know who's blocking me on AIM because I use www.block-checker.com"
"Did they block you too? Download a free AIM Block Checker www.block-checker.com"
"Hey you can see who's blocking you on AIM! Download it now www.block-checker.com"
The code has evidence that it also searches the process list for csrss.exe to keep it running, but I think their plan backfired as it will always find the legitimate Windows csrss.exe file.
To send messages to MSN Messenger conversation windows it searches for windows containing " - Conversation" and uses sendkeys to send the message.
It creates files "exclusion_AOL.ini", "exclusion_MSN.ini" and "exclusion_Yahoo.ini" in the system directory which look like they include the people the message has already been sent to, in order not to resend it to anyone...
It adds itself to startup,of course, under HKLM with the name "block-checker" pointing to C:\Program Files\Block Checker\block-checker.exe.
