Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Looks familiar? Yes! From Alureon!

09 Dec 2010   #1

Win 7 Ultimate 64-bit. SP1.
Looks familiar? Yes! From Alureon!


It's a normal day to us. We receive a new Bamital virus sample report from a customer, and we provide an analysis. Suddenly, something interesting bursts into my eyes:

What's your thought on this code fragment? At the first glance, this piece of code looks like a non-malicious call to manipulate the Windows Printer SubSystem. But if you've analyzed Alureon before, it may look familiar to you. Yes, Alureon also takes advantage of the Windows Print Subsystem to install its payload.

Now let's recall Alureon's nasty stuff:

The older Alureon installs its payload by using Windows Print Manager. It drops its malicious payload to the Print Processor directory and then calls a winspool API AddPrintProcessorA() to issue an RPC request to the Printing SubSystem, which is hosted by spoolsv.exe; the spoolsv.exe then loads the Alureon payload from the Print Processor directory:

Since the spoolsv.exe is a trusted system process, it makes Alureon difficult to detect by HIOS/Anti-virus
Looks familiar? Yes! From Alureon! - Microsoft Malware Protection Center - Site Home - TechNet Blogs

My System SpecsSystem Spec


 Looks familiar? Yes! From Alureon!

Thread Tools

Similar help and support threads for2: Looks familiar? Yes! From Alureon!
Thread Forum
BSOD after removing Alureon.a System Security
Alureon and my broken laptop System Security
Solved Alureon.E (virus)trojan System Security
Is Anyone Familiar with ZipCloud? Backup and Restore
[Q] Alureon.A: Causes and removal System Security
Solved Trojan:DOS/Alureon.A System Security
Alureon.gen!U System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 08:57 AM.
Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33