Microsoft zaps botnet found pre-installed with counterfeit Windows
Microsoft announced today that it has taken action to disrupt an emerging botnet, called Nitol, that used victims’ PCs to conduct distributed denial of service attacks and gave cybercriminals backdoor access to install other malware or data. The disruption of the botnet was the culmination of a Microsoft operation codenamed “b70,” which was launched as the result of discoveries made during an investigation into the distribution of counterfeit software by computer resellers in China.
First, the company was granted temporary restraining orders against an individual named Peng Yong and his company based in Changzhou, China. Then, Microsoft took over hosting 3222.org—the domain hosting the Nitol botnet and “nearly 70,000 other malicious subdomains”—according to a blog post describing the operation written by Richard Domingues Boscovich, assistant general counsel for Microsoft’s Digital Crimes Unit. In addition to the Nitol command and control network, the domain hosted over 500 strains of various other malware, including trojans that record victims' keyboard entry and take control of PCs' Web cameras and microphones. The 3222.org domain has been tied to malware activity dating back to 2008.
Microsoft researchers in China initially discovered Nitol while investigating the sale of computers loaded with counterfeit copies of the Windows operating system. In August of 2011, members of Microsoft’s Digital Crimes Unit purchased 20 computers—a mix of laptops and desktops—from computer resellers across China. Four of the computers purchased were found to be pre-infected with malware, including one with the Nitol botnet. Nitol was the only malware found that actively attempted to connect to a command and control network.
Nitol provided attackers with an HTTP-based backdoor to infected computers. It distributes itself as a dynamic link library called LPK.DLL, the name of a software module that gets called by all Windows applications with a user interface. Nitol copies itself when activated into any directory that has executable programs in it—including those on USB drives and other removable media. By default, applications look in the directory they’re installed in for DLLs before looking in other directories defined by the system. So this virus is able to get the applications installed on the PC to load it without having to fool users into installing anything.
http://arstechnica.com/security/2012/09/microsoft-zaps-botnet-found-pre-installed-with-counterfeit-windows/
