Author Topic: AutoCAD Adware Trojan affecting mostly users in China  (Read 1224 times)

0 Members and 1 Guest are viewing this topic.

Krushert

  • Seagull
  • Posts: 13679
  • FREE BEER Tomorrow!!
AutoCAD Adware Trojan affecting mostly users in China
« on: July 15, 2009, 08:47:14 AM »
Just a big FYI
AutoCAD Adware Trojan

Quote
A new Adware Trojan has recently been identified as using AutoCAD as a delivery vehicle for installing Browser Helper Objects that cause IE to display popup ads.

This malware was first reported by the Webroot Threat Blog in this article:

AutoCAD Adware Trojans Target Techies

You can read the Webroot posting for all the details but, in a nutshell, a Windows stub application checks the system for AutoCAD installations, downloads the appropriate version of ObjectARX app from servers in China and modifies startup AutoLISP files to load that ARX app the next time AutoCAD is started. Once the ARX app loads and runs it does several things to the system that ultimately allow advertisements to appear when the user is viewing certain popular Chinese search engine results and when the time zone of the infected system is set to Beijing.

All indications are that AutoCAD is only being used as a delivery mechanism in order to make it harder to detect the malware (since anti-virus software doesn't tend to look at ObjectARX files). It should also be noted that this kind of infection seems to specifically target machines that are in use in China or have been used in China.

.....



I + XI = X is true ...  ... if you change your perspective.

I no longer CAD or Model, I just hang out here picking up the empties beer cans

sinc

  • Guest
Re: AutoCAD Adware Trojan affecting mostly users in China
« Reply #1 on: July 15, 2009, 09:48:09 AM »
Ooooh, fun.

I'm sure we can now expect a new wave of attacks that try to exploit similar vectors.  Once someone does something like that, other boneheads tend to copy it.

Matt__W

  • Seagull
  • Posts: 12955
  • I like my water diluted.
Re: AutoCAD Adware Trojan affecting mostly users in China
« Reply #2 on: July 15, 2009, 11:48:07 AM »
♫  Trojan man!!  Trojan man!!
Autodesk Expert Elite
Revit Subject Matter Expert (SME)
Owner/FAA sUAS Pilot @ http://skyviz.io