Rogue User Agents

[Urmas]

http://www.f-secure.com/weblog/archives/00001684.html

How many infected user agents are out there? Toni examined one of our sinkholes and its April 2009 logs contained 63,000 unique IP addresses using agents that contain AntivirXP08.

63 thousand. That's a lot of infections, right? And that doesn't include other strings we've seen such as "Antimalware2009".

You can determine yours from whatsmyuseragent.com.

 

[floppybootstomp]

I clicked on the link and it gave me a load of info about my net connections, some of which I don't understand.

It would also appear I'm using Mozilla but as far as I know I'm not, unless IE7 & Opera are based on Mozilla, which I doubt. Unless that's because I'm using a link from PCR UK

So, I have to ask: What does this link do for me and what use is the information they provide?

I don't intend to be critical, I'm just puzzled

 

[Urmas]

So, I have to ask: What does this link do for me and what use is the information they provide?

OK... I found a better - more informative - page: http://user-agent-string.info/

Click on "Analyze My UA".

My (FF) UA:

Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:1.9.0.10) Gecko/2009042513 Ubuntu/8.04 (hardy) Firefox/3.0.10

 

[muckshifter]

So, I have to ask: What does this link do for me and what use is the information they provide?

Basically, if you see AntivirXP08 in the header, you will need to go visit one of these sites PDQ.

And, you just became a statistic.


http://www.bleepingcomputer.com/uninstall/11067/AntivirXP08.html

 

[floppybootstomp]

Ah, ok, thanks chaps

All looks good for me on this machine

 

[nivrip]

No, still don't get this.

It tells me that I use IE7 and Vista but, believe it or not, I already know that.

What am I missing here?

 

[muckshifter]

No, still don't get this.

It tells me that I use IE7 and Vista but, believe it or not, I already know that.

What am I missing here?

AntivirXP08 ... as I said, if you "see" that in the results, go get it removed. Your browser has been compromised.

The other info is just err, info.

 

[nivrip]

AntivirXP08 ... as I said, if you "see" that in the results, go get it removed. Your browser has been compromised.

The other info is just err, info.

Ta Mucks. But is AntivirXP08 the ONLY thing that we're looking out for here? At least I don't have it.

Or, are there other things?

 

[muckshifter]

Ta Mucks. But is AntivirXP08 the ONLY thing that we're looking out for here?

yep ...

 

[captain zed]

Hey Mucks and Urmas,...i got the all clear....believe it or not i have learned quite a bit these last few days.....its great when all the heavy hitters are involved LOL...ya cant beat a thread where everyone throws in their tuppence worth.
Zzzzz