As of October 12th 2010, the MSRT Team added detection for the ZeuS crimeware (also known as Zbot and WSNPoem) on Microsoft’s Malicious Software Removal Tool (MSRT):
For those who don’t know: MSRT is being distributed to WinXP, WinVista and Win7 automaticly using Windows Update Service. Of course these are really great news but the thing which worries me a little bit is the fact that Microsoft waited years until they finally added detection for the ZeuS Crimeware. ZeuS has been a big threat in the cyberspace for years and has already managed to steal millions of dollars.
MSRT’s ZeuS detection rate
I thought it would be a good idea to test MSRT’s detection for ZeuS by running some quick tests. I’ve tested 20 ZeuS infection binaries (v2) by infecting a VM with the following test conditions:
MSRT Version: Kb890830 (2010-10-12)
Below are the results of my tests:
|Infection binary (MD5)||ZeuS Version||MSRT Result||Virustotal|
|Total||Detected: 10, Missed: 10|
Microsoft’s Malicious Software Removal Tool was able to identify 10 out of 20 infected systems which is a detection rate of 50%.
During the tests I noticed that in most of the cases you need to run a fullscan with MSRT to detect a ZeuS infection. Please also note that these are some quick tests from my side and don’t necessarily represent the real detection rate of MSRT on ZeuS.
I’m really curious about the number of infections detected by MSRT world wide. Hopefully Microsoft will publish some data in the next few days.
PS: You can also follow abuse.ch on Twitter: twitter.com/abuse_ch