Saturday, June 23, 2007

InternetGameBox Rootkit

InternetGameBox touts itself as software, which allows you to play online, flash based online games. But, InternetGameBox is much more than gaming! It's an adware which uses Navipromo rootkit to hide its traces! As soon as InternetGamebox client program is installed from their website, the installer drops few files to System32 directory and creates a randomly named process which is hidden from user mode APIs.

This is how InternetGameBox client looks like:

Here's a screen shot of hidden process:

Files and Registry keys hidden by Navipromo:


Surprisingly, the hidden executable is barely detected by AVs. Here's a screen shot of Virus.org Malware Scanner showing the scan result of the executable. It can be seen that only ArcaVir was able to detect it heuristically:

InternetGameBox' Navipromo rootkit can be completely removed using the Navilog1 tool. A tutorial to use the Navilog1 tool to remove Navipromo can be found at CastleCops Wiki.

5 Comments:

Blogger Boris said...

Is this really true?
i used the software and its really good

7:54 AM  
Anonymous Anonymous said...

Yes, its totally true. Dont install that friggin internetgamebox.

2:43 AM  
Anonymous Anonymous said...

yeah.. maybe it's ok.. but whether or not it's spyware or not..

the most annoying thing it done.. was that.. every 20 clicks in internet explorer or firefox.. it kept opening an advertising site.. to advertise some crap...

and no spyware software detected it.. but acted in the same way...

dont install...

6:55 AM  
Anonymous Anonymous said...

DO NOT INSTALL!!!

NOOOOOOOOOOOOOOOOOOOOOOOOOOO!!!!!!

THIS CONTAINS A VERY BAD ROOTKIT!!!

I installed this and kept getting the pop-ups. I uninstalled internet game box and kept getting the pop-ups. I did everything that I could do for 2 days to get rid of this and couldn't shake it. I finally had to do a complete system restore. Many Trojans, viruses, spyware, etc. are easy fixes but you DO NOT want to mess with root kits.

DO NOT INSTALL INTERNET GAME BOX UNDER ANY CIRCUMSTANCES !!!

After I did a system restore, I added:

http://www.internetgamebox.com

To my list of restricted websites... just in case.

3:08 AM  
Anonymous Anonymous said...

hi what is the website to download internet game box.

4:40 AM  

Post a Comment

<< Home