Engagement Congratulations Saying

Poison Ivy (part two)

Yes, unfortunately it is extremely easy to create with a trojan Poison Ivy. Let's see how.



After downloading the program,


open Poison Ivy 2.3.2.exe.


Poison Ivy gives us the ability to create server and client, you need to first create a server.


Here are some of the server configuration screen, which in this test call ViralBlog.


will not explain how to configure the server, this article is not a guide on how to use Poison Ivy, but a test on the simplicity of creating a Trojan with such a program.



Now we need a client that connects to the server as soon as created.



In this case port 3466, the same as we set on the server.
And here is the client ready to connect to the server and perform operations.


Of course there is no listening server and therefore is no connection.

But the newly created server will be immune to the virus?
To find out, I will use an online service, www.virustotal.com that allows you to scan a file with as many as 40 different antivirus.


And here's the result:

37 out of 40 antivirus detect the trojan.


Only three anti-virus does not believe the dangerous file.

From this brief analysis, one could say that it is useless to worry about Poison Ivy, because so much is recognized by almost all anti-virus used.
But it is not. Turning in a network are programs that allow you to make the virus immune to malware created. But do they work?

change the server you just created with one of these tools you get a file slightly more "heavy" (the original 10kb, 231Kb amended) and immune to viruses. After editing the original file, change the file name, change the icon and redo testing. (I have omitted the procedure for changing the server because I repeat this article is not a guide on creating malware).

repeating the scan with Virustotal online you get the following result:


Very worrying really. Only one third recognizes the malware as such.
too much virus do not detect most blazoned as a threat.

Note this does not indicate increased reliability by an AntiVirus rather than another. There is currently no solution that offers a 100% effectiveness of malware.

The excellent free service Virustotal the council to check suspicious files downloaded from the Internet to any email or attachments. Just observe some simple rules to be more relaxed, constantly update the operating system and anti-malware software, do not download material from P2P networks and do not visit sites unreliable.

In the next article we will see what actions the client allows you to make Poison Ivy and how to remove the server from an infected computer.

Watch this video on Poison Ivy.