ecard.exe now becomes msdataaccess.exe

Most of you might have got fake greeting card spam mails, with a link to download ecard. On clicking this link, you will be presented with few trojans and also advised to download and install ecard.exe to view the ecard. But now, the gang behind this malware have changed their trojan dropper's name to msdataaccess.exe from ecard.exe! Similar to the old ecard.exe variant, this new one installs malware such as Tibs rootkit etc.

Here's a screnshot of rooted files related to Tibs rootkit:

And, here's the screenshot of SSDT hook installed by the rootkit:


And lastly, I came across this ecard spam mail (Do NOT visit the link given below!):

"Partner() has created Holiday ecard for you
at bristos.com.

To see your custom Holiday ecard, simply click on the following Internet address (if your mail program doesn't support this feature you will need to COPY and PASTE the address into your browser's address box):

http://81.71.5.34/?4ee8af5c23933166b19e3393b5ca09ff74e82d

Send a FREE greeting card from bristos.com whenever you want by visiting us at:
http://bristos.com/
This service is provided and hosted by bristos.com."

And, that link opens up this page:

Yes! We are waiting for the contents to be uploaded by the Admins ;)