General: [Sticky] Virus Warning Updates

Bottom of Page

31 to 55 of 55

  1. <
  2. 1
  3. 2
  4. >
    •  
      CommentAuthorKrazyIvan
    • CommentTimeSep 19th 2008
     

    The Singu.AM backdoor copies itself on computers under the name inetput.exe. When run, it installs itself as a computer service and opens a port on the victim's computer, so the attacker can control it remotely and carry out malicious actions: administer connections, capture keystrokes, configure connection parameters, access the Windows Registry, etc.

    This malicious code is distributed through P2P networks. To tempt users into downloading it, it uses social engineering techniques, passing itself off as a fake program, an erotic photo, etc.

    The Goldun.TB and Sinowal.VTJ Trojans are distributed in a similar way.

    Goldun.TB reaches the victim's computer on an email attachment (photo
    here: http://www.flickr.com/photos/panda_security/2865375408/)
    pretending to be an ICS warning (an incorrect abbreviation of IPCS:
    Internet Service Provider Consortium), and indicating that the Internet connection will be suspended due to the user's violation of alleged author rights.

    The email attaches a supposed 6-month activity report which it refers to in the message body. This report is compressed in a .ZIP file. If users decompress and try to open the false report, they will be allowing a copy of the Goldun.TB Trojan onto their computer.

    The Sinowal.VTJ Trojan, on the other hand, reaches mailboxes in an email pretending to come from a user who accuses the recipient of sending a virus to his computer via email.

    The email subject is "I am wait (sic) your reply"
    (http://www.flickr.com/photos/panda_security/), and it has an attached file it refers to in the email body, which supposedly contains proof of the user's sending of malicious emails.

    On opening the file (.ZIP format) and running the content (executable file that looks like a PDF document), users will be entering a copy of the Sinowal.VTJ Trojan onto their computer.

    Once on the computer, this malicious code tries to download a configuration file from a Russian domain, previously used to distribute banker malware. It also releases a series of malicious files on the system.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeSep 29th 2008
     

    This week's PandaLabs report includes information about the
    VirusResponseLab2009 false antivirus and the P2PShared.M worm, as well as a new pharming attack using the Banker.LKC Trojan.

    The VirusResponseLab2009 adware is another example of how false antivirus solutions are being used by cyber-criminals for financial gain.

    When run, this adware fakes a system scan, telling users that their computers are infected (http://www.flickr.com/photos/panda_security/2881336631/). It also sporadically launches a pop-up warning, from the taskbar, falsely claiming that the computer is being attacked from the Internet, or that the user is vulnerable to password theft (http://www.flickr.com/photos/panda_security/2889552552/).

    The real aim of this malicious code is to make users believe they are infected and consequently buy the antivirus solution offered
    (http://www.flickr.com/photos/panda_security/2889552552/) in order to clean their computers of these (non-existent) threats.

    P2PShared.M is a worm that spreads through P2P networks. It does this by copying itself to the folders of several P2P applications, under the guise of software programs, which are then downloaded by other users.

    The worm creates a copy of itself on the system and modifies the Windows Registry.

    This week, PandaLabs has also offered information on the Banker.LKC Trojan, which passes itself off as a video about the new iPhone in order to trick users and launch a pharming attack that could result in the loss of confidential data.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeOct 3rd 2008
     

    Virus Alerts, by Panda Security (http://www.pandasecurity.com)

    Fakegooglebar.Z, a Trojan that modifies the page of the popular Google search engine to distribute fake antivirus programs, the Eranc.A worm and the Slenfbot.C bot are the subject of this week's PandaLabs report.

    On opening Internet Explorer, Fakegooglebar.Z displays a warning informing that the computer might get damaged on visiting the web page the user is about to view. Then, if the user goes to the Google page, the malicious code inserts a message in it indicating that an unregistered version of "Antivirus 2009" has been detected and encouraging the user to activate the product through a link. If they do that, they are taken to a website to download this fake antivirus. You can see a picture of the modified Google page here:
    http://www.flickr.com/photos/panda_security/2909336058/).

    "Fake antiviruses are a growing threat. Up to now, these rogue software programs were mainly distributed through spam messages with malicious links. In this case, however, cyber-criminals use a Trojan that changes the Google web page. This aims at avoiding raising suspicion among users, as this is a web page they might have visited hundreds of times.
    All this makes it more tempting to download the fake antivirus", explains Luis Corrons, technical director of PandaLabs.

    Earanc.A is a worm that spreads by copying itself to all removable drives on the computer. This way, whenever any such drive is connected to a new computer, it will infect it.

    Once run, the worm opens Windows Media Player and plays the video of a clock whose hour hand moves from 1 to 12 (see image http://www.flickr.com/photos/panda_security/2908481131/). This video is deleted after being played and replaced by a copy of the worm.

    Then Earanc.A deletes all multimedia files on the infected computer and replaces them with a copy of itself with the following format: original file name.original extension.exe. It also changes the Registry so that file extensions and hidden files are not displayed, and disables the system restore feature and the registry tools.

    Finally, it changes the Internet Explorer window title to this:
    ++++ Makanya jangan handak buka BF ja, neh rasain oleh2 dari amang
    hacker ++++

    Slenfbot.C is a bot that spreads by sending itself to users' MSN Messenger and IRC contacts. The file it sends out is called "MVC-Imagen008" and is compressed in zip format.

    Once run, this malicious code closes all open security applications for monitoring computer processes and traffic in order to make detection more difficult. It also creates some entries in the Windows Registry to ensure it runs even in Windows safe mode.

    Finally, it disables the Windows administration tools and prevents users from displaying hidden folders on the computer and using the Command Prompt window.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeOct 10th 2008
     

    Lydra.AO records users' activity on the infected computer and sends it to the malware author. To do so, it remains active in the Windows memory and starts capturing keystrokes and mouse movements. It also collects email addresses found in files with certain extensions.

    It stores the information gathered, together with the PC hardware and software data, and sends it to the malware author via email. To do so, it uses its own SMTP or MAPI engine.

    Redvoz.A is a backdoor Trojan that connects to a remote server, which allows the creator to run arbitrary commands on the infected computer and take control of the system.

    This new malicious code creates a system service for managing network policies displayed by default by system services and third-party applications. This service is run continuously and cannot be stopped, making it difficult to remove. As the service is in a loop, the threat is recreated if it is deleted.

    Autorun.AHS is a worm designed to spread through the floppy disk drive.
    When run on the computer, it modifies specific Registry entries to make it seem as though the Task Manager, Windows Registry, Folder options and Explorer files have been enabled. What it really does though, is replace the Internet Explorer start page for a malicious page. It also modifies the Windows Registry to run on every system startup.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeOct 17th 2008
     

    The Banbra.GBQ banker Trojan, the APop.A malicious Java Script and the Spammer.AJR Trojan are the focus of this week’s PandaLabs report.

    Banbra.GBQ is designed to obtain bank information from the user. This malicious code is distributed through email. To fools users, the executable file passes itself off as a Word document, and when run it opens a document in Portuguese in which users are asked to appear in the regional electoral committee (see image: http://www.flickr.com/photos/panda_security/2947407316).

    The idea is to distract users while the Trojan is infecting their computers.

    APop.A is a Java Script file that opens a series of Internet Explorer windows when run. One of these opens a page which claims to offer downloads of eMule, the well-known P2P file-sharing application.

    Both the Web page and the program are very similar to the originals, however, if users read the installation license carefully, they will see a text warning that the Navipromo adware will also be installed on their computer.

    The Spammer.AJR Trojan is designed to send spam from infected computers. These emails have interesting sounding subjects and include a link to a fake YouTube page (see image: http://www.flickr.com/photos/panda_security/2946552395/). If users visit the page, a fake antivirus program will be installed on their system.

    This week, PandaLabs has launched an orange alert warning of the danger of these fake antivirus programs, which according to data gathered by the laboratory, have already infected more than 30 million users around the world and are generating as much as €10 million a month for their creators.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeOct 24th 2008
     

    This week's PandaLabs report deals with the BatGen.D malicious tool and the Sinowal.VUW and YahooPsw.S Trojans.

    BatGen.D is a tool used by cyber-crooks to generate malware.

    Once run, the tool displays a short tutorial on how to create the desired malware, starting with its name. Once named, the malicious code is copied to c:\chosen_name.bat.

    With this tool cyber-crooks can choose, just with a click, the malicious actions to be performed by their creations on infected computers:
    spread across P2P networks, infect .rar files, shut down the victim's computer at random, etc You can see a photo of the console here:
    http://www.flickr.com/photos/panda_security/2968157479/

    "These tools make it extremely easy to create malware strains and they are behind the current avalanche of malware, with an average of ten thousand new malware strains detected every day", explains Luis Corrons, Technical Director of PandaLabs.

    The Sinowal.VUW Trojan, a member of the most dangerous malware families, is designed to intercept applications and monitor Web pages visited. The Internet addresses of these pages are compared to those of a Spanish bank. If they match, the access credentials are stored and the user is prompted to enter a set of banking data. This data is then sent to the Trojan creator through a Web page.

    Also, the Trojan installs a rootkit on the MBR (Master Boot Record, or "zero sector";) to avoid detection by security solutions.

    YahooPsw.S reaches computers with a barcode icon. This Trojan is designed to steal Yahoo!Messenger passwords. To do this:
    * It acts as a keylogger.
    * It captures screenshots.
    * It logs mouse movements.
    Data stolen are sent to several email addresses.
    Finally, this week, PandaLabs has reported the relationship between the stock market trends and malware. According to Panda Security's lab there is a close relationship between the stock market decline and the malware surge. More information at http://www.pandasecurity.com/spain/homeusers/media/press-releases/viewne
    ws?noticia=9407

    •  
      CommentAuthorKrazyIvan
    • CommentTimeOct 31st 2008
     

    Two Trojans, Gimmiv.A and Aidreden.A, and theP2PShared.P worm are the subject of this week's PandaLabs report.

    Gimmiv.A allows its creator to take full control of infected systems.

    Once a computer has been infected, the Trojan starts gathering the following information:

    * User names and passwords entered in web pages.
    * MSN Messenger passwords
    * Outlook Express passwords
    * System user name
    * Computer name
    * Patches installed
    * Information about the browser

    All stolen information is encrypted using the Advanced Encryption Standard (AES) and sent to a remote server.

    Aidreden.A is a Trojan designed to dupe users into buying a fake antivirus. To do this, it modifies the Host file on the infected computer so that users that visit certain Web pages are taken to a fake Microsoft web page and encouraged to download an anti-spyware software (see image here:
    http://www.flickr.com/photos/panda_security/2989258406/).

    Finally, P2PShared.P is a worm with bot features that steals password for all kinds of programs, applications, email and even banking details.
    All this information is then sent to cyber-crooks.

    Once run, it copies itself to the system and all the P2P file sharing directories under names like:

    Windows Live Password reveal.exe
    Leona-Lewis-Bleeding-love.mp3.www-freemp3s.com
    eMule-0-48a-VeryCD080902-Update.exe
    MsnCleaner.exe

    •  
      CommentAuthorKrazyIvan
    • CommentTimeNov 7th 2008
     

    The PCDefender2008 adware, the Downloader.UYC malicious script and the MSNWorm.FH worm are the subject of this week's PandaLabs report.

    PCDefender2008 is a "fake antivirus" adware that reaches computers with the name pcdefender2008Install.exe. Once installed, it simulates a computer scan to make users believe they are infected by dozens of malware samples (image here: ). Its aim is for users to purchase the fake antivirus promoted by this adware. Once the fake scan is over, users are offered the option of neutralizing the supposed infections, and if they accept, a screen is displayed (image here: ) in which users are given two options: to buy the antivirus or remain infected.

    On purchasing the product, users are redirected to the Web page of the fake product, created by cyber-crooks. If they do not purchase it, the adware will constantly display reminder messages to infected users, which is extremely annoying.

    "As incredible as it may seem, numerous users continue to fall victim to these traps. It is therefore advisable to remember a few basic rules such as not opening emails from unknown senders, and not running files or clicking links in one of those emails, as that is how these fake antiviruses enter computers," explains Luis Corrons, technical director of PandaLabs.

    Downloader.UYC is a malicious script designed to download the Downloader.UYD Trojan, which in turn is used to infect computers with other malware. To fool users and conceal its malicious actions, once run on the computer, this script displays a Windows Internet Explorer window.

    The Trojan downloaded by Downloader.UYC is also designed to prevent the firewall from blocking the downloading of malware.

    MSNPhoto.A is a worm that spreads through MSN Messenger. To do so, it sends a message with an infected file to all the affected users'
    contacts so they accept it and become infected.

    It also creates a key in the Windows Registry to ensure it is run every time the session is started. Similarly, it disables several functions including the system console and the computer recovery feature, and modifies the host file, preventing access to several Web pages, most of which are IT security-related, so users find it more difficult to remove this worm from their computer.

    In addition, PandaLabs has warned about the sending of malicious emails that are using the name of the US president-elect, Barack Obama, as bait to distribute malware.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeNov 14th 2008
     

    A new fake antivirus (the AntivirusPro 2009 adware), and the Gimmiv.C and Boface.C worms designed to spread on social networks such as Facebook and MySpace are the subjects of this week's PandaLabs report.

    AntivirusPro 2009 is a malicious code that passes itself off as a trial anti-malware solution. Once installed on the computer, it makes users believe their computer is infected to make them purchase the full, pay version of the fake antivirus. This way, cyber-crooks gain financial benefits from their infections. According to data collected by PandaLabs, over 30 million computers worldwide could be infected by fake antiviruses (http://www.pandasecurity.com/spain/homeusers/media/press-releases/viewn
    ews?noticia=9393)

    Gimmiv.C is a worm designed to exploit one of the latest Microsoft Windows vulnerabilities (MS08-067). When run on the computer, it drops two malicious files onto the system.

    One of the malicious files is vista.exe, an IP scanner that scans the subnet range of the local network searching for computers with port 445 open. Then, the worm runs another file downloaded (Mrosconfig.exe), which is used to exploit the MS08-067 vulnerability. Gimmiv.C uses this malicious code on the vulnerable computers found in the scan. It also makes one of the computers download other malware by connecting to a certain URL.

    Finally, Boface.G is a worm designed to spread on social networks such as MySpace or Facebook.

    This worm posts a link to a fake YouTube video on the infected user's profile or contacts panel, or sends the contacts a private message with the link. When they try to watch the video (which seems to come from one of their friends) they are taken to a Web page where they are encouraged to download a Flash Player update to watch it. However, if they do so, they will let a copy of the worm into their computers and will infect all of their contacts.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeNov 21st 2008
     

    This week's PandaLabs report looks at the Wow.VM Trojan, the Auraax.C worm and a series of malicious codes that spread across P2P networks using the High School Musical films as bait.

    Wow.VM spreads in a file called Love.jpg, posing as an inoffensive screensaver. When run, it displays a picture of a teenage girl (http://www.flickr.com/photos/panda_security/3046935025/). However, in the background it takes a series of malicious actions.

    This Trojan is designed to steal login details (user name and password) for online games such as World of Warcraft. The stolen information is then sent to the creator of the malware via Web.

    Wow.VM uses stealth techniques to avoid being detected by the user. Once it is installed on the computer, it deletes the original file from which it was run.

    Auraax.C reaches computers disguised as a Word file. This worm makes copies of itself in removable drives on the infected system. It also adds itself to the list of authorized applications in the Windows firewall in order to spread across the Internet.

    Finally today, PandaLabs has detected the existence of several malicious codes spreading across P2P networks using the High School Musical films as bait. When users search for files related to High School Musical using any of these programs, some of the results will include files infected with malware.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeDec 1st 2008
     

    BankoLimb.BW modifies the Web pages of banks in order to steal users'
    passwords when they access the page.

    To do this, it registers as a Browser Helper Object (BHO), so it can monitor the pages users visit on the Internet. When a user visits a certain banking Web page, the Trojan injects its HTML code into the page and captures all information entered. This is then sent to the creator of the Trojan.

    As if this wasn't dangerous enough, this Trojan allows remote execution of code permitting an external attacker to control the system.

    Spammer.AKE is designed to send junk mail to email addresses from infected computers. Once it has infected a computer, it downloads a file from the Internet containing addresses to spam and the subjects to use.
    These include:

    Hoje vai ser especial
    Uma longa jornada
    Palavras dos maiorais
    Um seculo de sabedoria

    These messages contain a link claiming to point to some photos but which actually take users to a malicious file.

    Nakhatar.A. installs on computers disguised as a Windows folder. When run, it closes some security and registry monitoring tools. It also disables other options including the Windows Task Manager.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeDec 12th 2008
     

    This week's PandaLabs report looks at the BankerFox banker Trojan, the Azero.B virus and the P2PShared.U worm, distributed through a fake McDonald's email message.

    Banker.LAX is designed to steal bank details. To do this, it drops a library on targeted computers passing itself off as a legitimate Firefox plug-in. Then, if the user accesses the website of their bank, the malicious code will capture all the information entered. The malware creator will then use this information to empty the users' accounts.
    This malware can steal passwords from more than one hundred banking institutions.

    "Oddly enough, this Trojan affects Firefox only, whereas cyber-criminals usually exploit Internet Explorer", says Luis Corrons, technical director of PandaLabs. "The reason for this is the increasing number of people who are using this Internet browser. As always, cyber-crooks
    target the most popular tools to affect as many users as possible. It
    is very likely that we will see more attacks like this in the future."

    Azero.B is a virus designed to infect executable files by inserting malicious code at the beginning of their code. Also, it replaces the computer wallpaper with an image with the following text: ""Hello Administrator! If you have seen me you are same as a Fool guy" .

    See an image of this wallpaper here:
    http://www.flickr.com/photos/panda_security/3101557477/

    Also this week PandaLabs has discovered a fake email message that pretends to be a special Christmas promotion from McDonald's but really is a bait to spread the P2PShared.U worm.

    The message subject is "Mcdonalds wishes you Merry Christmas!" and the text body reads as follows:

    "McDonald's is proud to present our latest discount menu. Simply print the coupon from this Email and head to your local McDonald's for FREE giveaways and AWESOME savings."

    For more information about this malicious code, go to http://www.pandasecurity.com/homeusers/media/press-releases/viewnews?not
    icia=9476

    Finally, PandaLabs has reported a new variant of the Boface worm, Boface.J, which uses Facebook to spread. More information in the PandaLabs blog:
    http://pandalabs.pandasecurity.com/archive/My-friend-was-a-worm.aspx

    •  
      CommentAuthorKrazyIvan
    • CommentTimeDec 19th 2008
     

    Antivirus360 is a fake antivirus. As with all this type of malware, this example is designed to make users believe that their computers are infected and then try to sell them a version of the fake antivirus.
    (Image here: http://www.flickr.com/photos/panda_security/3119340477/)

    If users decide to buy the product, they will see a Web page on which they can enter their payment details (image here:
    http://www.flickr.com/photos/panda_security/3120158812/)

    Sinowal.VXR is designed to steal bank passwords and send them to its creators, allowing them to steal money from users' accounts. To obtain this information, Sinowal.VXR monitors users' activity on the Internet and when they access certain bank Web pages, the Trojan redirects them to a spoof page. There they will be asked for a series of data including their user name and password, as well as other memorable information such as their favorite film, book or destination.

    "The reason for collecting this extra information is that cyber-crooks can then access the user's email accounts or similar services which often use these type of questions in the event that the user has forgotten their password", explains Luis Corrons, technical director of PandaLabs.

    The information is encrypted and sent via HTTP POST to an external server which saves all the data gathered.

    Salita.AN is a virus with a malicious payload that prevents the computer from functioning correctly. It stops Internet Explorer from working in offline mode, it disables access to the Windows Registry and Task Manager, and deactivates warnings from the "Windows Security Center". It also deletes Windows Registry entries related with safe mode, to prevent accessing the system in this way.

    The virus spreads by copying itself to all system drives, USB devices and shared drives.

    PandaLabs has also offered information this week on a vulnerability recently corrected by Microsoft which affects Internet Explorer. More information is available in the PandaLabs blog.
    http://pandalabs.pandasecurity.com/archive/Critical-updated-of-Microsoft
    -Security-Bulletin-MS08_2D00_078.aspx

    •  
      CommentAuthorKrazyIvan
    • CommentTimeDec 29th 2008
     

    Emogen (named Jumper Trojan by its creators) is a backdoor Trojan which includes a tool that allows cyber-crooks to manage infections.

    Through this malicious code, attackers can; manage files, capture screenshots, capture camshots, capture keystrokes (keylogger activity), steal passwords, manage installed applications, manage processes, etc.
    Emogen can even chat with the infected victim, and obtain statistical data of its infections through the console.

    "Until recently, this malicious code was sold together with the management console for 80 euros. Now, it is distributed in different forums for free. Consequently, infections will probably rise," explains Luis Corrons, Technical Director of PandaLabs.

    Here is an image of this malicious code's management console:
    http://www.flickr.com/photos/panda_security/3128211878/

    Autorun.AOL is a worm that exploits a Microsoft Windows vulnerability to spread (MS04-011). It tries to connect to an IRC channel, where it awaits its creator's instructions, accessing all the system ports.
    Additionally, it spreads through external drives.

    MoonLight.V is another worm designed to send spam to the contacts users have on their computers. This worm attaches a copy of itself to the spam messages in order to spread, and uses its own SMTP engine to send the emails.

    Spam message subjects include:

    * Tolong Aku..
    * Registration Confirmation
    * RE:HeLLO GuYs
    It also spreads through P2P networks.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeJan 2nd 2009
     

    Emogen.B is a backdoor Trojan that connects to a server and lets attackers take control of the targeted computer remotely. They will then be able to monitor system activities and take actions such as downloading malware, stealing user information, controlling the Command Prompt window remotely and even starting a chat session with the infected user.

    See an image of the Emogen.B console here:
    http://www.flickr.com/photos/panda_security/3128211878/

    This backdoor Trojan cannot spread automatically, but uses the usual means of propagation: P2P networks, physical devices such as CDs or floppy disks, Internet downloads or FTP file transfers.

    SystemSecurity is a fake antivirus-type adware that displays a false infection report to trick users. If the user clicks the button to disinfect the computer, it displays a page asking for a fee. (Image
    here: http://www.flickr.com/photos/panda_security/3159368914/).

    "This type of fraud has become quite popular lately. Malware like this shows the real financial motivation behind malicious code. Cyber-crooks will turn to anything to profit from infected users", explains Luis Corrons, Technical Director of PandaLabs.

    Finally in this week's report, we mention Gafermus.A, a Trojan that tries to connect to certain Web pages to download other malware. Then, it makes several copies of itself on the infected system using random names from the Windows services. It cannot spread automatically using its own means but requires user intervention.

    • CommentAuthorGuest
    • CommentTimeJan 8th 2009
     

    good

    •  
      CommentAuthorKrazyIvan
    • CommentTimeFeb 6th 2009
     

    Had not updated this since my brother came to visit and I took a vacation. Getting back into the groove of things.

    Virus Alerts, by Panda Security (http://www.pandasecurity.com)

    MSNWorm.FU is a worm that spreads through MSN Messenger. To do so, it opens conversations with the infected user's contacts and offers them a file as if it were a photo for the contact to accept and consequently become infected. The file is sent together with sentences such as:

    "me puedes marcar en esta foto de facebook?" (can you tag me in this facebook photo) "me cerraron mi cuenta por subir esta foto. si esta muy mal?" (they closed my account for loading this photo. Is it that bad?) "viste esta super fiesta de año nuevo?" (check out the New Year party) "toma, esta perfecta esta foto como wallpaper" (here, this photo is perfect as wallpaper)

    The file is usually compressed in a .zip file to avoid being detected by the Messenger.

    DirDel.A is a worm that reaches computers with a folder icon, to fool users into running it. When run, it does not display any message or open any folder. This malware replaces folders in different directories with a copy of itself. For example, if there is a folder called Example, it creates a copy of itself in the same directory called Example.exe and deletes all the original folders and their content.

    This worm spreads by copying itself to all the system drives and shared folders.

    P2PShared.AB reaches computers disguised as an email file, with names related to trademarks, such as Ikea.exe. To spread, it copies itself onto the shared files of P2P programs, with names of programs, disks, and so on. For example:

    Youtube Music Downloader 1.0.exe
    Absolute Video Converter 6.2.exe
    FOOTBALL MANAGER 2009.exe
    Password Cracker.exe

    This worm also spreads via email by sending spam emails with subjects such as You´ve received a Hallmark E-Card, and an attached file called postcard.zip which contains malware. You can see an image here: http://www.flickr.com/photos/panda_security/3256919391/

    In addition, this week PandaLabs has informed about a new phishing attack used by Facebook as bait. French users received a message inviting them to view specific content in Facebook. When they did, they were redirected to a fake Facebook page, similar to the original. Any details they entered were sent to cyber-crooks. More information here: http://pandalabs.pandasecurity.com/archive/Facebook-Phishing-Site-Targets-French-Users.aspx

    •  
      CommentAuthorKrazyIvan
    • CommentTimeFeb 20th 2009
     

    P2PWorm.AA is a worm that combines adware and downloader features. On infecting a computer, the malicious code shows ads about software and application downloads. Click here to see an example.

    Also, the worm downloads other malware strains onto the infected computer. These files are downloaded to P2P file-sharing folders so that they are later on downloaded by other users to infect them. To do this, it disguises the codes as program cracks, applications, etc.

    "It has become increasingly common to see malicious codes presenting features of two or three malware types (worms, adware, Trojans,...).
    This way, cyber-crooks try to increase the profitability of their infections, attacking users in many different ways", explains Luis Corrons, Technical Director of PandaLabs.

    Waledac.J is a worm that sends email thanks to its own SMTP engine.
    These emails include a copy of the worm in order to spread it. Waledac.J sends these emails to all of the infected user's contacts, whose
    addresses it has previously stolen.

    The worm is also designed to download other malware strains onto the targeted computer. The downloaded files pass themselves off as images and even have a .JPG extension in order to trick users. See an example of this here: http://www.flickr.com/photos/panda_security/3294033419/

    Sality.AO is a virus that combines the features of traditional viruses with the objectives of new malware, i.e. generating financial returns for cyber-criminals.

    Sality.AO uses some techniques which haven't been seen for years, such as EPO or Cavity. These techniques relate to the way in which the original file is modified in order to infect it, making it more difficult to detect these changes and to disinfect it. EPO allows part of a legitimate file to be run before infection starts, making it difficult to detect the malware. Cavity involves inserting the virus code in blank spaces within the legitimate file's code, making it both more difficult to locate and to disinfect infected files.

    In addition to these techniques related with early malware, Sality.AO includes a series of features associated with new malware trends, such as the possibility to connect to IRC channels to receive remote commands, potentially turning the infected computer into a zombie. Such zombie computers can be used for sending spam, distributing malware, denial of service attacks, etc.

    Similarly, infections are not just restricted to files, as was the case with old viruses, but also look to propagate across the Internet, in line with new trends. To this end, it uses an iFrame to infect PHP, ASP and .HTML files on the computer. The result is that when any of these files are run, the browser is redirected, without the user's knowledge, to a malicious page that launches an exploit in order to download more malware onto the computer.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeMar 13th 2009
     

    The new variant of the Conficker worm (Conficker.D) that has appeared this week connects to numerous servers to update. Like other variants in this family, this worm uses the MS08-067 Microsoft Windows vulnerability to spread. Apart from allowing the worm to enter the computer, this vulnerability lets the attacker take several actions on the infected computer, even allowing control of the computer. This worm also spreads through USB devices, such as memory sticks and MP3 players.

    This worm updates every day and downloads new versions of itself onto the infected computer from Web pages that constantly change their URL to make it more difficult to block.

    The Malwaredefender 2009 adware on the other hand, is a fake antivirus.
    On reaching computers, this adware, like most of its kind, simulates a malware scan to pass itself off as an antivirus. During the scan it supposedly detects several examples of (non-existent) malware in order to worry users (image:
    http://www.flickr.com/photos/panda_security/3348889715/).

    It then invites them to buy the pay version of the fake antivirus to eliminate the malware it claims to have detected, opening a registration window (image: http://www.flickr.com/photos/panda_security/3348889711/).

    On registering, users are redirected to a Web page to download the Premium version of the fake antivirus: (image of the store here:
    http://www.flickr.com/photos/panda_security/3348889717/)

    Finally, the BadGorve.H Trojan is designed to eliminate files with certain extensions (JPG and WMV among others) from specific directories on the infected computer, causing a significant loss of user information.

    •  
      CommentAuthorKrazyIvan
    • CommentTimeMar 27th 2009
     

    Nabload.DLU passes itself off as a funny video to trick users while downloading another malicious code to the target computer in order to steal online banking details. The process is as follows:

    The Trojan reaches the targeted computer as a greetings video. When the user opens the file, the Trojan loads a funny video from the Internet, while simultaneously downloading another malicious code: Banker.LRX.
    This malware is designed to steal login credentials for several online banking entities.

    You can watch a video showing what the targeted user would see while being infected: http://www.youtube.com/watch?v=OaQhFhVX6yI

    Nabload.DLU also modifies the Windows Registry in order to activate every time the user restarts the computer. This way, it ensures it is always active on the system.

    Renus2008 is a fake antivirus type of adware. Once run, it shows a screen simulating a computer scan. The malicious code gives the possibility of performing a quick or an in-depth scan of the computer.
    Also, users can configure different aspects of the fake antivirus as if it was a real one (see image here: )

    Once the fake scan finishes, a warning message is displayed indicating that some infected files have been found on the system. However, these files do not exist.

    Users are offered the option to disinfect their computers through the "Remove Viruses" button on the scan screen. If they do so, a window is displayed inviting them to register and buy the paid version of the fake antivirus (see image here: )

    "If the user buys the paid version, they are paying for a product that actually does nothing and which, in some cases can't even be downloaded", explains Luis Corrons, Technical Director of PandaLabs.
    "This is one more example of how cyber-crooks try to trick users in order to get their money".

    MSNworm.FZ is a worm that spreads by using the instant messaging program MSN Messenger. It attaches itself to messages passing itself off as a picture file, and sends itself to the victim's contact list.

    To trick users, once run it shows an error message indicating that the "picture can not be displayed".

    The worm also modifies the Microsoft Internet Explorer home page and creates a key in the Windows Registry to ensure it is run every time the session is started.

    • CommentAuthormezz09
    • CommentTimeApr 11th 2009
     

    Ooh, site updates? certainly seems sleeker.

    anyway, does anyone know of a virus for phones with touchscreen that disables the touchscreen?

    •  
      CommentAuthorKrazyIvan
    • CommentTimeMay 8th 2009
     

    ^^
    Not ignoring you but I cannot read what you posted because of some conflict with IE. :(

    This week's PandaLabs report looks at the CoreGuard2009 adware and the Kobcka.A and EvilHot.A Trojans.

    CoreGuard2009 is a fake antivirus type of adware. Like of all its kind,
    CoreGuard2009 tries to pass itself off as a security solution and simulates a system scan, finding malware strains that are not actually present on the system. It then offers users the possibility of removing that 'malware' by buying a premium version of the product at $76.50.

    "The purpose of this tool is to trick users into believing they are infected with various malware strains and offer them a paid version of the fake antivirus to remove them. This way, malware creators profit from their infections," explains Luis Corrons, Technical Director of PandaLabs.

    You can find images of this fake antivirus here:
    http://www.flickr.com/photos/panda_security/tags/coreguard2009/

    Kobcka.A is a Trojan designed to send spam messages to various email addresses. It also sends its creator information about the infected computer, for example, the operating system version.

    The Trojan uses stealth techniques (through a rootkit) to make detection more difficult. It affects the productivity of the computer, the network to which it's connected or other remote sites.

    EvilHot.A is a Trojan that modifies the user's logon password that was active at the time of the infection. Once run, the Trojan displays a series of messages and crashes the computer (you can see an image here:
    http://www.flickr.com/photos/panda_security/3512463150/)

    It then tries to connect to a Web page to download some files.

    More information about these and other malicious codes is available in the Panda Security Encyclopedia
    ((http://www.pandasecurity.com/homeusers/security-info)

    •  
      CommentAuthorKrazyIvan
    • CommentTimeMay 29th 2009
     

    KillAV.KP is designed to prevent users from accessing websites of antivirus companies and IT security forums. This way, users cannot check security-related issues nor download updates.

    This malicious code reaches computers in what looks like an image file with an icon of a cat. To avoid being detected, once run KillAV.KP shows users a .GIF animation (image here:
    http://www.flickr.com/photos/panda_security/3574720713/ )

    Meanwhile, it downloads a file to the system which modifies the Windows Registry to prevent users accessing websites of security companies, etc.

    The PasswordStealer.BM worm on the other hand, steals users'
    confidential information, i.e. passwords stored on Internet Explorer.
    It also steals information regarding the affected computer (version of the operating system, user name and IP address). The information is stored and sent to its creator later on via IRC.

    There are several tell-tale signs of the presence of this worm. When run, it displays an image of a young person smoking a cigarette (image
    here: http://www.flickr.com/photos/panda_security/3575542298/ ). It also modifies the homepage of Internet Explorer (image here:
    http://www.flickr.com/photos/panda_security/3575542334/ )

    PasswordStealer.BM uses several techniques to make it more difficult to
    delete:
    - It hides files and folders.
    - It conceals file extensions.
    - It conceals operating system files.

    Additionally, PasswordStealer.BM tries to spread through IRC channels.
    To do so, it sends random messages with a file called MYPIC.ZIP which contains a compressed copy of itself, to all the users connected to the channel the affected user connects to.

    Finally, the MSNWorm.GI worm is designed to spread through MSN Messenger. To do so, it sends an instant message to the infected user's contacts, tempting them to view a photo.

    The message includes a link with a URL that resembles Facebook's. On clicking the link, a download window is opened for users to run or save the file (supposedly a photo). The file has a double extension (JPG and
    EXE) to fool users. This file really consists of an up-to-date copy of the worm.

    If users open the downloaded file, Facebook's legitimate page will open to fool them and get them to believe there has been an error when they cannot find the new photo.

    More information about these and other malicious codes is available in the Panda Security Encyclopedia
    ((http://www.pandasecurity.com/homeusers/security-info)

    •  
      CommentAuthorKrazyIvan
    • CommentTimeJun 5th 2009
     

    This week's PandaLabs report includes information about the AntivirusDoktor adware, the Sinowal.WHZ Trojan, a dangerous SEO attack and an attack that affects Twitter users.

    Like all fake antivirus adware, AntivirusDoktor is designed to make users believe their computers are infected. The tool performs a false scan of the affected system. Then, it shows a screen as if the computer were infected by dozens of virueses. Image here:
    http://www.flickr.com/photos/panda_security/3596732479/

    AntivirusDoktor then offers users the option to eliminate the malware by purchasing a paid version of the fake antivirus (image:
    http://www.flickr.com/photos/panda_security/3596732511/ ). The objective is to profit financially from selling fake antiviruses.

    If users do not purchase the paid version, the antivirus displays a window every now and again indicating the computer is infected and prompting users into purchasing the paid version.

    You can view all the images here:
    http://www.flickr.com/photos/panda_security/tags/antivirusdoktor/

    Sinowal.WHZ, on the other hand, is a Trojan distributed through emails that purport to come from UPS. Users are informed via email that the service was unable to deliver the packet sent to a recipient on a specific date. Additionally, users are prompted into opening the attached file including the receipt.

    "Users probably have not ordered a delivery on the mentioned date, and will probably open the attached file in case they are charged for a service they have not ordered," explains Luis Corrons, technical director of PandaLabs.

    If users open the attached file, they will really be downloading a copy of the Trojan onto their computer. Like most of the variants of this family, Sinowal.WHZ is designed to steal infected users' bank details.

    PandaLabs has also informed this week about an attack designed to distribute fake antiviruses using Twitter, one of the most popular 2.0 Web services. More information here:
    http://www.pandasecurity.com/spain/homeusers/media/press-releases/viewne
    ws?noticia=9704

    Additionally, PandaLabs has informed about a BlackHat SEO attack on search terms like Air France, YouTube, E3, Microsoft and Project Natal.
    For more information, go to the PandaLabs blog (http://pandalabs.pandasecurity.com/archive/Cyber-Criminals-Target-Air-F
    rance_2C00_-YouTube_2C00_-E3_2C00_-Microsoft_2C00_-Project-Natal_2C00_-a
    nd-more_2620_.aspx)

    More information about these and other malicious codes is available in the Panda Security Encyclopedia (http://www.pandasecurity.com/homeusers/security-info/about-malware/ency
    clopedia/)

    •  
      CommentAuthorKrazyIvan
    • CommentTimeJun 26th 2009
     

    This week's PandaLabs report looks at the Terminator2009 adware, the KillRDLL.A Trojan and the Rimecud.E worm.

    Terminator2009 is a fake antivirus (a type of adware). When it runs, it simulates a scan (although this is started when users click the scanner button). It then claims to have detected malware. If users follow the program's recommendations, they are redirected to a page where they can purchase a Premium version of the fake antivirus. If not, the adware starts displaying warnings to users claiming that the computer is infected and suggesting they purchase the pay version to eliminate these
    (non-existent) threats.

    The overall objective for the creators of this malicious code is to profit from the sale of pay versions of the fake antivirus.

    You can view the images here:
    http://www.flickr.com/photos/panda_security/tags/terminator2009/

    KillRDLL.A is a Trojan that creates copies of itself every time users access a directory. This file has a Windows folder icon with a hidden extension to make users believe it is a folder. It also creates a copy of itself when users access a subdirectory.

    Fake folders use names including:

    Angelina Jolie
    Clips
    Documents
    Favorites
    Flash Games
    Games
    My Documents
    My Folder
    Picture
    Video
    WallPapers

    When run, it opens the Web page of a search engine that dislplays false results. You can see an image here:
    http://www.flickr.com/photos/panda_security/3662238086/

    Finally, the Rimecud.E worm downloads malware from certain Web pages. It is designed to send spam messages while it downloads more malware. Being infected by this worm could result in the user suffering an avalanche of malicious programs.

    In order to spread, this worm copies itself to folders of P2P applications such as Bearshare and eMule. It also spreads through MSN Messenger. To do so, it sends a copy of the worm to the contacts of the affected user (if connected).

    It also copies itself to the USB devices connected to the computer and creates an autorun.inf file to be run whenever the infected device is connected to a computer.

31 to 55 of 55

  1. <
  2. 1
  3. 2
  4. >
Add your comments
  • Format comments as
 
Back to Discussions Top of Page
 
Copyright Andrew Miller (Spode), 2008