Virus gets around
By Dan Goodin in San Francisco
Posted in Security, 12th February 2009
Researchers have identified a new strain of malware that can spread rapidly from machine to machine using a variety of infection techniques, including the poisoning of webservers, which then go on to contaminate visitors.
The malware is a variation of a rapidly mutating virus alternately known as Virut and Virux (And here too ). It has long proved adept at injecting itself into executable files, which are then able to attack uninfected machines through network drives and USB sticks.
The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able to infect web scripts based on languages such as PHP, ASP, and HTML. Servers that become infected include an iframe in webpages that attempt to spread malware to visitors.
"This catapults the possibility of spreading even farther," Trend Micro researchers warn. "If the script files happen to be uploaded to a publicly accessible website, any visitor to the affected sites will be led to the URL embedded in the iframe code."
The iframe surreptitiously directs visitors to zief.pl (don't visit it unless you're a security professional), which attempts to exploit a variety of vulnerabilities based on the browser and other applications the user has installed, Microsoft researchers say. Once installed, the virus injects its code into various system processes such as explorer.exe and winlogon.exe and hooks low-level Windows APIs to ensure it stays in memory.
The virus has also picked up some new polymorphic tricks designed to make it harder for anti-virus programs to detect. Among other things, it uses more than one layer of encryption, allowing its binary fingerprint to change but to preserve its malicious payload.
Infected machines will have an IRC backdoor installed that tries to connect to several servers using port 80. ®
- http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE_VIRUX.A
- http://www.theregister.co.uk/2009/02/12/new_virut_strain/
- http://www.symantec.com/security_response/writeup.jsp?docid=2006-051402-1930-99
- wong chee tat :)
No comments:
Post a Comment