Conficker worm hits University of Utah computers

Conficker worm hits University of Utah computers

April 12th, 2009

(AP) -- University of Utah officials say a computer virus has infected more than 700 campus computers, including those at the school's three hospitals.

University health sciences spokesman Chris Nelson said the outbreak of the Conficker worm, which can slow computers and steal personal information, was first detected Thursday. By Friday, the virus had infiltrated computers at the hospitals, medical school, and colleges of nursing, pharmacy and health.

Nelson says patient data and medical records have not been compromised.

"That's secured in a much deeper way because of the implications," he said.

Nelson said the virus is mainly attacking personal computers and could be siphoning login and password data, credit card numbers and banking information.

Directions for purging the virus from personal computers and equipment like thumb drives, digital cameras and smart phones has been distributed to staff and students.

Information technology staff shut of Internet access for up to six hours at some campus locations Friday so they could isolate the virus. They were expected to work through the weekend to eradicate it from the system.

Mindy Tueller of the university's office of information technology said all faculty and students should take steps to make sure they are protected. The virus does not infect Macs.

"It can do a lot of bad things," Tueller said. "Every university member should be concerned about this if they're using Windows-based devices."

©2009 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

In addition, there are new reports about the features and their behavior of the worms!

Conficker also installs fake antivirus software

Conficker now definitely downloading updates

Kaspersky Lab detects new version of Conficker worm

- wong chee tat :)

New Windows virus attacks PHP, HTML, and ASP scripts

New Windows virus attacks PHP, HTML, and ASP scripts
 
Virus gets around

By Dan Goodin in San Francisco  

Posted in Security, 12th February 2009  

Researchers have identified a new strain of malware that can spread rapidly from machine to machine using a variety of infection techniques, including the poisoning of webservers, which then go on to contaminate visitors.

The malware is a variation of a rapidly mutating virus alternately known as Virut and Virux (And here too ). It has long proved adept at injecting itself into executable files, which are then able to attack uninfected machines through network drives and USB sticks.

The variant, which Microsoft is calling Virus:Win32/Virus.BM, is also able to infect web scripts based on languages such as PHP, ASP, and HTML. Servers that become infected include an iframe in webpages that attempt to spread malware to visitors.

"This catapults the possibility of spreading even farther," Trend Micro researchers warn. "If the script files happen to be uploaded to a publicly accessible website, any visitor to the affected sites will be led to the URL embedded in the iframe code."

The iframe surreptitiously directs visitors to zief.pl (don't visit it unless you're a security professional), which attempts to exploit a variety of vulnerabilities based on the browser and other applications the user has installed, Microsoft researchers say. Once installed, the virus injects its code into various system processes such as explorer.exe and winlogon.exe and hooks low-level Windows APIs to ensure it stays in memory.

The virus has also picked up some new polymorphic tricks designed to make it harder for anti-virus programs to detect. Among other things, it uses more than one layer of encryption, allowing its binary fingerprint to change but to preserve its malicious payload.

Infected machines will have an IRC backdoor installed that tries to connect to several servers using port 80. ®

- http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=PE_VIRUX.A

- http://www.theregister.co.uk/2009/02/12/new_virut_strain/

- http://www.symantec.com/security_response/writeup.jsp?docid=2006-051402-1930-99

- wong chee tat :)