Technology news and Jobs 
VIRTUALISATION Conficker, back with a vengeance as top worm
VIRTUALISATION Conficker, back with a vengeance as top worm | Conficker, back with a vengeance as top worm |
|
| by Peter Dinham | |
| Monday, 31 August 2009 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
Conficker restricts access to the websites associated with IT security vendors and now, apparently, the latest variant of the worm can install rogue security software on compromised machines. BitDefender’s report for August has Win32.Induc.A, a less common piece of malware application built with Borland (now Embarcadero) Delphi versions 4 through 7, in second place on its top-10 e-threats list. According to BitDefender, this virus does not infect binary files, but modifies the SYSCONST.PAS file, injects its malicious code and then compiles the file back. The security firm says all the applications built with the compromised compiler would then be infected with the virus, and it warns that although Win32.Induc.A has no malicious payload, its abrupt escalation in its top 10 e-threats tracker suggests that, at present, “few Delphi developers are aware of the widespread infection.” And, a file infector known as Win32.Sality.OG, grabs third spot on the list, with BitDefender reporting that the polymorphic file infector appends its encrypted code to executable files (.exe and .scr binaries), and in order to hide its presence on the infected machine it deploys a rootkit and attempts to kill antivirus applications installed locally. Meanwhile, BitDefender says that the increasing presence of the worm Worm.Autorun.VHG – now ranked fourth - reveals that users are still ignoring Microsoft’s security advisories to deploy security patches, with the Internet/network worm exploiting the Windows MS08-067 vulnerability in order to execute itself remotely using a specially crafted RPC (remote procedure call) package, an approach which the security firm says is also used by Conficker. BitDefender also warns of a high-risk infection from its fifth ranked Win32.Virtob.Gen file infector written in assembly language, which it says hides its presence by injecting hooks into other Windows processes, but avoids compromising system files, and opens a backdoor that can be exploited by a remote attacker to seize control over the infected machine. |
Tags
| < Next story in category | Previous story in the category > |
|---|
