Worm

Remote Desktop Worm “Morto”

by certifiedbug on August 30, 2011

in Internet Security

F-Secure

We don’t see that many Internet worms these days. It’s mostly just bots and trojans. But we just found a new Internet worm, and it’s spreading in the wild. The worm is called Morto and it infects Windows workstations and servers. It uses a new spreading vector that we haven’t seen before: RDP.

RDP stands for Remote Desktop Protocol. Windows has built-in support for this protocol via Windows Remote Desktop Connection. Once you enable a computer for remote use, you can use any other computer to access it.

http://www.f-secure.com/weblog/archives/00002227.html

nakedsecurity

Although the Morto worm has received a lot of press attention we need to keep the threat in proportion. SophosLabs has received a very low number of reports of this worm being seen in the wild – other threats which are less exciting to the media are infecting considerably more computers.

http://nakedsecurity.sophos.com/2011/08/30/morto-rdp-worm-of-death/

{ 0 comments }

Active hyperlinks temporarily disabled in Windows Live Messenger 2009

by certifiedbug on November 14, 2010

in Microsoft

Those using Messenger have probably noticed Microsoft has been blocking active links in Messenger 2009 in an effort to limit the damage caused by a malicious worm which spreads itself through instant messaging and social networks.

The worm spreads by inserting a link into an IM conversation with a person whose computer is already infected. When someone clicks the link, it opens in a browser, downloads the worm on the recipient’s computer, and then repeats this process.

http://windowsteamblog.com/windows_live/b/windowslive/archive/2010/11/12/security-alert-active-links-in-messenger-2009-temporarily-turned-off-to-prevent-a-malicious-worm.aspx

{ 0 comments }

Iran confirms Stuxnet attack

by certifiedbug on September 27, 2010

in News

Computerworld

Although some computers at Iran’s Bushehr nuclear reactor were infected by the Stuxnet worm, none of the facility’s crucial control systems were affected, Iranian officials claimed Sunday.

The news followed Saturday’s admission by Iran that Stuxnet had infected at least 30,000 computers in the country. The worm, which researchers have dubbed the most sophisticated malware ever, targets Windows PCs that manage large-scale industrial-control systems in manufacturing and utility companies.

http://www.computerworld.com/s/article/9188147/Iran_admits_Stuxnet_worm_infected_PCs_at_nuclear_reactor

{ 2 comments }

Worm:Win32/Visal.B

by certifiedbug on September 10, 2010

in Internet Security

Microsoft Malware Protection Center
Emerging Malware Issue: Visal.B

The threat has a timestamp of 9/3/2010 and spreads using two techniques: mass emailing, and copying itself to local drives (C: and H:) and network shares. The threat will copy itself to various drives on the local system along with an autorun.inf file, and will also send itself to all contacts that it can find on the compromised system via email.

Visal.B uses MAPI to perform a mass mailing to all contacts that it finds on the compromised system. In a corporate environment the “address book” may be extensive. As more machines on a corporate network are infected, more and more email is sent around on the local network, which can cause mail server performance degradation. The threat also sends back information about the compromised system, specifically IP addresses and system information via a built-in SMTP/ESMTP (mail-transfer) engine.

The mass-mailed messages contain a link that looks as though it points to a .pdf document or .wmv video, but in fact it points to a malicious .scr file.

Alert Level: Severe
malware encyclopedia

http://social.technet.microsoft.com/wiki/contents/articles/worm-win32-visal-b.aspx

http://social.technet.microsoft.com/wiki/contents/articles/worm-win32-vb-wf-email-virus-defending-with-forefront-security-forefront-protection-antigen.aspx

http://garwarner.blogspot.com/2010/09/here-you-have-spam-spreads-email-worm.html

{ 0 comments }

MSRT November Threat Reports

November 24, 2009

Microsoft Malware Protection Center Out of these prevalent threat families worldwide, 8 are password stealers collecting online game credentials, online banking passwords or other user identities of users’ online accounts. 8 of them are fake security products or trojan downloaders for rogues. The MSRT now covers the following most high profile rogues o Win32/FakeVimes o [...]

Read the full article →