Worm speaks to Windows users
19923
Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
163595
Computer users could be open to attack from malicious hackers because of the way that Windows displays some images. Microsoft has issued a warning about a critical vulnerability in Windows that could let carefully
578328
(InfoWorld) - A new variant ofÂ the Stration worm, which has been plaguing Windows users for the past year, has made the jump from Skype to the ICQ and MSN Messenger networks. This latest variant popped up earlier this week, according to Chris Boyd, a researcher at FaceTime Communications, who blogs under the pseudonym "Paperghost." "They're using Skype as a jump off into other more established networks," Boyd said. "The infection will go looking for other instant messaging clients that are on the PC and then attempt to send the infection message that it initially sends through Skype through these other chat systems." For a computer to be infected, a user must first click on a link and then agree to download an executable file. In one sample provided by Boyd, the malicious link is listed below the instant message, "Check this out. Give me your opinion." Once installed, the worm will gradually start to send out messages to the victim's contacts, Boyd said. Instant message worms have spread from network-to-network in the past, but this is the first time Boyd has seen a worm jump from Skype to another network. "It's an odd system to make, because these guys have a foot in the door [in the Skype network]," he said. "You think they'd focus all their energies onto exploiting Skype." Stration is not widespread and is considered to be a low-risk infection, but it has been a tough worm to fight for some security vendors. Over the past year it has morphed into hundreds of variants, and antivirus companies have been having a hard time keeping track of its many iterations. Stration has also been called "Warezov" and "Stratio." Nobody knows who is behind the worm, but the domains that host the malicious code are registered through a Chinese Internet company, Boyd said. Â
16229
(InfoWorld) - Computer security analysts are studying reports of a worm that may be circulating via a feature in Skype's popular VOIP (voice over Internet protocol) service. Security vendor Websense said the worm spreads through Skype's chat feature. Users receive a message asking them to download a file called "sp.exe." The executable is a Trojan horse that can steal passwords. If a user runs the Trojan it triggers another set of code to spread itself. The first infected PCs appeared in the Asia-Pacific region, particularly in Korea, Websense reported on its blog on Tuesday. It said it was still investigating the issue. Not all security experts were in agreement, however. F-Secure received a sample of the worm and determined that it did not, in fact, target Skype, said Mikko Hypponen, chief research officer. "What's clear is, there's no massive worm outbreak with Skype at the moment," Hypponen said. "We are following the situation." The SANS Internet Storm Center said it was "hearing some details of a new worm spreading via Skype IM" and asked for more information in a posting on its site. Websense said the executable appears to be encrypted with NTKrnl Secure Suite Packer, a polymorphic encryption program that makes files look unique to different detection engines. The original site that hosted the code is not serving it any more, Websense said. Â
373163
Websense warns of a Skype worm on the loose; Opera adds a security alert layer to its browser.
710162
Security researchers warned Monday of a new worm, dubbed "Funner," targeting Microsoft Corp.'s MSN Messenger IM (instant messaging) system.
143304
A computer worm is attacking some business PCs through a flaw in antivirus software by Symantec Corp., a security company warned Friday.
125692
(InfoWorld) - Skype users are under attack from aÂ new wormÂ that spreads through the peer-to-peer Internet phone application'sÂ chat feature. The attack begins when a user receives an instant message containing a link from someone in their contact list or an unknown Skype user, said Villu Arak, a Skype spokesman based in Tallinn, Estonia. There are several versions of the chat messages, which are "cleverly written" to fool users, Arak wrote on the Skype heartbeat blog. The link appears to contain a JPEG photo file, but if clicked causes the Windows run/save dialog box to appear, which asks whether the user wants to save or run a ".scr" file. The file is malicious software that can then access a user's PC via Skype's API (application programming interface). The malicious file has been named W32/Ramex.A. "Users whose computers are infected with this virus will send a chat message to other Skype users asking them to click on a web link that can infect" their computers, Arak wrote. To avoid trouble, users should not download the file. At least two security vendors, F-Secure and Kaspersky Lab, have updated their software to detect the worm, Arak wrote. Instant message programs are another way hackers can try to gain control over PCs. Access to one person's instant messenger or e-mail account can mean contact details for many others, allowing hackers to use malicious e-mails or instant messages to lure victims into downloading malicious software. Â
199836
Users are being warned about a Windows virus that travels with a game of Tetris.
791
A new computer worm emerged on Tuesday which broke the speed record from the announcement of a security vulnerability in Microsoft&#39;s Internet Explorer to a full-blown virus that spreads in the wild.
238166
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs--it wants to invade their homes, too.
342444
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs - it wants to invade their homes, too.
467651
A computer worm is using a recently disclosed flaw in Sun Microsystems' operating system to propagate.
62609
With viruses, worms, spyware, spam and phishing, running a computer this year -- especially one with Windows -- has often been a colossal headache. -Rob Pegoraro
169476
Microsoft has fixed a critical flaw in the Windows operating system that could be used by criminals to create a self-copying computer worm attack.The software vendor released its first set of patches for 2008 on Tuesday, fixing a pair of networking flaws in the Windows kernel. Microsoft also released a second update for a less-serious&#160;Windows flaw that would allow attackers to steal passwords&#160;or run Windows software with elevated privileges.The critical bug lies in the way Windows processes networking traffic that uses IGMP (Internet Group Multicast Protocol) and MLD (Multicast Listener Discovery) protocols, which are used to send data to many systems at the same time. Microsoft says that an attacker could send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on a system.Security experts say that there is no known code that exploits this flaw, but now that the patch has been posted, hackers can reverse-engineer the fix and develop their own attack code.Because IGMP is enabled in Windows XP and Vista by default, this bug could be used to create a self-copying worm attack, Microsoft said Tuesday.&quot;Theoretically this is wormable, and that&#39;s why this is rated critical,&quot; said Tim Rains, security response communications lead with Microsoft. However, Microsoft does not believe that hackers will have an easy time developing attack code that will work reliably. &quot;We&#39;ve done a thorough analysis of the vulnerability, and we&#39;ve come to the conclusion that there are several technical mitigating factors that make it unlikely to get reliable remote code execution,&quot; Rains said.Windows uses the IGMP protocol for many popular consumer applications such as streaming video, multiplayer games, and universal plug-and-play, but the protocol is usually blocked at the router. A derivative of IGMP, MLD is the multicast protocol used by IPv6 systems and is enabled on Vista by default.&quot;If it became a worm it could take over an internal network pretty quickly, or at least all the machines where multicast is enabled,&quot; said Eric Schultze, chief technology officer with Shavlik Technologies. &quot;But this one is going to be mitigated because a lot of people have blocked multicast.&quot;The critical MS08-001 update that fixes this flaw also patches a second, less-serious bug in the Windows networking stack that could be leveraged to launch a denial-of-service attack against a Windows system. This vulnerability lies in the Internet Control Message Protocol Router Discovery Protocol (ICMP RDP), which is used by Windows to find out how to communicate with the network. Because this capability is not turned on by default, Microsoft considers this to be merely an &quot;important&quot; bug.Microsoft&#39;s other Tuesday update, MS08-002, fixes an elevation of privilege flaw in the Windows Local Security Authority Subsystem Service (LSASS), used to manage account credentials in Windows.This flaw could be exploited by attackers to steal passwords or run their code with a higher level of privilege on Windows, said Schultze. &quot;The primary concern is Johnny who is a user becoming Johnny admin,&quot; he said. But if attackers were to combine an attack that exploited this flaw with another exploit that would allow them to run code on the system, then &quot;that could become a critical issue,&quot; he said.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
236348
At least one new variant of a worm spread rapidly from Asia and Europe to US computers, filling up people&#39;s email accounts, but otherwise causing little apparent damage.