Digital Virus

More than nine million computers around the world have been infected by a digital virus in what experts believe is a multi-staged attack.

The world leading security experts paint a scary scenario, stressing that they are yet to identify who programmed it and what the next stage will be.

Known as Conficker or Downadup, it is spread by a recently discovered Microsoft Windows vulnerability, by guessing network passwords and by hand-carried consumer gadgets like USB keys, the New York Times said on Friday.

Experts were quoted as saying that it is the worst infection since the Slammer worm exploded through the Internet in January 2003, and it may have infected as many as nine million personal and business computers around the world.

Worms like Conficker not only ricochet around the Internet at lightning speed, they harness infected computers into unified systems called botnets, which can then accept programming instructions from their clandestine masters.

The experts were quoted as saying that many computer users may not notice that their machines have been infected.

But they might be waiting for the instructions to materialise, to determine what impact the botnet will have on PC users.

Google Chrome acts as a keylogger

About 2% of the time, however, the keystrokes are recorded, along with associated data such as the IP address of the user who entered those keystrokes.

"Users were faced with Google retaining all of their search logs and all of the URLs they were typing."

Reacting to criticism that its newChrome browser was essentially acting as a keylogger, potentially recording users' every keystroke, Google Inc. yesterday said it would render anonymous the data it collects from the browser within 24 hours.

Asus admits Eee Box mini PC shipped with virus

Asus has admitted that some of the its Eee Box desktop mini PCs have shipped with a virus.

But while the company has only admitted the infection was present in machines shipped to Japan, Register Hardware can confirm that other territories may be affected too.

According to an email sent out by Asus, PC Advisor reports, the Eee Box's 80GB hard drive has the recycled.exe virus files hidden in the drive's D: partition. When the drive is opened, the virus activates and attempts to infect the C: drive and an removable drives connected to the system.

According to Symantec, the malware is likely to be the W32/Usbalex worm, which creates an autorun.inf file to trigger recycled.exe from D:.

Separately, we've been testing the Eee Box this week, and discovered our review unit came loaded with the W32/Taterf worm - aka W32.Gammima.AG, aka kavo.exe malware that sniffs out online gaming usernames and passwords.

Fortunately, the infection was spotted and removed by Microsoft's most recent malware removal tool update.

Coincidence? That seems likely, given the different virus and the fact that the disk image used to prepare the Japanese Eee Boxes will almost certainly be different from the one used to image English-language product.

But at this stage it remains unclear whether the infection we found was present from the start, or accidentally added by a previous reviewer.

Trend virus update freezes some PCs

Problems with antivirus updates from Trend Micro left some users with unusable computers late last week.

The signature update, pushed out on Friday morning, incorrectly identified key Windows system files as being infected with a Trojan. The security software quarantined these important files leaving users with unstable systems. Trend later fixed the problem by issuing updated signature definition files that avoided the false positive.

For affected users that was far from the end of their worries. They were still left with the hassle of repairing Windows and (perhaps) reinstalling their security software.

Consumers were hardest hit by the glitch, which affected users of Trend Micro Internet Security, Trend Micro Internet Security Pro and Trend Micro AntiVirus. In an advisory to customers forwarded to The Register, Trend Micro said that a small number of consumers were hit by the snag and explained that the faulty update "inaccurately identified certain files as malicious and quarantined them". It admitted that this might cause system instability.

In response to queries from El Reg, prompted by reader emails, Trend Micro issued a statement:

On 5th September 2008 at 02h00 GMT, a false alarm was triggered in Trend Micro Internet Security caused by a new pattern file that had been issued. Specifically the inclusion of pattern Troj_Generic.ADV issued within Official Pattern Release (OPR) version 5.525.50 quarantined several Microsoft Windows DLLs.

In mitigation we removed the detections in question and at 12h15 GMT on 5th September, OPR 5.527.50 was released that resolved this issue. Customers who downloaded OPR 5.525.50 needed only to update to the latest OPR. All other customers who updated thereafter received the latest OPR.

Oh Lordy it's happened again

Anti-virus updates misidentifying legitimate files as suspect are a well known Achilles' Heel of anti-virus scanner software. Issues crop up periodically at roughly the same frequency Premiership football managers and club chairmen fall out.

The results can be just as ugly.

It's hard to think of a security firm that hasn't had problems in this area, and Trend is no exception. The issue gets far more messy, as in the latest Trend Micro case, when system files are incorrectly flagged up as malware.

Reg reader Antonin, based in France, explained the problem in greater depth.

"Trend Micro release a new signature file which decided that explorer.exe and several other system files had a "Troj Gen Adv" and should be quarantine. After the cleanup, a reboot was advised and after the reboot, chaos started," Antonin explained.

"Logon was OK but there was no taskbar, Trend Micro and several other application would not load automatically, Excel and Word and any other application would start but after clicking [I received] several error messages, services menu was corrupted and windows was very unstable. Restore would not work and install/uninstall would not neither," he added.

Antonin was eventually advised by Trend Micro to repair Windows before uninstall and reinstalling Trend Micro.

The net security firm is continuing to investigate the issue. "To date Trend Micro UK have received thirty-five calls to our technical support teams in relation to this issue and TrendLabs is investigating the incident further to determine root cause and remediate," said Rik Ferguson, senior security advisor at Trend Micro.

Orkut worm feeds on scraps

From social networking to social engineering

Malware authors have written a worm for Orkut, Google-owned networking site that's big in Brazil.

The Scrapkut worm uses active code injection to spread between victims and their friends on Orkut. The malicious code appears on a victim’s scrapbook, containing a link to a supposed YouTube video.

People who click on the link are redirected to an external site hosting malware that's disguised as a Flash upgrade. Users duped into installing the software get malicious Javascript code injected into their next active Orkut web session. This malicious scrapbook entry is then sent to all the victims' friends, recommencing the infection cycle.

An analysis by Symantec can be found here.

Judging by the counter on a web page associated with the malware (not the most reliable of indicators) about 13,000 users are already infected by the Scrapkut worm, which isn't - for now - doing anything particularly nasty other than spreading.

By contrast an earlier worm that spread across the Orkut network last December infected an estimated 655,000 people. Google plugged the cross-site scripting (XSS) error that made the attack possible hours later, thwarting tfurther propagation of that fast-spreading worm.

YouTube fake tool dumbs down malware distribution

Nothing on the internet is real, man

Miscreants have created a tool that dumbs down the process of using fake YouTube websites to spread malware.

The YFakeCreator tool allows budding VXers to set up a fake site and configure options such as the properties of a supposed video. Typically users are required to download a fake codec to view content, which is not actually on offer. The codec contains the malware payload which can be anything from adware to a Trojan.

The tool also includes the ability to set-up a fake error message in a bid to disguise any attack.

Would-be virus writers would still need to mount a spam campaign in order to dupe prospective marks into visiting sites created by YFakeCreator, but the tool does reduce the overall work needed to mount an attack.

The tool was spotted by net security firm Panda Security which has published a full write-up, including screenshots of the tool, here. Panda discovered the tool on underground hacking forums.

YFakeCreator is far from an isolated example of tools that remove the need to understand coding from the task of malware distribution. For example, Panda found a tool that can turn any executable file into a worm on underground forums back in June.

Fake Windows XP Activation Trojan Wants Your CVV2 Code

Fake Windows XP Activation Trojan Wants Your CVV2 Code

In a self-contradicting social engineering attempt, a malware author is offering to sale a (updated version of Kardphisher) DIY fake Windows XP activation builder, which despite the fact that it claims "We will ask for your billing details, but your credit card will NOT be charged", is requesting and remotely uploading all the credit card details required for a successfully credit card theft.

Perhaps among the main reasons why such simplistic social engineering attempts never scaled in a "malicious economies of scale" approach, is because sophisticated crimeware kits capable of obtaining the very same data automatically, started leaking for everyone to start taking advantage of - including yesterday's cybercriminals using such DIY fake message builders.

Moreover, according to recently reseased survey results, end users cannot distinguish between fake popups and real ones, and on their way to continue doing what they were doing, click OK on that pesky warning message telling them that they're about to get infected with malware. Taking into consideration the fact that the popup windows the researchers used look like cheap creative compared to the average fake security software's layout high quality GUIs, it is perhaps worth restating your research questions with something in the lines of - What motivates end users to install an antivirus application going under the name of Super Antivirus 2009 or Mega Virus Cleaner 2008? The fact that the fake status bar is telling them that they're infected with 47 spyware cookies, or the fact that they ended up at the fake site while browsing their trusted web services?

The increase of rogue security software domains is happening due to the high payout affiliation based model, the standardized creative allowing the participants to come up with their own fake names if they want to, and due to the fact that the fake security threats scareware approach seems to be perfectly taking advantage of the overall suspicion on the effectiveness of their legitimate security software.