Panda Software´s Weekly Report on Viruses and Intruders

10/6/2006. - This week’s report from Panda Software once again looks at the numerous variants of Spamta that continue to appear. In addition, PandaLabs reports on other malicious codes including Bck/WebMic.A and Trj/Rizalof.KD.

The creators of Spamta seemingly don’t let up. According to PandaLabs, new variants of this worm are appearing at a rate of about 10 a day. The variants are similar to each other, with the only difference being the message used as bait and in some cases, the message displayed when the worms are run.

According to Luis Corrons, Director of PandaLabs, “this could be a kind of trial, an attempt to find a malicious code able to spread rapidly across as many computers as possible”. Once it has spread, according to Corrons, “the creators could include a new function to make it much more dangerous.”

Next in this week’s report comes the Bck/WebMic.A backdoor Trojan. This malware from Germany opens two ports on infected computers and tries to connect to a server through port 1338. One of the most notable features is its ability to record audio and video on the infected computer, using the internal sound system and the web cam (if installed on the system). In order to do this, it waits for commands from the server it connects to.

In order to go unnoticed, WebMic.A disables the update mechanism of the Avira antivirus, modifying the hosts file on the computer, and disguising its registry entries as “Windows XP Manager”. Its behavior means it can be detected proactively by Panda Software’s TruPrevent™ Technologies.

Finally, PandaLabs has reported the appearance of the Trj/Rizalof.KD Trojan. This malicious code has an IRC client that it uses to connect to a server from which it receives orders to take a series of basic actions, such as downloading and running a file from a URL.

Some versions of the Trojan, the text strings in the executable file are encrypted with a simple algorithm in order to impede detection. However, Panda Software’s TruPrevent™ Technologies can detect this code as malicious without having previously identified it.

For further information about these and other computer threats, visit Panda Software´s Encyclopedia.

About PandaLabs
Since 1990, PandaLabs’ mission has been to analyze new threats as soon as possible to ensure that our clients are safe. Several teams specialized in each specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc.) work 24x7 to offer global coverage. To do this they are supported by TruPrevent™ Technologies, a truly global early warning system made up of sensors that are strategically distributed and neutralize new threats and send them to PandaLabs for in-depth analysis. According to AV-Test.org, PandaLabs is the fastest in the industry to offer complete updates (more information at www.pandasoftware.com/pandalabs.asp).

Oxygen3 24h-365d
by Panda Software

2006-10-07 11:23

Back

IT News: