PUPs: a growing threat according to data from Infected or Not

9/28/2007. - PUPs (Potentially Unwanted Programs) are becoming an increasing threat according to data compiled from the Infected or Not website. This week, the five malicious codes most frequently detected by NanoScan and TotalScan (Panda’s online tools available on this website) were PUPs.

PUPs are programs installed without the user’s consent and, due to their characteristics, can affect the user’s control over their privacy, confidentiality, computer resource usage, etc.

“The growth of PUPs is due largely to the fact that they are often installed by other malicious code, such as Trojans or adware. In these cases, they often act as complements to the malware by terminating the processes of security solutions or displaying pop-up ads”, explains Luis Corrons, Technical Director of PandaLabs.

Position	Type	Name
1	PUP	MyWebSearch
2	PUP	FunWeb
3	PUP	Processor
4	PUP	HideWindow.S
5	PUP	KillApp.B
6	Worm	Bagle.HX
7	Hacking Tool	KillProcWin.A
8	PUP	Winfixer2005
9	Adware	Processor
10	Adware	HideWindow.S

Of the malicious codes that appeared this week, PandaLabs’ weekly report looks at the AttachMsngr.G and MakeSnake.A Trojans and the Brocat.B worm.

AttachMsngr.G is a Trojan designed to steal Messenger passwords and communications. It does this by capturing keystrokes and mouse actions. It also creates a key in the Windows registry to ensure it is run every time the system is started up. When it is activated, it displays an error message with the MSN Messenger header.

The MakeSnake.A Trojan takes a series of annoying actions. It displays a screen with the text: “WE NEED A DRINK!! PLEASE, HELP US, UGLY FACE”. Then a new text (“Aza l vina io souris io e!”) follows the mouse pointer like a snake all over the screen. This Trojan creates and modifies several Windows registry entries, allowing it, for example, to run every time the system is restarted and hide the search option in the Start menu.

Brocat.B is a worm that reaches computers with a heart-shaped icon called Love is Cinta, the title of an Indonesian movie. Went run, it sporadically shows the dialog box that typically appears on closing a session.

To spread, this worm makes copies of itself in several places on the computer and in such a way that it can affect all system users. It also creates a file called autorun.inf on all the computer’s drives, so the worm runs whenever users access any drive.

This week, PandaLabs has also published a complete analysis of Traffic Pro, a tool that uses exploits to install malware on computers. Users can read it at: http://pandalabs.pandasecurity.com/archive/Kits-for-installing-malware-_2D002D003E00_-Traffic-Pro.aspx?sitepanda=particulares

For more information about these and other computer threats, visit Panda Security´s Encyclopedia.

Oxygen3 24h-365d
by Panda Software

2007-10-02 14:01

Back

IT News: