My Comfort Zone: April 2009

Conficker also installs fake antivirus software
by Elinor Mills

Researchers have discovered another feature of the Conficker worm that provides an additional clue about the intent of the creators--the worm installs malware that masquerades as antivirus software, Trend Micro said on Friday.

The worm, which has infected millions of Windows-based computers on the Internet, is downloading a program called Spyware Protect 2009 and displaying warning messages saying that the computer is infected and offering to clean it up for $49.95, according to the Trend Micro blog.

If you see this pop-up message, chances are your computer is infected with Conficker. The latest feature of the widespread worm is that it installs fake antivirus software on infected machines.
(Credit: Trend Micro)

The infection alerts repeatedly appear and experts are worried that people may be clicking on them and paying for the software just to be rid of the annoying messages, thereby handing thieves their credit card information.

The fake antivirus program also attempts to install a Trojan downloader that is programmed to download new versions of Spyware Protect 2009, according to Kasperky Lab's blog. However, the domain the Trojan downloader was being accessed from has been shut down, the blog said.

The fake antivirus feature further bolsters the speculation that the motivation behind the worm is to make money and not a desire to disrupt computer or network operations.

Researchers were still analyzing new component code of the worm that began being spread via peer-to-peer and being downloaded off domains that host the Waledec worm on Wednesday but were finding the task difficult because the instructions are encrypted.

The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.

Despite all the news the worm has made, many computers still remain unpatched, Sophos said. Of the number of people who have used Sophos' free endpoint assessment test to check the security risk of a network since the beginning of the year, 11 percent did not have the Microsoft patch installed, according to Graham Cluley's blog at Sophos.

For the month of March, 10 percent of all of the people who used the Sophos assessment tool were missing the patch, he said. The company did not divulge exactly how many people had used the tool and Cluley said the statistics cannot be extrapolated to represent the number of unpatched systems on the Internet.

In an indication of infection rates, IBM's Internet Security Systems group released statistics that show that the number of unique IPs infected with Conficker.C is increasing slightly.

Based on infections seen through monitoring devices in its IBM ISS' Managed Security Services, the number has grown from just over 64,000 on April 2 to more than 71,000 on April 8, according to the unit's Frequency X blog.

"We've seen around 11 percent more unique IPs in the past few days in comparison to a week ago," the blog said, also adding that the number doesn't necessarily indicate the scope of worldwide Conficker infection.

Nearly 60 percent of the infections monitored by IBM ISS are in Asia, followed by 18 percent each in Europe and South America, and 4 percent in North America, the statistics show. By country, China leads with 16.6 percent, followed by Brazil at 10.8 percent, Russia at 10.2 percent and Korea at 4.6 percent, according to ISS.

To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn. There is also a Conficker removal guide on CNET's Download.com site.

Credits: Cnet.com

==============================================================================

Analyst's Diary

Bot-watching 2

Aleks

We just described what happens on Kido controlled machines when the spambot Iksmas is installed and launched. However, Kido is also downloading a fake antivirus named SpywareProtect2009. Owners of infected computers can see the effects of the SpywareProtect2009 activity.

This is what happens: the fake antivirus starts to show messages every couple of minutes about purported infections as it supposedly ‘detects’ viruses, network attacks, browser issues and so forth:

This fake AV is so annoying that there is a significant probability that innocent users will click on the offer to pay for disinfection – and thus will be defrauded of almost 50 USD. What is worse, their credit card details might also be harvested – with all sorts of nightmarish results.

In addition to launching numerous messages about infections, SpywareProtect2009 attempts to install a Trjoan-Downloader.Wind32.Fraudload.ecl onto the system. This downloader is programmed to download new versions of SpywareProtect2009. Variant .ecl is downloading these versions from alsterstor.com.

We have notified the registrar of this domain zone and the site was closed down within 20 minutes.

Credits:Analyst Diary of Virustlist.com

Quotes of the Day

We may love the wrong person and cry for the wrong reason ,but no matter how things go wrong, one thing is for sure, mistakes help us find the right person that really meant for us...

Just b/c some 1 hurt u yesterday doesn't mean u should start living life today in constant fear of being hurt tomorrow. Be faithful in small things because it is in them that your strength lies!

Beautiful words said by a man to his lover: "The next girl I'll ever love on this earth will be our daughter".

Forensic Files - Invisible Intruder

Fake AntiVirus

Real Serial Killers#1: Ted Bundy

Forensic Files - Skin Of Her Teeth

Forensic Files - A Bitter Pill To Swallow

Forensic Files:Pinned By The Evidence