Look out for malicious Valentine greetings!
February 14, 2008
A malicious programme that entered Dr.Web malware database as BackDoor.Groan came into existence over a year ago. It was
spread with a spam mailing and constituted 80% of infected mail traffic.
BackDoor.Groan was detected in spam messages throughout 2007 and it looks like its authors want it to move into 2008. The
creators of the malware are constantly changing packers for an executable and apply social engineering techniques to spread
it. Almost every world holiday or tragic event was exploited by a spam mailing from criminals. It should also be mentioned
that after a while when the first variation of the malware appeared the authors changed the method used to spread it: it was
not attached to a mail message any longer but the message provided a link. Following it using the Internet Explorer executed
a downloading script and the backdoor programme got into the system unnoticed.
The St. Valentine's day has also been used by the creators of the programme who distributed a spam mailing with messages
containing Valentine Friends, You are My Valentine, Powerful Love as a subject. A message offered a link to download a
"Valentine greeting" - valentine.exe (included into Dr.Web virus database as Trojan.Packed.357). When launched the programme
installs a driver with a random name (detected by Dr.Web as Trojan.Spambot.2569) and places it to the Windows system
directory along with a P2P configuration file. It places its code to %systemroot%\system32\services.exe and starts sending
requests using random UDP ports. Upon receiving a reply it starts sending out spam.
Users of solutions by Doctor Web, Ltd. don't need to worry about the threat - SpIDerMail anti-spam filter successfully
filters out Trojan.Packed.357 mailings. Dr.Web Mozilla Thunderbird link checker allows checking a page the link points to for
embedded malicious scripts (visit http://www.freedrweb.com for more details about free
link-checker browser plug-in).
However, if you believe that your machine has been infected by Trojan.Packed.357, you can download a free Dr.Web CureIt! utility and use it to scan all your logical disks. Apply the "Cure" option to all
detected objects.
Other news
|
 |
My five cents
|
 |
| |
What is the screen size of your monitor?
|
 |
|
 |
|
 |
|
