Fake Conflicker.B Infection Alert puts internet users at risk

The global network of spamtraps controlled by the experts inside SophosLabs are seeing a swarm of attacks today, posing as an email warning about the Conficker worm.

 

Here is a typical message that has been spammed out by hackers:

Subject: Conflicker.B Infection Alert
Attached file: open.zip

 

Message body:

 

Dear Microsoft Customer,

Starting 12/11/2009 the ‘Conficker’ worm began infecting Microsoft customers unusually rapidly. Microsoft has been advised by your Internet provider that your network is infected.

To counteract further spread we advise removing the infection using an antispyware program. We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus.

Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.

Regards,
Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division

 

Opening the file attached to the email (in this case it’s called open.zip) infects your computer with malware which Sophos detects as Mal/EncPk-KW.

 

The wording is nearly identical to a similar attack I blogged about last October.

 

What surprises me is that during the last few months the hackers behind the attack appear to have made no effort to fix mistakes in their disguise – for instance, it should say Conficker in the subject line not Conflicker!

 

I can only presume that they’re counting on their potential victims not spotting that typo. It certainly has not stopped the cybercriminals from sending out the infected messages en masse today. Presently this malicious spam campaign is one of the most commonly seen examples of file attachment malware being spread around the world:

 

By Graham Cluley, Sophos

 

Kaspersky Lab detects new version of Conficker worm (Net-Worm.Win32.Kido.js)

Kaspersky Lab, a leading developer of secure content management solutions, announces that a new version of the malicious program Kido (aka Conficker and Downadup) has been detected.

 

Read more

New IE bug is Conficker 2

The latest bug in Internet Explorer could create a security issue on the same scale as Conficker, says a research at AVG.

 

“It’s better than [the vulnerability used by] Conficker,” Roger Thompson, chief research officer at AVG, said.

 

“It exposes the whole world, and can be exploited through the firewall. That’s better than Conficker, which mostly did its damage once it got inside a network.”

 

Conficker, the worm that exploded into prominence in January when it infected millions of machines, exploiting an already-patched bug in Windows that Microsoft had thought dire enough to fix outside its usual update schedule.

 

The worm hijacked a large number of PCs – estimates ranged as high as 12 million at one point – and then assembled them into a massive botnet able to spread malware, plant fake antivirus software or distribute huge amounts of spam.

 

“I have no doubt that the really bad guys are bustling to get this [new vulnerability] into their exploit toolkits,” said Thompson.

 

“For the Conficker people, this could be the next thing. They waited until they had a really good exploit, then combined that with some smart strategies. So I wouldn’t be surprised if they picked up on this.”

 

The vulnerability Thompson’s worried about is in the Microsoft Video Controller ActiveX Library, or the ‘msvidctl.dll’ file, an ActiveX control that can be accessed using Internet Explorer (IE).

 

Although the bug has been used by hackers since at least June 9, it only made it into the public eye this week, when several security companies, including firms in both China and Denmark, reported that thousands of compromised sites were serving up exploits.

 

Microsoft acknowledged the vulnerability in a security advisory this week and said it would produce a patch and provided an automated tool to disable the ActiveX control by setting nearly three-dozen “kill bits” in the Windows registry.

 

“This is a good exploit with a big lump of infectable people,” said Thompson.

 

One reason why the bug is an excellent choice for hackers is that it hasn’t been patched. When Conficker first appeared, the flaw it exploited had already been patched by Microsoft. It turned out, however, that there were plenty of PCs that had not been updated with the fix.

 

Thompson wouldn’t hazard a guess as to whether Microsoft would be able to craft a fix in time to add it to the patches slated for delivery next Tuesday, July’s regularly-scheduled update day. “But I’m fairly confident that they’re trying very hard,” he said.

 

Attack code is readily available, Thompson said, meaning that attackers not yet abusing the bug don’t have to figure out an exploit of their own. “If the people who infect banner ads use this before there’s a patch, then watch out,” he warned.

 

Today, Microsoft admitted that researchers at IBM’s ISS X-Force had reported the vulnerability in 2008, but did not name the date.

 

“It’s not the end of the world or anything,” said Thompson. “But I won’t be surprised to see Version 2.0 of Conficker with this. It seems custom-made for them.”

 

Systems running Windows XP or Windows Server 2003 are vulnerable to current attacks through IE6 and IE7. Windows Vista and Windows 7 are not at risk; nor are users running IE8 or other browsers, such as Mozilla’s Firefox and Google’s Chrome.

SOURCE:  pcadvisor

Three Months Later: Where’s DOWNAD?

Exactly three months ago, the whole IT sector was waiting with bated breath for April 1. The latest DOWNAD/Conficker variant–WORM_DOWNAD.KK–was poised to strike. We know that on that day, it would attempt to access 500 of 50,000 websites and download new malicious files. This led to fears–somewhat misplaced–that new, possibly damaging payloads could cause severe problems, not just for systems already affected by DOWNAD but the Internet as a whole. Many sectors assumed the worst.

Read more

Experts: Gumblar attack is alive, worse than Conficker

Gumblar, a new attack that compromises Web sites, has added new domain names that are downloading malware onto unsuspecting computers, stealing FTP credentials to compromise more sites, and tampering with Web traffic, a security firm said on Thursday.

Read more

Conficker virus begins to attack PCs: experts

BOSTON (Reuters) –

A malicious software program known as Conficker that many feared would wreak havoc on April 1 is slowly being activated, weeks after being dismissed as a false alarm, security experts said.

Conficker, also known as Downadup or Kido, is quietly turning thousands of personal computers into servers of e-mail spam and installing spyware, they said.

Read more

How To Remove Conficker Worm And Protect Yourself Step By Step With VirusExperts.org Removal Package

There is a lot of tools that can remove Conficker worm but when conficker changed to more than one version A,B,C and E, some of tools not effected so we collected the best tools to remove and protect from conficker worm.

Read more

Case Conficker ( Know More About Conficker,Downadup,Downup and Kido Worm ) (Video)

Case Conficker / Downadup / Downup / Kido
Mikko Hypponen & Patrik Runald
F-Secure Corporation

Species Conference
February 2, 2009
Amsterdam

Conficker Eye Chart (Conficker Infection Test)

This way let you know if your PC infected with Conficker worm (A,b,C…etc)

Read more

Conficker and April 1st (Podcast)

Sean Richmond of Sophos Australia talks to Paul Ducklin about the first of April Conficker security panic

Download

Next Page »