Conficker
also installs fake antivirus software.
April 10, 2009 4:00 PM PDT
Fonte: CNET
News
Tradução
automática para português
Researchers
have discovered another feature of the Conficker
worm that provides an additional clue about the
intent of the creators--the worm installs malware
that masquerades as antivirus software, Trend Micro
said on Friday.
The worm,
which has infected millions of Windows-based computers
on the Internet, is downloading a program called
Spyware Protect 2009 and displaying warning messages
saying that the computer is infected and offering
to clean it up for $49.95, according to the Trend
Micro blog.
The infection
alerts repeatedly appear and experts are worried
that people may be clicking on them and paying for
the software just to be rid of the annoying messages,
thereby handing thieves their credit card information.
The fake
antivirus program also attempts to install a Trojan
downloader that is programmed to download new versions
of Spyware Protect 2009, according to Kasperky
Lab's blog. However, the domain the Trojan downloader
was being accessed from has been shut down, the
blog said.
The fake
antivirus feature further bolsters
the speculation that the motivation behind the worm
is to make money and not a desire to disrupt computer
or network operations.
Researchers
were still analyzing new component code of the worm
that began being spread via peer-to-peer and being
downloaded off domains that host the Waledec worm
on
Wednesday but were finding the task difficult
because the instructions are encrypted.
The worm
spreads via a hole in Windows that Microsoft patched
in October, as well as through removable storage
devices and network shares with weak passwords.
The worm disables security software and blocks access
to security Web sites.
Despite
all the news the worm has made, many computers still
remain unpatched, Sophos said. Of the number of
people who have used Sophos' free endpoint assessment
test to check the security risk of a network since
the beginning of the year, 11 percent did not have
the Microsoft patch installed, according to Graham
Cluley's blog at Sophos.
For the
month of March, 10 percent of all of the people
who used the Sophos assessment tool were missing
the patch, he said. The company did not divulge
exactly how many people had used the tool and Cluley
said the statistics cannot be extrapolated to represent
the number of unpatched systems on the Internet.
In an
indication of infection rates, IBM's Internet Security
Systems group released statistics that show that
the number of unique IPs infected with Conficker.C
is increasing slightly.
Based
on infections seen through monitoring devices in
its IBM ISS' Managed Security Services, the number
has grown from just over 64,000 on April 2 to more
than 71,000 on April 8, according to the unit's
Frequency
X blog.
"We've
seen around 11 percent more unique IPs in the past
few days in comparison to a week ago," the
blog said, also adding that the number doesn't necessarily
indicate the scope of worldwide Conficker infection.
Nearly
60 percent of the infections monitored by IBM ISS
are in Asia, followed by 18 percent each in Europe
and South America, and 4 percent in North America,
the statistics show. By country, China leads with
16.6 percent, followed by Brazil at 10.8 percent,
Russia at 10.2 percent and Korea at 4.6 percent,
according to ISS.
To check
if your computer is infected you can use this Conficker
Eye Chart or this site
at the University of Bonn. There is also a Conficker
removal guide on CNET's Download.com site.
