elgato
Joined: 24 Feb 2005
Posts: 16923
Location: Texas
|
| Posted: Sun Jul 25, 2010 11:47 am Post subject: Windows Vulnerability Targeted by More Malware |
|
|
Security researchers have found more malware exploiting an unpatched Windows vulnerability via .LNK shortcut files.
According to Sophos blog July 23, two other pieces of malware have been observed targeting the bug. One is a keylogging Trojan the company is calling Chymin-A that is "designed to steal information from infected computers." The other is Dulkis-A, a "worm written in obfuscated Visual Basic" that contains several subcomponents.
"First it will self-replicate using the malicious link vulnerability to USB devices detected as TROJ/CPLnk-C," explained Chester Wisniewski, senior security advisor at Sophos. "Then it is packed using the TDSS packer, implying it may contain the ability to infect and hide using the TDSS rootkit. It also appears to drop a very old data-stealing Trojan that was originally designed to steal data about Remote Access or dial-up connection information. I have not had enough time to analyze this piece to see if that is in fact what it still does.
"The other bit that was interesting about the Chymin-A sample was that the shortcut that triggers the infection pointed at a UNC path on a file server on the Internet," Wisniewski added. "This means that anyone blocking outbound File and Print connections (SMB) would not be at risk."
more.. link to news article |
|
