All About Virus News, Updates, etc.

oobi

- tech - Skype warns its users of peer-to-peer worm Jeremy Kirk IDG News Service   Mon Sep 10, 10:00 AM ET   Link to original article Skype users are under attack from a new worm that spreads through the peer-to-peer Internet phone application's chat feature. The attack begins when a user receives an instant message containing a link from someone in their contact list or an unknown Skype user, said Villu Arak, a Skype spokesman based in Tallinn, Estonia. There are several versions of the chat messages, which are "cleverly written" to fool users, Arak wrote on the Skype heartbeat blog. The link appears to contain a JPEG photo file, but if clicked causes the Windows run/save dialog box to appear, which asks whether the user wants to save or run a ".scr" file. The file is malicious software that can then access a user's PC via Skype's API (application programming interface). The malicious file has been named W32/Ramex.A. "Users whose computers are infected with this virus will send a chat message to other Skype users asking them to click on a web link that can infect" their computers, Arak wrote. To avoid trouble, users should not download the file. At least two security vendors, F-Secure Corp. and Kaspersky Lab Ltd., have updated their software to detect the worm, Arak wrote. Instant message programs are another way hackers can try to gain control over PCs. Access to one person's instant messenger or e-mail account can mean contact details for many others, allowing hackers to use malicious e-mails or instant messages to lure victims into downloading malicious software.

[ Last edited by  oobi at 3-10-2007 06:01 AM ]

fly_in_d_sky

nasib baik tak gune skype da ...........

oobi

- online videos could be next virus threat - Report says videos seen as potential means to infect computers as more than 300 gather to discuss upcoming Web security threats. CNNMoney.com October 2 2007: 9:24 AM EDT   Link to original article ATLANTA (AP) -- Online videos aren't just for bloopers and rants - some might also be conduits for malicious code that can infect your computer. As anti-spam technology improves, hackers are finding new vehicles to deliver their malicious code. And some could be embedded in online video players, according to a report on Internet threats released Tuesday by the Georgia Tech Information Security Center as it holds its annual summit. The summit is gathering more than 300 scholars and security experts to discuss emerging threats for 2008 - and their countermeasures. Among their biggest foes are the ever-changing vehicles that hackers use to deliver "malware," which can silently install viruses, probe for confidential info or even hijack a computer. "Just as we see an evolution in messaging, we also see an evolution in threats," said Chris Rouland, the chief technology officer for IBM's (Charts, Fortune 500) Internet Security Systems unit and a member of the group that helped draft the report. "As companies have gotten better blocking e-mails, we see people move to more creative techniques." With computer users getting wiser to e-mail scams, malicious hackers are looking for sneakier ways to spread the codes. Over the past few years, hackers have moved from sending their spam in text-based messages to more devious means, embedding them in images or disguised as Portable Document Format, or PDF, files. "The next logical step seems to be the media players," Rouland said. There have only been a few cases of video-related hacking so far. One worm discovered in November 2006 launches a corrupt Web site without prompting after a user opens a media file in a player. Another program silently installs spyware when a video file is opened. Attackers have also tried to spread fake video links via postings on YouTube. That reflects the lowered guard many computer users would have on such popular forums. "People are accustomed to not clicking on messages from banks, but they all want to see videos from YouTube," Rouland said. Another soft spot involves social networking sites, blogs and wikis. These community-focused sites, which are driving the next generation of Web applications, are also becoming one of the juiciest targets for malicious hackers. Computers surfing the sites silently communicate with a Web application in the background, but hackers sometimes secretly embed malicious code when they edit the open sites, and a Web browser will unknowingly execute the code. These chinks in the armor could let hackers steal private data, hijack Web transactions or spy on users. Tuesday's forum gathers experts from around the globe to "try to get ahead of emerging threats rather than having to chase them," said Mustaque Ahamad, director of the Georgia Tech center. They are expected to discuss new countermeasures, including tighter validation standards and programs that analyze malicious code. Ahamad also hopes the summit will be a launching pad of sorts for an informal network of security-minded programmers.

oobi

- tech - Hacked Antivirus Site Delivers a Virus Robert McMillan IDG News Service   Sat Feb 9, 9:00 AM ET   Link to original article The Web site for Indian antivirus vendor AvSoft Technologies has been hacked and is being used to install malicious software on visitors' computers, security researchers said last week. The download section of AvSoft's S-cop Web site hosts the malicious code, according to Roger Thompson, chief research officer with security vendor AVG. "They let one of their pages get hit by an iFrame injection," he said. "It shows that anyone can be a victim.... It's hard to protect Web servers properly." The technique used on the site has been seen in thousands of similar hacks over the past few months. The attackers open an invisible iFrame Window within the victim's browser, which redirects the client to another server. That server, in turn, launches attack code that attempts to install malicious software on the victim's computer. The malicious software is a variant of the Virut virus family. The iFrame pages are commonly used by Web developers to insert content into their Web pages, but because it is possible to create an invisible iFrame window, the technology is often misused by hackers as a way to silently redirect victims to malicious Web sites. AvSoft, based in New Delhi, sells an antivirus product called SmartCOP and has sold a second antivirus product called Smartdog. The company, which is not well-known in the U.S., also specializes in recovering data lost due to virus attacks. The company could not be reached for comment Thursday afternoon. That data recovery service could come in handy for some, as Virut is known as a "parasitic infector" virus that is extremely difficult to remove. "It infects all of your programs on your local hard drives, and then it starts hitting your network drives as well the first time you run," Thompson said. Fortunately, the malware used to install Virut exploits only well-known bugs, meaning that users who are running antivirus software on fully patched systems will probably not be infected by the attack in its current state, security experts say. Nobody knows how the malware got onto the Web site in the first place. News of the hack was reported on the Full Disclosure security discussion list on Thursday. McAfee Security Research Manager Dave Marcus believes that the site was compromised by exploiting a Web programming error, most likely in the site's SQL or PHP code. Security experts say that criminals have written automated programs that scour the Web for these types of flaws and then automatically infect sites, making this an increasingly common problem.