By silicon.com, 12 January 2004 17:10
NEWS An email disguised as a message from Microsoft's security team contains a dangerous Trojan horse called Xombe.
Xombe, also known as Trojan.Xombe, Downloader-GJ and Troj/Dloader-L, was being distributed on Friday and poses as a critical update for Windows XP. When executed, it attempts to download a malicious backdoor component from the Web.
It appears to be an imitation of one of last year's most successful worms, the mass-mailed Swen, which also masqueraded as a security warning from Microsoft.
However, Xombe has yet to repeat the success of Swen. While the former failed to make the top 10 threats intercepted by email-security firm Messagelabs on Monday morning, Swen was at number two, with some 7,000 instances captured in the past 24 hours.
Ken Dunham, director of malicious code at security company iDefense, said that the success of Swen has encouraged virus writers to create emails and websites that appear official in order to fool more people into executing malicious code.
The email, which appears to have been sent from windowsupdate@microsoft.com, has the subject line "Windows XP Service Pack 1 (Express) - Critical Update" and directs users to execute the attachment, called winxp_sp1.exe, in order to fix some vulnerabilities in Internet Explorer, Outlook and Outlook Express.
Dunham said that once executed, the attachment downloads a file called msvchost.exe that alters the Windows Registry and opens certain ports in order to listen out for commands from a hacker.
Most antivirus companies have already updated their signatures, but users without up-to-date antivirus applications could be infected, helping the Trojan's author to take control of large numbers of PCs. Dunham said that once a "large army of zombie computers" has been built up, attackers could use them for more serious crimes such as ID theft and banking fraud.
Munir Kotadia writes for ZDNet UK
Comments
There are 2 comments. Join the discussion
1. beetle baily
well if hackers actually can build up a group of zombie computers, then blame microsoft and all the money grabbin companies that produce flawed software or hardware, an then not being made to correct said problems, but each year they whine for more money, no wonder , every computer should come with lifetime protection an microsoft an the suppliers of internet connections should be held responsible atleast in part for all the crap on the internet, ip's can be tracked, an if corporation produced a quality computer, properly protected from the start , then it would be much easier to find hackers, or what not, but no,no,no, then these corporations wouldnt be makin large of all they virus software an so on, which in turn comes down to greed, an a government that sides with the corporations, an why, proly cause someone is greesin someone's palm, like usual, money does all the talkin, never , mind good quality, no, your supposed to bleed all these sukers out there into thinkin, ohh gotta have that, viruses are gonna get me, yet most of the software just plain sucks
2. anonymous
What can I do because I received such an update and my anti-virus is unable to remove it although it is updated?