Extremely aggressive worm chokes instant messaging
May 2010
IT in Manufacturing
New variant of Palevo blasts unprotected systems via fake photo gallery links.
The latest offspring of the Palevo family has begun spreading these days via a massive wave of automatically generated IM spam. The unsolicited message incites the recipients to click a link accompanied by a grinning smiley face, which purportedly leads them to an image or photo gallery.
Figure 1. The unsolicited IM spam that brings Palevo
Instead of opening the alleged image collection, the users are tricked into saving what seems to be a .JPG file, which is, in effect, an executable concealing the malicious payload – Worm.P2P.Palevo.DP.
Figure 2. The apparent .JPG is an .EXE file delivering the worm
Having an unprotected system infected with Palevo.DP is a synonym for mayhem. First and foremost, the worm creates several hidden files in the Windows folder: mds.sys, mdt.sys, winbrd.jpg, infocard.exe and modifies some registry keys to point towards these files in order annihilate the OS' firewall.
As its siblings, Palevo.DP holds a backdoor component, which allows remote attackers to seize control over the compromised computer and do whatever they want with it – from installing additional malware and swiping files to launching spam campaigns and malware offensive on other systems.
Palevo family is also able to intercept passwords and other sensitive data entered in Mozilla Firefox and Microsoft Internet Explorer Web browsers, which makes it extremely risky to users relying on e-banking or on-line shopping services.
The spreading mechanism also comprises the infection of network shares and removable USB storage devices, where it creates autorun.inf files pointing to its copy. When the removable disk or memory stick is inserted into machines with the Autorun feature enabled or unprotected by a security solution with on-access scanning capability, the system is automatically infected.
Palevo worms also affect users of the P2P sharing platforms, such as Ares, BearShare, iMesh, Shareza, Kazaa, DC++, eMule and LimeWire, by adding their code to the shared files.
“We recommend users to be extremely cautious and not to click any suspicious links they receive via IM clients before checking with their senders the validity of the Web sites towards which these links point. This Palevo offensive is highly aggressive and during the very beginning of the outbreak we have witnessed rates of infection which easily exceeded 500% growth per hour for countries like Romania, Mongolia or Indonesia”, said Catalin Cosoi, BitDefender senior researcher.
For additional information about e-threats and tools for defending your data and systems check www.malwarecity.com
For more information contact Alina Anton, senior PR & marketing coordinator, EMEA & APAC Business Unit, BitDefender, +40 212 063 470, [email protected], www.bitdefender.com
Further reading:
Unlocking mining efficiency with advanced processing control
IT in Manufacturing
ABB’s Advanced Process Control system, powered by its Expert Optimizer platform, is emerging as a key enabler of smarter, more efficient mining operations.
Read more...
PC-based control regulates innovative dehumidifiers
Beckhoff Automation
IT in Manufacturing
The Swedish company Airwatergreen AB is breaking new ground in the dehumidification of air in industrial buildings and warehouses. PC-based control from Beckhoff regulates the innovative process.
Read more...
Harnessing AI and satellite imagery to estimate water levels in dams
IT in Manufacturing
Farmers and water managers often struggle to accurately estimate and monitor the available water in dams. To address the challenge, International Water Management Institute researchers have worked with Digital Earth Africa to create an innovation that uses satellite images and AI to get timely and accurate dam volume measurements.
Read more...
Why industry should enter the world of operator training simulators
Schneider Electric South Africa
IT in Manufacturing
System-agnostic operator training simulator (OTS) software is a somewhat unsung hero of industry that trains plant operators in a virtual world that mirrors real-world operations. The benefits are multiple.
Read more...
Track busway for scalable data centre power delivery
IT in Manufacturing
The latest generation Legrand Data Centre Track Busway technology addresses the operational pressures facing today’s high-density, AI-intensive computing environments and is being well received by data centre facilities around the world.
Read more...
Poor heat management in data centre design
IT in Manufacturing
Designing a world-class data centre goes beyond simply keeping servers on during load shedding; it is about ensuring they run efficiently, reliably, and within the precise environmental conditions they were built and designed for.
Read more...
It’s time to fight AI with AI in the battle for cyber resilience
IT in Manufacturing
Cybercrime is evolving rapidly, and the nature of cyber threats has shifted dramatically. Attacks are now increasingly powered by AI, accelerating their speed, scale and sophistication. Cybersecurity needs to become part of business-critical strategy, powered by AI to match attackers’ speed with smarter, faster and more adaptive defences.
Read more...
Why AI sustainability must be a boardroom priority
IT in Manufacturing
As South African companies race to harness artificial intelligence for innovation and growth, few are asking the most critical question - the environmental cost.
Read more...
RS South Africa shines spotlight on MRO procurement
RS South Africa
IT in Manufacturing
RS South Africa has highlighted the growing pressures faced by procurement professionals responsible for maintenance, repair and operations supplies across the country’s vital economic sectors.
Read more...
Sustainable energy management
Siemens South Africa
IT in Manufacturing
Utilising its innovative ONE approach technology, Siemens provides complete transparency on resource consumption and offers data-driven optimisation recommendations for sustainable energy management.
Read more...
printer friendly version