Extremely aggressive worm chokes instant messaging
May 2010
IT in Manufacturing
New variant of Palevo blasts unprotected systems via fake photo gallery links.
The latest offspring of the Palevo family has begun spreading these days via a massive wave of automatically generated IM spam. The unsolicited message incites the recipients to click a link accompanied by a grinning smiley face, which purportedly leads them to an image or photo gallery.
Figure 1. The unsolicited IM spam that brings Palevo
Instead of opening the alleged image collection, the users are tricked into saving what seems to be a .JPG file, which is, in effect, an executable concealing the malicious payload – Worm.P2P.Palevo.DP.
Figure 2. The apparent .JPG is an .EXE file delivering the worm
Having an unprotected system infected with Palevo.DP is a synonym for mayhem. First and foremost, the worm creates several hidden files in the Windows folder: mds.sys, mdt.sys, winbrd.jpg, infocard.exe and modifies some registry keys to point towards these files in order annihilate the OS' firewall.
As its siblings, Palevo.DP holds a backdoor component, which allows remote attackers to seize control over the compromised computer and do whatever they want with it – from installing additional malware and swiping files to launching spam campaigns and malware offensive on other systems.
Palevo family is also able to intercept passwords and other sensitive data entered in Mozilla Firefox and Microsoft Internet Explorer Web browsers, which makes it extremely risky to users relying on e-banking or on-line shopping services.
The spreading mechanism also comprises the infection of network shares and removable USB storage devices, where it creates autorun.inf files pointing to its copy. When the removable disk or memory stick is inserted into machines with the Autorun feature enabled or unprotected by a security solution with on-access scanning capability, the system is automatically infected.
Palevo worms also affect users of the P2P sharing platforms, such as Ares, BearShare, iMesh, Shareza, Kazaa, DC++, eMule and LimeWire, by adding their code to the shared files.
“We recommend users to be extremely cautious and not to click any suspicious links they receive via IM clients before checking with their senders the validity of the Web sites towards which these links point. This Palevo offensive is highly aggressive and during the very beginning of the outbreak we have witnessed rates of infection which easily exceeded 500% growth per hour for countries like Romania, Mongolia or Indonesia”, said Catalin Cosoi, BitDefender senior researcher.
For additional information about e-threats and tools for defending your data and systems check www.malwarecity.com
For more information contact Alina Anton, senior PR & marketing coordinator, EMEA & APAC Business Unit, BitDefender, +40 212 063 470, [email protected], www.bitdefender.com
Further reading:
Enhancing cyber security for industrial drives
Siemens South Africa
IT in Manufacturing
The growing connection between production networks and office networks as part of IT/OT integration and the utilisation of IoT have many benefits for industrial companies. At the same time, they also increase the risk of cyber threats. Siemens ensures that your know-how and plants are protected at all times.
Read more...
Immersion cooling systems for data centres
IT in Manufacturing
The demand for data centres in Africa is growing. The related need for increasing rack densities brings with it escalating cooling requirements.
Read more...
Transforming pulp and paper with automation and digitalisation
ABB South Africa
IT in Manufacturing
The pulp and paper industry in South Africa is undergoing a significant transformation from traditional manual processes to embracing automation technologies. Automation in pulp and paper mills aims to improve various production stages, from raw material preparation to final product creation.
Read more...
New world of process control: A completely web-based process control system
Siemens South Africa
IT in Manufacturing
Control technology is crucial for gaining a competitive edge in the process industry. That’s why there’s SIMATIC PCS neo - the innovative ground-breaking process control system by Siemens.
Read more...
Protecting industrial networks with resilient defence
RJ Connect
IT in Manufacturing
Network security is no longer just about preventing hacking or data breaches. For operational technology networks, resilient defence and consistent uptime are crucial. They are the core tenets that underpin Moxa’s guarded uptime and resilient defence (GUARD).
Read more...
The metaverse is now: are you ready to reimagine your business?
IT in Manufacturing
The convergence of the digital and physical worlds, driven by spatial computing and the metaverse, is rapidly reshaping business landscapes. This transformation extends beyond the mere novelty of virtual reality headsets and augmented reality filters, signalling a fundamental shift in how organisations operate, collaborate and innovate.
Read more...
AI and cyber security: South Africa’s next battleground
IT in Manufacturing
Artificial intelligence is rapidly becoming a double-edged sword in the world of cybersecurity. In South Africa, where cybercrime is on the rise, AI presents both an opportunity and a threat.Artificial intelligence is rapidly becoming a double-edged sword in the world of cybersecurity. In South Africa, where cybercrime is on the rise, AI presents both an opportunity and a threat.
Read more...
Technology won’t save your business from cyber threats
IT in Manufacturing
Artificial Intelligence is reshaping the landscape of information security, presenting both unprecedented opportunities and significant new threats.
Read more...
Addressing the cooling needs of the modern data centre
Schneider Electric South Africa
IT in Manufacturing
The rise in hardware density in data centres is gaining speed and is largely driven by the demands of artificial intelligence and machine learning, requiring more powerful servers and specialised hardware.
Read more...
South Africa’s next cyber security frontier
IT in Manufacturing
AI-powered agents are rapidly transforming how South African businesses operate, from chatbots managing customer inquiries to automated systems processing financial transactions. While these AI-driven assistants increase efficiency and reduce operational costs, they also present a new, and often underestimated, cybersecurity challenge: identity management.
Read more...
printer friendly version