Conficker also Installs Fake Antivirus software

Discussion in 'DSL & Info Tech News' started by JamesCooper, Apr 13, 2009.

  1. JamesCooper

    JamesCooper Member

    Conficker also installs fake antivirus software
    by Elinor Mills, cnet news, April 10, 2009

    Researchers have discovered another feature of the Conficker worm that provides an additional clue about the intent of the creators--the worm installs malware that masquerades as antivirus software, Trend Micro said on Friday (April 10, 2009).

    The worm, which has infected millions of Windows-based computers on the Internet, is downloading a program called Spyware Protect 2009 and displaying warning messages saying that the computer is infected and offering to clean it up for $49.95, according to the Trend Micro blog.


    If you see this pop-up message, chances are your computer is infected with Conficker. The latest feature of the widespread worm is that it installs fake antivirus software on infected machines. (Credit: Trend Micro)

    The infection alerts repeatedly appear and experts are worried that people may be clicking on them and paying for the software just to be rid of the annoying messages, thereby handing thieves their credit card information.

    The fake antivirus program also attempts to install a Trojan downloader that is programmed to download new versions of Spyware Protect 2009, according to Kasperky Lab's blog. However, the domain the Trojan downloader was being accessed from has been shut down, the blog said.

    The fake antivirus feature further bolsters the speculation that the motivation behind the worm is to make money and not a desire to disrupt computer or network operations.

    Researchers were still analyzing new component code of the worm that began being spread via peer-to-peer and being downloaded off domains that host the Waledec worm on Wednesday but were finding the task difficult because the instructions are encrypted.

    The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.

    Despite all the news the worm has made, many computers still remain unpatched, Sophos said. Of the number of people who have used Sophos' free endpoint assessment test to check the security risk of a network since the beginning of the year, 11 percent did not have the Microsoft patch installed, according to Graham Cluley's blog at Sophos.

    For the month of March, 10 percent of all of the people who used the Sophos assessment tool were missing the patch, he said. The company did not divulge exactly how many people had used the tool and Cluley said the statistics cannot be extrapolated to represent the number of unpatched systems on the Internet.

    In an indication of infection rates, IBM's Internet Security Systems group released statistics that show that the number of unique IPs infected with Conficker.C is increasing slightly.

    Based on infections seen through monitoring devices in its IBM ISS' Managed Security Services, the number has grown from just over 64,000 on April 2 to more than 71,000 on April 8, according to the unit's Frequency X blog.

    "We've seen around 11 percent more unique IPs in the past few days in comparison to a week ago," the blog said, also adding that the number doesn't necessarily indicate the scope of worldwide Conficker infection.

    Nearly 60 percent of the infections monitored by IBM ISS are in Asia, followed by 18 percent each in Europe and South America, and 4 percent in North America, the statistics show. By country, China leads with 16.6 percent, followed by Brazil at 10.8 percent, Russia at 10.2 percent and Korea at 4.6 percent, according to ISS.

    To check if your computer is infected you can use this

    Conficker Eye Chart: ... chart.html
    or this site at the University of Bonn: ... fdetector/

    There is also a Conficker removal guide on CNET's site. : ... =mncol;txt
  2. kwiki

    kwiki Member

    Thanks for the update bro!
  3. Warlock1981

    Warlock1981 Member

    it happend to me before, ginawa ko is end process lang ng browser na ginamit ko, tpos scan ang drive c and drive d, ok na. :)
  4. Abrinor

    Abrinor Member

    Add ko lng po. Kaya po nkapag install sya ng fake anti virus reason is kahit nka open ang firewall mo assuming you are using default windows firewall. Npapasok nya po un nagaadd sya ng sariling firewall exception. Look mo po ung firewall exception then look for something suspicious in my case i found
    " gsdfdsjyt " too obvious. Remove po para mblock. Pero siempre po mas importante na mremove ung virus,worm.

  5. Handy Cafe

    Mga kapatid bago po ako sa inyo ... may ask lang po ako bout sa handy cafe , automatic po ba siya na nag cocompute ng charge ng costumer per client , kasi 10.00 ako half hour , pero anh 1hr me 15.00 lang pano po ba iconfgure un sa handycafe ..bago lang po kasi akong gagamit nun sa matulungan nio po ako kung sino pa ang nakakaalam .....
    maraming salamat po and more power ....



Share This Page