Extremely aggressive worm chokes instant messaging
May 2010
IT in Manufacturing
New variant of Palevo blasts unprotected systems via fake photo gallery links.
The latest offspring of the Palevo family has begun spreading these days via a massive wave of automatically generated IM spam. The unsolicited message incites the recipients to click a link accompanied by a grinning smiley face, which purportedly leads them to an image or photo gallery.
Figure 1. The unsolicited IM spam that brings Palevo
Instead of opening the alleged image collection, the users are tricked into saving what seems to be a .JPG file, which is, in effect, an executable concealing the malicious payload – Worm.P2P.Palevo.DP.
Figure 2. The apparent .JPG is an .EXE file delivering the worm
Having an unprotected system infected with Palevo.DP is a synonym for mayhem. First and foremost, the worm creates several hidden files in the Windows folder: mds.sys, mdt.sys, winbrd.jpg, infocard.exe and modifies some registry keys to point towards these files in order annihilate the OS' firewall.
As its siblings, Palevo.DP holds a backdoor component, which allows remote attackers to seize control over the compromised computer and do whatever they want with it – from installing additional malware and swiping files to launching spam campaigns and malware offensive on other systems.
Palevo family is also able to intercept passwords and other sensitive data entered in Mozilla Firefox and Microsoft Internet Explorer Web browsers, which makes it extremely risky to users relying on e-banking or on-line shopping services.
The spreading mechanism also comprises the infection of network shares and removable USB storage devices, where it creates autorun.inf files pointing to its copy. When the removable disk or memory stick is inserted into machines with the Autorun feature enabled or unprotected by a security solution with on-access scanning capability, the system is automatically infected.
Palevo worms also affect users of the P2P sharing platforms, such as Ares, BearShare, iMesh, Shareza, Kazaa, DC++, eMule and LimeWire, by adding their code to the shared files.
“We recommend users to be extremely cautious and not to click any suspicious links they receive via IM clients before checking with their senders the validity of the Web sites towards which these links point. This Palevo offensive is highly aggressive and during the very beginning of the outbreak we have witnessed rates of infection which easily exceeded 500% growth per hour for countries like Romania, Mongolia or Indonesia”, said Catalin Cosoi, BitDefender senior researcher.
For additional information about e-threats and tools for defending your data and systems check www.malwarecity.com
For more information contact Alina Anton, senior PR & marketing coordinator, EMEA & APAC Business Unit, BitDefender, +40 212 063 470, [email protected], www.bitdefender.com
Further reading:
Revolutionising mining operations with MineOptimize
IT in Manufacturing
Now more than ever, mining and mineral processing companies need to boost productivity, ensure safety, and protect the environment. ABB’s comprehensive electrification, automation and digital solutions portfolio is ideally positioned to meet these challenges across all mining processes, from mine to port, transforming performance in a digital world.
Read more...
Buildings in Africa’s urban evolution
Schneider Electric South Africa
IT in Manufacturing
Africa is now an urban continent. How does the continent mobilise to accommodate urban dwellers and maintain and implement critical infrastructure that allows for this expansion? Building management systems provide a tangible solution to optimise resource use, lower operations costs and ultimately contribute to a growing continent that also employs green practices.
Read more...
TwinCAT Vision functionality extended
Beckhoff Automation
IT in Manufacturing
The image processing and camera integration capabilities of Beckhoff’s TwinCAT 3 Vision software have been expanded.
Read more...
Automation software to future-proof your operations
Adroit Technologies
IT in Manufacturing
As the official partner of Mitsubishi Electric Factory Automation, Adroit Technologies empowers businesses with cutting-edge solutions that reduce costs, improve quality and increase productivity.
Read more...
Siemens automation portfolio, your bridge to the industrial metaverse
Siemens South Africa
IT in Manufacturing
Step into the future with Siemens’ automation portfolio, your bridge to the industrial metaverse. Our cutting-edge solutions integrate AI, digital twins and real-time simulation, driving smarter, more efficient production.
Read more...
Transform your manufacturing efficiency
TransLution Software
IT in Manufacturing
MÄDLER offers a wide range of gears in various materials, modules and designs, available directly from stock.
Read more...
Optimise the cutting of metal materials
IT in Manufacturing
KRON Cutting is a comprehensive web-based system designed to optimise the cutting of metal materials, including rebar, pipes and profiles.
Read more...
Black Rock Mining centralises mining operations with AVEVA
IT in Manufacturing
Black Rock Mine Operations replaced and upgraded its existing infrastructure, and installed additional capacity to expand production from 3 to 4,6 million tons in three years. The new system is powered by a suite of AVEVA solutions.
Read more...
The strategic role of technology in today’s economy
IT in Manufacturing
In an era of economic uncertainty and persistent market volatility, businesses are under immense pressure to manage costs while maintaining operational effectiveness. The role of chief information officers and chief technology officers has never been more critical, as they are tasked with leveraging technology not just as a tool for efficiency but as a strategic asset in navigating these turbulent times.
Read more...
Minutes to meltdown: surviving a cyber attack
IT in Manufacturing
Commvault recently hosted its Minutes to Meltdown event. Led by the company’s security experts, this was an interactive and detailed ransomware attack simulation designed to help companies understand how to respond in the event of a cyber attack.
Read more...
printer friendly version