Internet worm exploits Windows vulnerability

A worm dubbed Win32/Conficker.A is making the rounds on Windows machines, exploiting a security hole that Microsoft released a patch for in October, Microsoft said on Wednesday.

The number of attacks have increased over the past couple of days, exploiting a critical vulnerability that was addressed by security update MS08-067.

The malware mostly was spreading inside corporations, but also hit several hundred home PCs, Microsoft said in a posting on the Microsoft Malware Protection Center Blog.

"It opens a random port between port 1024 and 10000 and acts like a Web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP using the random port opened by the worm. The worm often uses a .JPG extension when copied over and then it is saved to the local system folder as a random named dll," the posting said.

"It is also interesting to note that the worm patches the vulnerable API in memory so the machine will not be vulnerable anymore. It is not that the malware authors care so much about the computer as they want to make sure that other malware will not take it over too," Microsoft said.

Most of the infections are in U.S. PCs, but there have been reports from Germany, Spain, France, Italy, Taiwan, Japan, Brazil, Turkey, China, Mexico, Canada, Argentina, and Chile. The worm avoids infecting Ukrainian computers, for some reason, Microsoft said.

Several bots, under the generic name Backdoor:Win32/IRCbot.BH, also are exploiting the security hole. They drop a backdoor Trojan that connects to an IRC server to receive commands.

Resource - C|Net

Virus Alert: ASUS Recalls Eee Box PCs In Japan

Taiwan's ASUSTek Computer has announced a recall of its Eee Box PCs that were sold in Japan because they contain a virus.

The virus, known as recycled.exe, resides on the D drive of the machine and once opened, the virus will be activated and copy itself to the C drive as well as any other removable or USB drives. Affected by the virus, the running of the computer will become slow and it may download harmful malware programs from the Internet.

Li Yusheng, a representative from ASUS's public relations department, says that the virus entered the computers while they were downloading the Japanese version software to the computer. However, the anti-virus protections on Asus' other production lines are free from the bug and the software of Eee Box products sold to other countries are reportedly safe.

Li emphasizes that the build-in virus in Eee Box sold to Japan is an accident. The computer company has announced a recall of all these suspected Eee Box products and will impose stricter measures on production line management and software protection.

With a total shipment of 4,500, only about 300 Eee Box PCs have been sold in the Japanese market.

Resource - China Tech News