Czeska
11-29-2005, 02:13 PM
Rootkit-armed worm attacking AIM
By Gregg Keizer, TechWeb
A worm spreading through America Online's Instant Messenger (AIM) network carries a dangerous rootkit, code designed to hide a hacker's work from anti-virus scanners, a security firm warned Friday.
Sdbot.add, said instant messaging security vendor FaceTime, includes the "lockx.exe" rootkit.
Rootkits are among the most dangerous types of malware, since they hide illegitimate processes and files, and can trick logging functions into not recording malicious activity. And they're becoming more common, say some experts. According to Moscow-based anti-virus developer Kaspersky Labs, the number of worms or Trojan horses equipped with rootkits more than tripled in the first half of 2005.
If the AIM-running machine is infected, Sdbot.add gives the attacker control of the PC, lets him load additional software on it, and tries to disable installed security programs. It may also drop a slew of spyware and adware on the system, including programs from 180Solutions, Zango, and MaxSearch.
Like all IM-based exploits, this worm spreads by hijacking contact names from the AIM buddy list, then sending messages to those people. A link in the message, if clicked, surreptitiously downloads Sdbot.add.
Find article here (http://www.itnews.com.au/newsstory.aspx?CIaNID=20766)
By Gregg Keizer, TechWeb
A worm spreading through America Online's Instant Messenger (AIM) network carries a dangerous rootkit, code designed to hide a hacker's work from anti-virus scanners, a security firm warned Friday.
Sdbot.add, said instant messaging security vendor FaceTime, includes the "lockx.exe" rootkit.
Rootkits are among the most dangerous types of malware, since they hide illegitimate processes and files, and can trick logging functions into not recording malicious activity. And they're becoming more common, say some experts. According to Moscow-based anti-virus developer Kaspersky Labs, the number of worms or Trojan horses equipped with rootkits more than tripled in the first half of 2005.
If the AIM-running machine is infected, Sdbot.add gives the attacker control of the PC, lets him load additional software on it, and tries to disable installed security programs. It may also drop a slew of spyware and adware on the system, including programs from 180Solutions, Zango, and MaxSearch.
Like all IM-based exploits, this worm spreads by hijacking contact names from the AIM buddy list, then sending messages to those people. A link in the message, if clicked, surreptitiously downloads Sdbot.add.
Find article here (http://www.itnews.com.au/newsstory.aspx?CIaNID=20766)