An updated version of the Conficker worm is installing malware that attempts to lure people into buying rogue anti-virus software. Security researchers also say the worm is downloading malware tied to the notorious Waledac botnet.
may be tied to a scheme to lure users into downloading fake
Security researchers monitoring
the Conficker worm's activities
say the malware has been observed
downloading a file detected by Kaspersky Lab
"Once it's run, you see the app interface, which naturally asks if you
want to remove the threats it's 'detected,'" wrote Aleks Gostev on Kaspersky Lab's
blog. "Of course, this service comes at a price-$49.95."
In addition to that file, the worm is also now downloading
the Waledac malware,
which steals passwords and turns computers into bots
for spamming operations. Waledac has emerged as a key part of spamming
operations over the past several months, and is widely considered a
reincarnation of the infamous Storm botnet.
Tricking users into installing rogue software isn't new for the worm, which
tried the same thing when it first appeared in 2008. The move also
represents another example of attackers cashing in on rogueware. Finjan
recently issued a report about a rogueware
that pulled in an average of $10,800 a day. According to
Microsoft's latest Security Intelligence Report, two rogue families,
Win32/FakeXPA and Win32/FakeSecSen, were detected on more than 1.5 million
computers by Microsoft software.
"Fear is used, universally, as a means to control people," said
Sendio CTO Tal Golan. "Governments
use it. Large businesses use it. So it should come as no surprise to anyone
that 'cyber-bad guys' use it."
At the moment, the rogue anti-virus software comes from sites located in the
(131-3.elaninet.com.188.8.131.52) although the worm is downloading it from other
sites, according to Kaspersky Lab.
There are numerous tools
for disinfecting systems hit by Conficker,
some of which are linked to
here. The worm spreads by exploiting a patched Microsoft vulnerability as well
as via network shares by logging in to machines with weak passwords. It also
spreads through removable media. Network administrators are advised to deploy
if they have not already done so, as well as to follow best
practices regarding passwords.