Spybot.AKB worm spreads across P2P networks and e-mail
PandaLabs detected a new worm, Spybot.AKB, which spreads using P2P programs (copying itself to the usual shared folders with different names) and also via e-mail.
What’s new about this worm is the way it tricks users, spreading under the guise of an invitation to join social networks like Twitter and Hi5, or in an e-mail supposedly from Google replying to a job application. Another new feature is the way it installs on computers, passing itself off as a Firefox security extension.
Email subjects include:
- Jessica would like to be your friend on hi5!
- You have received A Hallmark E-Card!
- Shipping update for your Amazon.com order 254-71546325-658732
- Thank you from Google!
- Your friend invited you to twitter!
Once installed, the worm redirects browsers to different websites if the user launches a search with any of the following words:
A: Airlines, Amazon, Antivir, Antivirus.
B: Baseball, Books.
C: Casino, Chrome, Cialis, Cigarettes, Comcast, Craigslist, Credit.
D: Dating, Design, Doctor.
E: Explorer
F: Fashion, Finance, Firefox, Flifhts, Flower, Football
G: Gambling, Gifts, Graphic.
H: Health, Hotel.
I: Insurance, Iphone.
L: Loans.
M: Medical, Military, Mobile, Money, Mortgage, Movie, Music, Myspace.
O: Opera.
P: Pharma, Pocker.
S: School, Software, Sport, Spybot, Spyware.
T: Trading, Tramadol, Travel, Twitter.
V: Verizon, Video, Virus, Vocations.
W: Wallpaper, Weather.
It also takes a series of actions to compromise the security level of infected computers, adding itself to the Windows firewall list of authorized applications, and disabling the Windows Error Reporting service and the User Access Control (UAC).