Agressive worm infection leads to banking Trojan infection
Posted on 30.11.2012
Bookmark and Share
An aggressive variant of the VBNA-X "autorun" worm is finding its way onto users' computers, preparing them for further malicious downloads, warns Sophos.

"W32/VBNA-X is a worm, but also exhibits characteristics typically found in a Trojan. Its most obvious method of spreading appears to be through the use of autorun.inf files dropped on removable media and writable network shares," shares Chester Wisniewski.

Still, there are many who have already disable the Autorun/Autoplay option, but still get infected, as the worm hides legitimate folders and file extensions, and creates copies of itself named Porn.exe, Sexy.exe, Passwords.exe and Secret.exe and uses standard Windows 7 icons for them:


"I can easily see how people browsing file shares and USB drives could accidentally click the wrong folder, especially if the real folders are set to hidden," Wisniewski points out.

The worm is capable of adding registry keys to make itself run every time the infected machine boots up, and some variants can also disable Windows Update.

This new variant contacts a C&C server to receive instructions and downloads additional malicious payloads. In the instances investigated by Sophos, that payload was a Zeus Trojan variant - but that can change in the future.






Spotlight

Nearly 70% of critical infrastructure providers suffered a breach

Posted on 10 July 2014.  |  Nearly 70% of companies that are responsible for the world's power, water and other critical functions have reported at least one security breach that led to the loss of confidential information or disruption of operations in the past 12 months.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Jul 11th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //