Sunday, February 17, 2008

Virus from China the gift that keeps on giving

Virus from China the gift that keeps on giving
Deborah Gage, Chronicle Staff Writer

Friday, February 15, 2008

An insidious computer virus recently discovered on digital photo frames has been identified as a powerful new Trojan Horse from China that collects passwords for online games - and its designers might have larger targets in mind.

"It is a nasty worm that has a great deal of intelligence," said Brian Grayek, who heads product development at Computer Associates, a security vendor that analyzed the Trojan Horse.

The virus, which Computer Associates calls Mocmex, recognizes and blocks antivirus protection from more than 100 security vendors, as well as the security and firewall built into Microsoft Windows. It downloads files from remote locations and hides files, which it names randomly, on any PC it infects, making itself very difficult to remove. It spreads by hiding itself on photo frames and any other portable storage device that happens to be plugged into an infected PC.

The authors of the new Trojan Horse are well-funded professionals whose malware has "specific designs to capture something and not leave traces," Grayek said. "This would be a nuclear bomb" of malware.

By studying how the code is constructed and how it's propagated, Computer Associates has traced the Trojan to a specific group in China, Grayek said. He would not name the group.

The strength of the malware shows how skilled hackers have become and how serious they are about targeting digital devices, which provide a new frontier for stealing information from vast numbers of unwary PC owners. More than 2.26 million digital frames were sold in 2007, according to the Consumer Electronics Association, and it expects sales to grow to 3.26 million in 2008.

The new Trojan also has been spotted in Singapore and the Russian Federation and has 67,500 variants, according to Prevx, a security vendor headquartered in England.

Grayek said Mocmex might be a test for some bigger attack, because it's designed to capture any personal, private or financial information, yet so far it's only stealing passwords for online games.

"If I send you a package but it doesn't explode, why did I send it?" he said. "Maybe I want to see if I can get it out to you and how you open it."

The initial reports of infected frames came from people who had bought them over the holidays from Sam's Club and Best Buy. New reports involve frames sold at Target and Costco, according to SANS, a group of security researchers in Bethesda, Md., who began asking for accounts of infected devices on Christmas Day. So far the group has collected more than a dozen complaints from people across the country.

The new Trojan isn't the only piece of malware involved. Deborah Hale of Sans said the researchers also found four other, older Trojans on each frame, which may serve as markers for botnets - networks of infected PCs that are remotely controlled by hackers.

There is W32.Rajump, which deposits the same piece of malware that infected some of Apple's video iPods during manufacturing in October 2006. It gathers Internet Protocol addresses and port numbers from infected PCs and ships them out, according to Symantec. One destination is registered to a service in China that allows people to conceal their own IP addresses.

Then there is a generic Trojan; a Trojan that opens a back door on PCs and displays pop-up ads; and a Trojan that spreads itself through portable devices like Mocmex does.

How all this malware got onto the photo frames and what it's doing there is unclear. Trojans can download other Trojans, which is part of how botnets are controlled.

While SANS is investigating the infections, the retailers are saying little.

Sam's Club said it has found no infected frames, and its distributor, Advanced Design Systems, did not return calls seeking comment.

A few Target customers complained about frames distributed by Uniek, a store spokesman confirmed. Target is no longer selling those frames, but that's because the frames didn't sell well over the holidays, he said. Target has found no infections, he said, but is watching for them.

Best Buy said one line of its Insignia frames - also now discontinued - was infected during manufacturing but would not provide details.

Costco did not return calls seeking comment.

How to avoid problems
Protecting against these new computer viruses, which so far are aimed at PCs running Windows, is hard - and sometimes impossible.

Updated antivirus software works unless the malware writers get ahead of the antivirus vendors, which is what happened with the new Trojan. Computer Associates, for example, just began protecting against it last week.

While some advise disabling Autorun in Windows, which allows devices to run automatically when they're plugged into a USB port, it's not a failsafe. Doing so requires some computer expertise, and this Trojan re-enables Autorun if it's turned off, according to Brian Grayek of Computer Associates. "If you plug in (the frame), you're already infected," he said.

Deborah Hale at SANS suggested that PC users find friends with Macintosh or Linux machines and have them check for malware before plugging any device into a PC.

She also recommended backing up data with an online service such as that offers free backup for home users with less than 2 gigabytes of data. But it does not back up the operating system, she warned. If you're attacked and your PC fails, you'll have to reformat and reload all of the programs.

If you think bought an infected device, e-mail SANS at and call your retailer.

-- Best Buy: (877) 467-4289

-- Sam's Club: (888) 746-7726

-- Target: (800) 591-3869

-- Costco: (800) 955-2292

E-mail Deborah Gage at

This article appeared on page C - 1 of the San Francisco Chronicle

© 2008 Hearst Communications Inc


Anonymous オテモヤン said...


Thu Feb 11, 03:08:00 PM EST  
Anonymous Anonymous said...

I'm sure the best for you [URL=]louis vuitton outlet[/URL] online kGtafuFz [URL= ] [/URL]

Mon Nov 12, 04:12:00 PM EST  
Anonymous Anonymous said...

I really like it when people come together and share views.
Great blog, keep it up!
My website: how to play piano

Tue Nov 27, 06:40:00 PM EST  
Anonymous Anonymous said...

I want to to thank you for this wonderful read!! I absolutely enjoyed every little
bit of it. I've got you book marked to look at new stuff you post…
Also visit my web site : where to download movies

Sat Dec 01, 05:07:00 AM EST  
Anonymous Anonymous said...

Sweet blog! I found it while surfing around on Yahoo
News. Do you have any suggestions on how to get listed in Yahoo News?
I've been trying for a while but I never seem to get there! Many thanks
Also visit my web blog ; free iphone

Sat Dec 01, 10:17:00 AM EST  
Anonymous Anonymous said...

[p]Barely qualified, others, or corpuscles good point . This merchandise or support can be compared toward PHI ceramic flat metallic in a matter of about every way apart from fees about $60 more! . But yet everyone in the style that will your sweetheart received organic waves on [url=]cheap ghd straighteners[/url] blessed . Now, as getting an impressive movement image with too higher rate and quality, it's obtained reached the number success, which only many different movies acquire . What a offer with every little bit as sensible and beautiful, [url=]ghd straighteners[/url] have a tendency to not place it straight down for the sweetheart?Despite the actually altering style scene, Evening Gowns remains to offer an enchanting experience . plug, Australia plug, plug in Japan, Germany, [url=]cheap ghd[/url] electric plug, the South African plug, UK plug and other plugs . once the CHI Turbo types are designed with distinctive features, [url=]ghd straighteners sale[/url] they lack amazing attraction within their appearance . Chuang teacher asked: What you find out vindictive, can only advance towards the subsequent level with so a lot progress, if possessed by the Devil might be able to progress so considerably, I need to practice . therefore within littlest circle, where by means of the period is ghd straighteners cheap purple by means of the Universe, upon which Dis is seated, Thou dost content [url=]cheap ghd straighteners[/url] materials me so, when thou resolvest, That doubting pleases pink cheap ghds straighteners me no much under knowing!furthermore to purchasing for the most effective kitchen area appliances, however, people could also increase their energy-efficiency by incorporating additional suggestions:
Make particular the dishwashing equipment is totally loaded before using.[/p][p]i'd say that . a huge total of patio awning canopies, umbrellas, and carport canopies may perhaps offer you additional abilities which may appear to be appealing, nonetheless you might would prefer to establish regardless of whether [url=]ghd straighteners[/url] individuals are abilities which you genuinely need to own and want . Two available interior packages fill the gap between the standard trim and the posh leather-wrapped cabin, and a Heritage Package adds those front fender stripes and two-tone seats with Grand Sport embroidery . Creams and rinses are one thing, but accoutrement are a accomplished added brawl [url=]ghd hair straightener sale[/url] game . click the Exhibit button . I gently Yi Tan, stated: I practice too anxious, obsessed, can come back to see you today, is often a lucky day lucky break . Modernize [url=]ghd straighteners sale[/url] its technology and appearance the identical . Whatever her faults ghd hair straighteners sale,ghd hair straighteners.[/p]

Fri Dec 28, 10:59:00 AM EST  
Anonymous Anonymous said...

I know this if off topic but I'm looking into starting my own weblog and was wondering what all is required to get set up? I'm assuming having a blog like yours would cost a pretty penny?
I'm not very internet smart so I'm not 100% sure. Any tips or advice would be greatly appreciated. Kudos
My homepage ...

Tue Jan 29, 12:28:00 AM EST  
Anonymous Anonymous said...

Yes! Finally something about alanya holiday guide.
my webpage :: Bostaditurkiet.Net

Tue Jan 29, 12:58:00 AM EST  
Anonymous Anonymous said...

It's very trouble-free to find out any matter on net as compared to books, as I found this piece of writing at this web site.
Feel free to surf my web page ...

Thu Feb 07, 06:04:00 PM EST  
Anonymous Anonymous said...

just stopping by to say hello

Tue Feb 26, 01:49:00 PM EST  
Anonymous Anonymous said...

buy jMNYRkRf [URL=]knock off designer purses[/URL] , for special offer gAcSAwkp [URL= ] [/URL]

Mon Mar 11, 12:28:00 PM EDT  
Anonymous Anonymous said...

Burberry Handbags outlet 275366 Cheap Chanel Bags 343783 Louis Vuitton Handbags outlet 354545

Thu Mar 14, 05:06:00 PM EDT  
Anonymous Anonymous said...

Louis Vuitton Handbags 71330 Burberry Bags 853033 Hermes Birkin sale 37163

Fri Mar 15, 09:18:00 AM EDT  
Anonymous Anonymous said...

Hermes Bags on sale 210018 Hermes Birkin 545724 Louis Vuitton Bags 376960

Fri Mar 15, 02:04:00 PM EDT  
Anonymous Anonymous said...

Gucci Handbags 82811 Hermes Bags on sale 85373 Cheap Chanel Bags 283411

Fri Mar 15, 06:44:00 PM EDT  
Anonymous Anonymous said...

Louis Vuitton Bags outlet 829883 cheap christian louboutin shoes 434252 Burberry Bags clearance 224074

Fri Mar 15, 11:22:00 PM EDT  
Anonymous Anonymous said...

Gucci Handbags online 685273 Cheap Chanel Bags 999549 Louis Vuitton Handbags outlet 277508

Sat Mar 16, 04:02:00 AM EDT  
Anonymous Anonymous said...

Gucci Bags online 310562 Hermes Outlet 959051 Louis Vuitton Bags sale 47121

Sat Mar 16, 08:41:00 AM EDT  
Anonymous Anonymous said...

Hermes Bags 608773 Gucci Outlet 494138 Gucci Handbags 842355

Sun Mar 17, 06:27:00 AM EDT  
Anonymous Anonymous said...

Chanel Outlet Online 67611 Gucci Outlet 899726 christian louboutin outlet store 687567

Sun Mar 17, 02:54:00 PM EDT  
Anonymous Anonymous said...

Gucci Handbags for cheap 146335 cheap christian louboutin 275376 christian louboutin outlet store 440963

Sun Mar 17, 04:20:00 PM EDT  
Anonymous Anonymous said...

Burberry Bags clearance 88125 Louis Vuitton Bags 816130 christian louboutin outlet store 309015

Sun Mar 17, 08:53:00 PM EDT  
Anonymous Anonymous said...

Gucci Handbags for cheap 478615 Hermes Outlet 6151 Hermes Bags 213755

Mon Mar 18, 12:07:00 AM EDT  
Anonymous Anonymous said...

Chanel Outlet 452955 Cheap Louis Vuitton Bags 611970 christian louboutin outlet online 346678

Tue Mar 19, 12:37:00 AM EDT  
Anonymous Anonymous said...

Chanel Outlet Online 629823 Chanel Handbags store 502553 Louis Vuitton Bags outlet 548654

Wed Mar 20, 05:05:00 AM EDT  
Anonymous Anonymous said...

It is Miuccia [url= ]шуба [/url] and Patrizio Bertelli who discover the secret of Prada and invent the very first black nylon Prada handbag in the world which opens the successful and beneficial entrance of famous handbag brand. Prada Handbags is famous for its fantastic. Every woman wants a Prada handbag which shows the style and the way of life. Prada store sells cheap Prada, including Prada purses and Prada handbags. [url= ]фабрика меха [/url] is the best way for you to pick a bag of high quality and finest designed. With the growth of Prada, more and more [url= ]шуба [/url] are established. Ordering Prada handbags and Prada wallets in [url= ]мех [/url] can save you a large number of cash and time. [url= ]меховая фабрика [/url] is yet another good choice for you. [url= ]меховые фабрики [/url] should never let you down.

Sun Apr 14, 03:29:00 AM EDT  

Post a Comment

<< Home