[Tech] Sicurezza: Xombe, nuovo trojan per Windows XP

Il nuovo virus Xome, identificato anche come Trojan.Xombe, Downloader-GJ e Troj/Dloader-L, una volta eseguito su Windows XP tenta di downloadare e attivare una backdoor e di fatto minaccia di trasformare i computer colpiti in altrettanti "zombie":

Ken Dunham, malicious code intelligence manager at security company iDefense, said that the success of Swen has encouraged virus writers to create e-mails and Web sites that appear official in order to fool more people into executing malicious code.

Il virus, tanto per cambaire, si diffonde via e-mail.



Il messaggio di posta elettronica ha come mittente "windowsupdate@microsoft.com"; il subject è "Windows XP Service Pack 1 (Express) - Critical Update"; il testo del messaggio invita ad eseguire un allegato chiamato "winxp_sp1.exe" al fine di correggere alcune falle nella sicurezza di Microsoft Internet Explorer, MS Outlook ed MS Outlook Express.

Dunham said that once executed, the attachment downloads a file called msvchost.exe that alters the Windows Registry and opens certain ports in order to listen out for commands from a hacker.



Most antivirus companies have already updated their signatures, but users without up-to-date antivirus applications could be infected, helping the Trojan's author to take control of large numbers of PCs. Dunham said that once a "large army of zombie computers" has been built up, attackers could use them for serious crimes such as ID theft and banking fraud.



Microsoft was not immediately available to comment.

Pur essendo indirizzato agli utenti di Windows XP, secondo Symantec il virus può colpire anche anche Windows 2000, Windows 95, Windows 98 / 98 SE, Windows ME, Windows NT e Windows 2003 Server (acc... manca niente? Ah, sì... Windows 3.x e Windows CE, forse...).



Fonte: News.com.