EmailEmail
PrintPrint
Worry Watch -- A computer threat straight out of the movies
Saturday, February 18, 2006

We've seen it in the movies: a family member is kidnapped and held for ransom by the bad guy. Now, a similar process is being used to demand money from PC users in real life.

 
 

WEEKLY REPORTS

Solutions, Prevention & Remedies

Top 10 Threats

   
 

When a victim opens a specially crafted file in an infected E-mail message, the program encrypts files on his computer. These files remain impenetrable until the user applies decryption keys to free the kidnapped files.

Unfortunately, the correct codes are held by hackers until the user pays a certain amount of money.

This problem was recently re-discovered in Portland, Oregon when a woman's computer was hi-jacked, displaying pornographic pictures and a note that demanded $10.99 by way of Western Union in return for her stolen files. The extortion attempt included the threat to delete a file every half hour until the money was received.

These types of threats, dubbed "ransomware," still appear to be isolated, but if you become a victim, contact your local authorities immediately.


Worry Watch Plus Online only:

Information, Protection and Prevention -- More About Ransomware
Wikipedia definition


Microsoft?s Latest Security Releases:

Name

Number

For Users of

Priority

Cumulative Security Update for Internet Explorer

KB 910620

Windows 2000 (SP4) and Internet Explorer 5.01 (SP4)*

Critical

Vulnerability in Windows Media Player Could Allow Remote Code Execution

KB 911565

Windows XP (SP1 and SP2), 2000 (SP 4), ME, SE, 98 and Media Player 7.1, 9, and 10*

Critical

Vulnerability in Windows Media Player Plug-in with Non-Microsoft Internet Browsers Could Allow Remote Code Execution

KB 911564

Windows XP (SP1 and SP2), XP Professional, and 2000*

Important

Vulnerability in TCP/IP Could Allow Denial of Service

KB 913446

Windows XP (SP1 and SP2) and XP Professional*

Important

Vulnerability in Web Client Service Could Allow Remote Code Execution

KB 911927

Windows XP (SP1 and SP2) and XP Professional *

Important

Vulnerability in the Korean Input Method Editor Could Allow Elevation of Privilege

KB 901190

Windows XP (SP1 and SP2), XP Professional, and Office 2003 (SP1 and SP2) Office 2003 Multilingual, Office OneNote 2003*

Important

Vulnerability in PowerPoint 2000 Could Allow Information Disclosure

KB 889167

PowerPoint 2000

Important

Windows Malicious Software Removal Tool

KB890830

Windows 2000, XP*

Go back

* Reading: Solutions, Prevention & Remedies
Additional summary information related to a specific type of solution or prevention that you should be considering. Depending upon the week, this section may have:
• Recent Windows security releases from Microsoft
• Recent updates to widely used anti-spyware programs
• Recent updates to widely used anti-virus programs
• Recent updates to other security programs & devices (ex: Firewalls, routers)
• Recent updates to various applications in wide use


Top 10 Threats:

Name

Type

Affects

Alert Level

Sdbot.ftp

Worm

Windows 95, 98, 2000, ME, NT, XP

Low

Netsky.P

Worm

Windows 95, 98, 2000, ME, NT, XP*

Medium

Metafile

Trojan

Windows 95, 98, 2000, ME, NT, XP*

Low

Bagle.GS

Worm

Windows 95, 98, 2000, ME, NT, XP*

Low

Tearec.A  

Worm

Windows 95, 98, 2000, ME, NT, XP

Low

Sober.AH

Worm

Windows 98, 2000, ME, NT, XP

Low

Downloader.HRS

Trojan

Windows 95, 98, 2000, ME, NT, XP*

Low

Parite.B

Virus

Windows 95, 98, 2000, ME, NT, XP*

Low

Qhost.gen

 

Trojan

Windows 2000, NT, XP*

Low

Bagle.GX 

Worm

Windows 95, 98, 2000, ME, NT, XP*

Low

Go back

Read: Top Threats
These are viruses that are currently on the watch lists of major anti-virus software companies.

Name
What the threat is called. We use the name given each virus by Panda Software. Sometimes other anti-virus companies give the same threat a different name. Usually they use similar names.

Type
There are different characteristics associated with different types of threats.
• Virus - has the ability to replicate or infect computers or other programs
• Trojan Horse (or Trojan) - appear to be harmless programs when you get them. They unleash their payload when you double-click, open, or execute them.
• Phishing - a Web site or e-maill message posing as another company - usually one you know to fool you into giving the sender personal information.
• Worm - self replicates onto additional disks, computers or networks
• Spyware - installs on your system to collect information about your activity, preferences or interests
• Hoax - false messages sent by e-maill to mislead the recipient
• Backdoors - opens a security hole that allows outsiders to take control of your computer
• Dialer - uses your telephone to dial an outside number - sometimes a number that costs you money when dialed

Affects
Not all viruses affect all types of systems. Some, for example may affect only Windows 98 and 95, but not Windows XP or NT. Others affect all Windows systems, but not Macintosh. In this column, we show you the consumer systems that the threat is known to affect. We don't always include the servers that operate in your company's backroom.

Alert level
The level of awareness that anti-virus vendors suggest you need to have for each threat listed.
For each threat listed, we'll post a corresponding link here, so you can get more information to help you recognize, diagnose, prevent, and repair the problem.

First published on February 18, 2006 at 12:00 am
Worry Watch is compiled by David Radin & Jes Scherder using data and reports from Microsoft, CERT, Panda, and other sources. To contact the compilers of Worry Watch, go to http://www.megabyteminute.com/contactdavid.html.