Beware! BMP files may contain a new virus

tdinc

OSNN Veteran Addict
Political User
Joined
Dec 6, 2003
Messages
3,508
Kaspersky Labs has detected a mass mailing of a new Trojan named Agent. Agent infects victim machines when users view graphics in BMP format.

Agent exploits a vulnerability in MS Internet Explorer versions 5.0 and 5.5 which allows malicious code to be launched on victim machines via modified BMP files. This vulnerability is a direct result of the Windows source code leak and was first detected on February 16, 2004.

Agent was mailed using spammer technology in an infected email that only contains a BMP file with a random name. The file is created especially for the Russian version of Windows 2000; the malicious code will not function on other language versions. This implies that Agent was probably created in Russia or the CIS.

Should a user open the BMP file Agent immediately connects to a remote server located in the Lybian domain zone, downloading and installing a second Trojan named Throd.

Throd is a classic spyware program. The Trojan first copies itself into the Windows system registry autorun keys and then awaits further commands. The 'master' can remotely execute various commands on the victim machine including copying data, collecting addresses from MS Outlook and turning the infected computer into a proxy server functioning as a platform for anonymous cyber crimes.

"Throd is obviously written for spammers,' comments Eugene Kaspersky, Head of Anti-Virus Research at Kaspersky Labs, 'the Trojan harvests email addresses and creates a network of zombie machines for massive spammer attacks. Once again, we see spammers and virus-writers are working hand in hand."

To date, Microsoft has not issued a patch for this vulnerability. In other words, the only protection users have is up-to-date anti-virus software. "Moreover, it is very likely that malware attacking other versions of Windows will soon appear', adds Eugene Kaspersky, 'I strongly recommend that users make sure that their antivirus software protects them from malware exploiting this particular Windows vulnerability."

Kaspersky® Anti-Virus does scan the contents of BMP files and automatically detects suspicious objects attempting to penetrate via either the Internet of email. The solution neutralizes Agent automatically and our antivirus databases have been updated to detect Throd.

Detailed descriptions of both Agent and Throd are available in the Kaspersky Virus Encyclopedia.
 

X-Istence

*
Political User
Joined
Dec 5, 2001
Messages
6,498
Old bug, was found when the source was leaked, was an entire story on /.

Also, it does not affect IE 6.x, or any other browser (Firefox, and Opera :p)
 

tdinc

OSNN Veteran Addict
Political User
Joined
Dec 6, 2003
Messages
3,508
:rolleyes: Well, what can I say, A few days and a dollar short.
 

Petros

Thief IV
Joined
May 19, 2003
Messages
3,038
Windows 98 users who never update their software better watch out!
 

Xie

- geek -
Joined
Sep 29, 2003
Messages
5,274
Unwonted said:
Windows 98 users who never update their software better watch out!
tdinc said:
The file is created especially for the Russian version of Windows 2000; the malicious code will not function on other language versions.
 

Electronic Punk

willalwaysbewithyou
Staff member
Political User
Joined
Dec 2, 2001
Messages
18,631
Well the one in my thread doesn't :p
Free reputation for whoever does it... lol
 

ming

OSNN Advanced
Joined
Jun 17, 2003
Messages
4,252
BMP?! :)
Have you heard rumours about the possibility of infections through JPG and mp3's as well?
 

Members online

No members online now.

Latest profile posts

Electronic Punk wrote on Sazar's profile.
Where are you buddy? :(
Perris Calderon wrote on Electronic Punk's profile.
Hey ep!

All good with me, applying for microsoft mvp right now, should have done this a while ago.

Notifications don't work, I only found your response by comming back to hunt up some threads, if you want, give me your email address so we can keep in touch easier, mine is perriscalderon at gmail
Perris Calderon wrote on Electronic Punk's profile.
Ep, glad to see you come back and tidy up...did want to ask a one day favor, I want to enhance my resume , was hoping you could make me administrator for a day, if so, take me right off since I won't be here to do anything, and don't know the slightest about the board, but it would be nice putting "served administrator osnn", if can do, THANKS

Been running around Quora lately, luv it there https://tinyurl.com/ycpxl
Electronic Punk wrote on Perris Calderon's profile.
All good still mate?

Forum statistics

Threads
61,978
Messages
673,285
Members
89,064
Latest member
Plesuvius