| Trojan delivers unwanted gift
to Windows PCs By Elinor Mills, CNET News.com Published
on ZDNet News: December 28, 2005
A new Trojan horse program was infecting PCs
on Wednesday, exploiting a hole in Windows systems to sneak onto computers,
then dropping adware or spyware or turning them into zombies, according
to several Internet security companies.
The Trojan, dubbed Exploit-WMF (Windows Meta
File), was rated a category 2 level risk, meaning it had the potential
to continue to spread, said Dave Cole, director of security response at
Symantec.
The exploit "is misusing a function in the
WMF library in Windows," dropping onto the machine a downloader Trojan
"that pulls down its big brother, a more sophisticated Trojan" from a server
on the Internet, he said.
"Then it might try to pull down adware, spyware
or a bot program," that can turn the computer into a zombie to be used
for attacking other machines or sending spam, or just leave a hole on the
computer through which sensitive data could be stolen, Cole said.
Kaspersky Lab rated the vulnerability "highly
critical" and predicted that "new modifications of these programs may well
appear in the near future."
The WMF vulnerability affects computers running
Windows XP with Service Pack 1 and Service Pack 2, as well as Windows Server
2003 with Service Pack 0 and Service Pack 1. It can be exploited when an
Internet Explorer user, or Firefox user under certain circumstances, visits
a Web site that has malicious code on it or when a user previews .wmf format
files with Windows Explorer, Kaspersky said in a statement.
The WMF library allows the computer to handle
particular image types of Windows machines, Cole said. There is no patch
for it yet from Microsoft, although antivirus vendors had released software
to help protect against it, he said.
"Microsoft is investigating new public reports
of a possible vulnerability in Windows and will continue to investigate
the reports to help provide additional guidance for customers," a Microsoft
spokesperson wrote in an e-mail. "Upon completion of this investigation,
Microsoft will take the appropriate action to protect customers, which
may include providing a fix through the monthly release process or issuing
a security advisory, depending on customer needs." |