Malware Resists Eradication

<h1>Malware Resists Eradication</h1>Author: <a title="Rosemarie Grabowski" href="http://www.articlesbase.com/authors/rosemarie-grabowski/122008.htm">Rosemarie Grabowski</a> Infected PCs are being linked to networks by Criminals--using different pieces of destructive malware that thwart security applications Millions of PCs strong That's A Botnetweb Find more evidence of botnetwebs that came from Finjan, , a network security equipment company in California. <a href="http://www.articlesbase.com/businesscenter/article/163710/stealth_botnet_infects_nearly_2_million_systems.html">Finjan reported finding a C&C server</a> capable of sending spam, malware, or remote-control commands to a whopping 1.9 million bots. The C&C server had six administrator accounts, plus a cache of dirty programs. Ophir Shalitin, Finjan marketing director, says Finjan doesn't know which of the programs might have infected which of the PCs--or more important, which malware made the initial infection. The firm traced the (now defunct) C&C server's IP address to Ukraine, and found evidence that the botnet resources were rented out for $100 per 1000 bots per day. According to Alex Lanstein, a FireEye senior security researcher, a distributed collection of botnets gives bad guys many advantages. If law enforcement or a security firm were to shut down the C&C server for any single botnet, the crook could still make a profit from the surviving botnets. Creating such botnets typically starts with "dropper" malware, Lanstein says, that uses "plain-Jane, vanilla techniques" and no strange coding or actions that may raise a red flag for antivirus apps. Once a dropper enters a PC (often via a drive-by download or an e-mail attachment), it may pull in a Trojan horse, such as the Hexzone malware being sent by the server Finjan found. That Hexzone variant was initially detected by only 4 out of 39 antivirus engines at Virus total. How do you make a terrible thing even worse? If you're a crook who operates a <a href="http://www.articlesbase.com/businesscenter/article/164282/botnet_probe_turns_up_70g_bytes_of_personal_financial_data.html">botnet</a>--an often-expansive network of malware-infected PCs--you link botnets together to form a gargantuan "botnetweb." And you do it in a way that's hard for an antivirus suite to fight. Botnetwebs don't just enable crooks to send spam or malware to millions of PCs at once. They also represent a highly resilient infection that uses multiple files. An attempt at disinfection might eliminate some files, but those left behind will often redownload the scrubbed ones. The culprits "are not a bunch of nerds sitting in some dark room developing these botnets for fun," writes Atif Mushtaq of FireEye, the Milpitas, California, security company that coined the term botnetweb. "These are organized people running this in the form of a sophisticated business." About the Author: Rosemarie Grabowski, A fellow PC user has always run her businesses from my home. So her computer is an important business tools that she relies on daily. Just a few of the reasons she is involved in the field of PC Security. Not just personal but two fold. She wants her computer to run as it should. Contact her at 308-687-6085 or <a href="http://www." target="_blank">www.</a> topsecretfreereport.com/makeadifference-x CHECK OUT MY BLOG FOR SOMEMORE TIMELY INFORMATION: <a target="_blank" href="http://">http://</a> mypcsafefromspywar.blogspot.comArticle Source: <a href="http://www.articlesbase.com/">ArticlesBase.com</a> - <a href="http://www.articlesbase.com/security-articles/malware-resists-eradication-1125292.html" title="Malware Resists Eradication">Malware Resists Eradication</a>

Infected PCs are being linked to networks by Criminals--using different pieces of destructive malware that thwart security applications

Millions of PCs strong That's A Botnetweb

Find more evidence of botnetwebs that came from Finjan,

, a network security equipment company in California. Finjan reported finding a C&C server capable of sending spam, malware, or remote-control commands to a whopping 1.9 million bots.

The C&C server had six administrator accounts, plus a cache of dirty programs. Ophir Shalitin, Finjan marketing director, says Finjan doesn't know which of the programs might have infected which of the PCs--or more important, which malware made the initial infection. The firm traced the (now defunct) C&C server's IP address to Ukraine, and found evidence that the botnet resources were rented out for $100 per 1000 bots per day.

According to Alex Lanstein, a FireEye senior security researcher, a distributed collection of botnets gives bad guys many advantages. If law enforcement or a security firm were to shut down the C&C server for any single botnet, the crook could still make a profit from the surviving botnets.

Creating such botnets typically starts with "dropper" malware, Lanstein says, that uses "plain-Jane, vanilla techniques" and no strange coding or actions that may raise a red flag for antivirus apps. Once a dropper enters a PC (often via a drive-by download or an e-mail attachment), it may pull in a Trojan horse, such as the Hexzone malware being sent by the server Finjan found. That Hexzone variant was initially detected by only 4 out of 39 antivirus engines at Virus total.

How do you make a terrible thing even worse? If you're a crook who operates a botnet--an often-expansive network of malware-infected PCs--you link botnets together to form a gargantuan "botnetweb." And you do it in a way that's hard for an antivirus suite to fight.

Botnetwebs don't just enable crooks to send spam or malware to millions of PCs at once. They also represent a highly resilient infection that uses multiple files. An attempt at disinfection might eliminate some files, but those left behind will often redownload the scrubbed ones.

The culprits "are not a bunch of nerds sitting in some dark room developing these botnets for fun," writes Atif Mushtaq of FireEye, the Milpitas, California, security company that coined the term botnetweb. "These are organized people running this in the form of a sophisticated business."

Rosemarie Grabowski, A fellow PC user has always run her businesses from my home. So her computer is an important business tools that she relies on daily. Just a few of the reasons she is involved in the field of PC Security. Not just personal but two fold. She wants her computer to run as it should. Contact her at 308-687-6085 or www. topsecretfreereport.com/makeadifference-x CHECK OUT MY BLOG FOR SOMEMORE TIMELY INFORMATION: http:// mypcsafefromspywar.blogspot.com

Rate this Article:

0 / 5 stars - 0 vote(s)

Re-Publish

Article Source: http://www.articlesbase.com/security-articles/malware-resists-eradication-1125292.html

Article Tags: pcs criminals, botnet, botnetweb, dropper malware

Related Videos
Related Articles
Ask / Related Q&A

Play

Dealing with Spyware - #5 - Staying Safe in the Seedier Parts of the Net

Play

Dealing with Spyware - #4 - Scanning Your System for Spyware and Malware

Play

Security Breaking News: Celebrity Death = Scareware

Play

Beware of the Golden Cash Botnet - FrugalTech

Play

How to Know if your PC has a Virus or Malware Infection

Latest Security Articles
More from Rosemarie Grabowski

Social Media Sites & 'Privacy' Issues at Work - 'In-Private Browzing'

By: Trish Johnson aka JazzedLady | 20/12/2009
This article is in follow-up to my previous articles on this subject, today I would like to offer my thoughts on email scandals, privacy and security, ‘in-private browzing’ capabilities, and the challenges that these processes present for us all.

Securing websites

By: MFrizzi | 18/12/2009
This paper discusses some of the common ways that web servers are attacked and details various techniques in which they – and by extension the websites they host – can be protected.

Applications, virtualization, and devices: Taking back control

By: MFrizzi | 18/12/2009
Employees installing and using legitimate but unauthorized applications, such as Instant Messaging, VoIP, games, virtualization software, and unapproved browsers are a real and growing threat to business security and productivity. Removable storage media and wireless protocols make the challenge of securing data even more complex. This paper explains why it is important to control unauthorized applications and devices, discusses the different approaches, and highlights how integrating this funct

Trend Micro: Koobface Abuses Google Reader

By: Angeline Mabute | 18/12/2009
Trend Micro’s threat research revealed that Koobface botnet is abusing Google Reader by spamming URLS which redirects Internet users to infected websites through Youtube.

Trend Micro: Koobface Abuses Google Reader

PCI Penetration Testing. ASV, QSA, Internal, Third-party?

By: George Pettit | 17/12/2009
As a Qualified Security Assessor Company (QSAC) we often get asked by our clients if they are able to fulfil their ongoing PCI penetration testing requirements in-house. The short answer is it depends. PCI DSS requirement 11.3 covers an organisations requirement for conducting an annual internal and external penetration test – including application tests.

Silon Malware Steals your Credentials

By: Angeline Mabute | 17/12/2009
Trusteer warns the people on a new Trojan called Silon which can intercept user’s web login activities targeting Internet Explorer users.

How to Remove Malware from Your Computer

By: Hannah Miller | 17/12/2009
If you suspect your computer has become infected with some sort of virus or spyware, you should take action immediately. The longer a virus is on your computer the more it will spread and could attack core system files or your personal files. The longer spyware is on your computer the more likely you are to have computer problems and, even worse, identity theft. Here is an in-depth explanation on what should be done.

Failing Reliv Distributors

By: Rosemarie Grabowski | 12/11/2009 | Internet Marketing
Many of my Reliv clients are using the Internet as a super effective weapon to build their business. Pay very close attention if you are looking for that same effective way to build your business ...

Want A Successful ACN Business

By: Rosemarie Grabowski | 11/11/2009 | Online Business
How to generate an endless supply of leads of prospects that are approaching you for more information about your ACN products, services and your opportunity every single day.

My PC Freezes UP When Idle

By: Rosemarie Grabowski | 10/11/2009 | Computers
I downloaded several ad-removal programs such as Spybot, Ad-Aware, and RBkiller. Sure they removed around one hundred-fifty cookies/programs/anything else that caused pop-ups shortly after being pop-up free for around two days our computer began...slowing down.

Frank Vandersloot And Melaleuca

By: Rosemarie Grabowski | 10/11/2009 | Internet Marketing
Melaleuca began out of the ashes of a previous company. In 1985, Frank Vandersloot became CEO of Oil of Melaleuca, a multilevel marketing firm selling products based on melaleuca oil.

Sophisticated Botnet Causing a Surge in Click Fraud

By: Rosemarie Grabowski | 24/09/2009 | Internet Marketing
The Bahama botnet is masking the source of its clicks to convince click-fraud filters they are coming from high-quality, legitimate sources, such as U.S. libraries and schools. The botnet is also altering the "interval and breadth" of the attacks from the compromised PCs, according to Click Forensics.

Are ATM"s safe?

By: Rosemarie Grabowski | 03/09/2009 | Security
The bad guys have found plenty of ways to steal all-important PINs. Some set up bogus ATMs or install skimming devices or cameras on legitimate machines to record account numbers and PINs.

Is that ATM safe?

By: Rosemarie Grabowski | 03/09/2009 | Security
Monitoring all your accounts is important, but these days you want to pay particular attention to what's going on in your checking and savings accounts, because thieves increasingly target bank accounts.

Twitter is Down

By: Rosemarie Grabowski | 22/08/2009 | Security
The company simply couldn't keep up with the volume of information from its Tweeters. Last year, the company made a concerted effort to address those capacity problems, and now Fail Whale sightings are as rare as those for white whales.