August 18, 2005

Virus writing groups target each other

by brian_turner

Hacker groups are competing to produce malicious programmes that exploit a recently discovered loophole in Windows 2000. Some of the variants seek out and delete rival viruses they find on machines they manage to infect.

A patch for the Windows 2000 loophole was released on 9 August and malicious programmes designed to exploit it appeared a few days later. The vulnerability occurs in the Plug-and-Play component of Windows 2000 and also affects PCs running Windows XP, unless users have installed a security update. The flaw can also be fixed by a patch for Windows 2000.

Several major organisations, including the Financial Times, Caterpillar, ABC News and CNN, were attacked by the viruses earlier this week.

Despite Windows 2000 being the most prevalent version of the operating system used in large organisations, the number of firms infected was relatively low, according to Microsoft.

The company has released a free tool to automatically remove the Zotob worm and its variants from infected PCs. However, security firms Clearswift and F-Secure have identified newer versions of the viruses that try to destroy bugs from rival groups.

“There appears to be three different virus-writing gangs turning out new worms at an alarming rate,” said Mikko Hypponen, chief research officer at F-Secure, “as if they were competing to build the biggest network of infected machines.”

Microsoft advised users to turn on auto-updates and make sure anti-virus and other security programs were up to date.

In a statement, Microsoft said the reported worms are variants of an existing worm called Zotob.

Questions? Discuss this in our Internet Business forums for help and advice

Story link: Virus writing groups target each other

Add to Bookmarks: