Ian
Stole All the Forum Stars
Good things come to those who wait ...
Posts: 2913
|
 |
C variant of the Gibe worm
« on: Sep 23rd, 2003, 9:27pm » |
 Quote  Modify
|
C variant of the Gibe worm.
This malicious code uses so-called social engineering to trick users, as it reaches computers in an e-mail message that passes itself off as a security patch for Microsoft Windows operating systems.
This message is in HTML format and perfectly imitates the style of Microsoft web pages. In order to gain credibility, the sender of the e-mail message displayed is 'MS Technical Assistance'. The message also includes an attached file that actually contains the Gibe.C worm and can have different names, such as Q591362.EXE.
When the attached file is run, a series of windows are displayed, which simulate the installation of the supposed patch. However, these screens actually cover up the actions that the worm is carrying out. The actions carried out by this worm include inserting a large number of entries in the Windows Registry. Similarly, Gibe.C ends the processes of several antivirus and computer security programs, leaving computers at the mercy of hackers or other malicious code.
As well as e-mail, Gibe.C also uses KaZaA and the chat application IRC to spread.
|
Mischel Internet Security Forum
Reply
Notify of replies
Send Topic
Print
Author
IP Logged
Search
Members
Login
Register