Author Topic: Dangerous rootkit steals 40.000 passwords  (Read 4186 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33916
  • malware fighter
Dangerous rootkit steals 40.000 passwords
« on: March 22, 2006, 02:29:14 PM »
Hi forum members,

Read here about this threat: http://www.nthworld.org/archives/2006/03/on_march_20th_w_1.htm#more

More about win-alcra and removal instructions:
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=43300


polonus
« Last Edit: March 22, 2006, 02:31:30 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

CharleyO

  • Guest
Re: Dangerous rootkit steals 40.000 passwords
« Reply #1 on: March 22, 2006, 08:11:09 PM »
***

Interesting, Polonus ... and very scary!    :o

The first link give interesting background info.

Hopefully, everyone reads the second link as there is info there that can tip you off that something unwanted is installing (the faked install window) and therefore can take appropiate action.


***

mike6688

  • Guest
Re: Dangerous rootkit steals 40.000 passwords
« Reply #2 on: March 22, 2006, 08:28:08 PM »
Wow,

So glad I don't use P2P programs which the worm uses.

CharleyO

  • Guest
Re: Dangerous rootkit steals 40.000 passwords
« Reply #3 on: March 22, 2006, 08:50:17 PM »
***

Yeah, I have no use for P2P programs neither, Mike.   :)

Though, I do have P2P Shield activated for all supported ... just in case I get stupid some day!    ;)  ;D


***
« Last Edit: March 22, 2006, 08:53:07 PM by CharleyO »

Offline YLAP

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2118
Re: Dangerous rootkit steals 40.000 passwords
« Reply #4 on: March 22, 2006, 08:53:27 PM »
Hmmm... And Skype... I thought this application is P2P based too... Am I wrong?  ??? I know it is covered by avast with IM Shield. The only one P2P I have is uTorrent.
« Last Edit: March 22, 2006, 08:55:00 PM by =YLAP= »

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33916
  • malware fighter
Re: Dangerous rootkit steals 40.000 passwords
« Reply #5 on: March 22, 2006, 10:04:10 PM »
Hi CharleyO,

While they are declaring their program is malware free, Kazaa for instance gives you malware you cannot shut down, only if you are a malware fighter or get help from specific tools. But you would not like to have the SpyFalcon or like installs there on the first place, would you folks? There is a perfectly legit way to do this, and it is malware free but heavily moderated, and that is use Usenet, but you have to subscribe.
People like to scare you and say the Internet is not a safe place. The sites that are the source of malware aren't that many, and it is like in the real world, go to a back alley, and you can get clubbered over the head. If you take your precautions (layered protection and in-browser pre-scanning) you can surf with not too many risks. It is the masses of un-educated people that make the Internet an unsafe place, they always have three options: click right, click left or ignore, until the clicking gives out, because their machines have come to a halt and are taken to the repair man or just dumped by the road-side. A sorry state of affairs. We try to teach them better ways, but it is a long struggle to achieve.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

CharleyO

  • Guest
Re: Dangerous rootkit steals 40.000 passwords
« Reply #6 on: March 22, 2006, 10:22:07 PM »
***

I never have used P2P programs. From the very first I heard of such things, I started saying what a bad idea it is. In the first place, the purpose of those programs was to fool the young (and otherwise unknowledgable) into downloading spyware, adware, and any other form of malware. It worked and is still working because there are so many unaware newbies "born" everyday.

When using P2P programs, you are just asking for trouble ... and sooner or later, you will be sure to get it.


***

Omar

  • Guest
Re: Dangerous rootkit steals 40.000 passwords
« Reply #7 on: March 23, 2006, 12:05:44 AM »
I presume avast detects it? ;)

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33916
  • malware fighter
Re: Dangerous rootkit steals 40.000 passwords
« Reply #8 on: March 23, 2006, 08:15:43 AM »
Hi Omar,

On Febr. 18th it did not, look here:
http://www.computing.net/security/wwwboard/forum/17782.html
Hope avast can confirm, it does now,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!