Xombe Trojan imitates Microsoft security warning

Summary:An email pretending to be a Microsoft security warning harbours a malicious Trojan horse

An email disguised as a message from Microsoft's security team contains a dangerous Trojan horse called Xombe.

Xombe, also known as Trojan.Xombe, Downloader-GJ and Troj/Dloader-L, was being distributed on Friday and poses as a critical update for Windows XP. When executed, it attempts to download a malicious backdoor component from the Web. It appears to be an imitation of one of last year's most successful worms, the mass-mailed Swen, which also masqueraded as a security warning from Microsoft.

However, Xombe has yet to repeat the success of Swen. While the former failed to make the top ten threats intercepted by email-security firm Messagelabs on Monday morning, Swen was at number two, with some 7,000 instances captured in the past 24 hours.

Ken Dunham, director of malicious code at security company iDefense, said that the success of Swen has encouraged virus writers to create emails and Web sites that appear official in order to fool more people into executing malicious code.

The email, which appears to have been sent from windowsupdate@microsoft.com, has the subject line "Windows XP Service Pack 1 (Express) - Critical Update" and directs users to execute the attachment, called winxp_sp1.exe, in order to fix some vulnerabilities in Internet Explorer, Outlook and Outlook Express.

Dunham said that once executed, the attachment downloads a file called msvchost.exe that alters the Windows Registry and opens certain ports in order to listen out for commands from a hacker.

Most antivirus companies have already updated their signatures, but users without up-to-date antivirus applications could be infected, helping the Trojan's author to take control of large numbers of PCs. Dunham said that once a "large army of zombie computers" has been built up, attackers could use them for more serious crimes such as ID theft and banking fraud.

Although Xombe is only likely to be opened by Windows XP users, it affects Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT and Windows Server 2003 systems, as well as Windows XP, according to Symantec.

Topics: Security

About

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.Munir was recognised as Austr... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.