Watch Out for Trojans Circulating in PDFs
Websense Security Labs warns of Zbot campaign; an information stealing trojan
That PDF File You Are Storing Can be Dangerous
New Zbot campaign comes in a PDF
Websense Security Labs has received several reports of a Zbot trojan campaign spreading via email that connects your PC to a malicious remote server in China. They have seen over 2,200 messages so far.
Zbot (also known as Zeus) is an information stealing trojan (infostealer) collecting confidential data from each infected computer. The main vector for spreading Zbot is a spam campaign where recipients are tricked into opening infected attachments on their computer.
This new variant uses a malicious PDF file which contains the threat as an embedded file. When recipients open the PDF, it asks to save a PDF file called Royal_Mail_Delivery_Notice.pdf. The user assumes that the file is just a PDF, and therefore safe to store on the local computer. The file, however, is really a Windows executable. The malicious PDF launches the dropped file, taking control of the computer. At the time of writing, this file has a 20 perecnt anti-virus detection rate (SHA1 : f1ff07104b7c6a08e06bededd57789e776098b1f).
Location of the Zbot:
The Zbot trojan creates a subdirectory under %SYSTEM32% with the name “lowsec” and drops the “local.ds” and “user.ds” files. The “local.ds” and “user.ds” are configuration files for the threat. It also drops an executable “sdra64.exe” and modifies the registry entry “%SOFTWARE%\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit” to launch itself during system startup. When it runs, it injects malicious code into the Winlogon.exe instance in memory. This Zbot variant connects to malicious remote sever in China using an IP address of 59.44.[removed].[removed]:6010.
This is yet another hacking attempt pointing to China, which is kinda alarming and makes one wonder if China is quietly planning to go big on this. Make sure you’ve updated your anti-virus suites with latest definitions in order to keep your PC from malicious data. Also, avoid downloading any PDF from unknown senders.
PC maker, inspiration for Microsoft, dead
Atlanta: Henry Edward Roberts, a developer of an early personal computer that inspired Bill Gates to found Microsoft, died on Thursday in Georgia. He was 68.
Mr. Roberts, whose build-it-yourself kit concentrated thousands of dollars worth of computer capability in an affordable package, inspired Bill Gates and his childhood friend Paul Allen to come up with Microsoft in 1975, after they saw an article about the MITS Altair 8800 in Popular Electronics.
Mr. Roberts, an ex-military man, later went on to build careers as a farmer and a physician, but continued to keep up with computer advances.
According to hi son David Roberts, he recently told Mr. Gates that he hoped to work with new, nanotechnology-enhanced machines.
“He did think it was pretty neat, some of the stuff they’re doing with the processors,” said Mr. David Roberts, who confirmed that Mr. Gates rushed to Georgia on Friday to be with his mentor.
According to his family, Mr. Roberts died in a Macon hospital after a long bout with pneumonia.
“Ed was willing to take a chance on us — two young guys interested in computers long before they were commonplace — and we have always been grateful to him,” Mr. Gates and Mr. Allen said in a joint statement released on Thursday .
“The day our first untested software worked on his Altair was the start of a lot of great things. We will always have many fond memories of working with Ed.”
The man often credited with kick-starting the modern computer era never intended to lead a revolution.
Born in Miami in 1941, Mr. Roberts spent time in the U.S. Air Force and earned an electrical engineering degree from Oklahoma State University in 1968.
He later parlayed his interest in technology into a business making calculators.
When large firms like Texas Instruments began cornering the business, Mr. Roberts soon found himself in debt, Mr. David Roberts said. Meanwhile, he was gaining an interest in computers at a time when hulking machines were available almost exclusively only at universities.
A funeral is planned Monday, in Cochran.