Jump to content

Change Mode

Recommended Posts

Don't know if anyone has seen or posted this yet.






Xombe Trojan poses as Microsoft warning


By Munir Kotadia

ZDNet (UK)

January 12, 2004, 9:48 AM PT





An e-mail disguised as a message from Microsoft's security team contains a dangerous Trojan horse called Xombe.

Xombe, also known as Trojan.Xombe, Downloader-GJ and Troj/Dloader-L, was being distributed on Friday. It poses as a critical update for the Windows XP operating system. When executed, it attempts to download a malicious backdoor component from the Web.


It appears to be an imitation of one of last year's most successful worms, the mass-mailed Swen, which also masqueraded as a security warning from Microsoft.




However, Xombe has yet to repeat the success of Swen. While the former failed to make the top 10 threats intercepted by e-mail security company MessageLabs on Monday morning, Swen was at No. 2, with some 7,000 instances captured in the past 24 hours.


Ken Dunham, malicious code intelligence manager at security company iDefense, said that the success of Swen has encouraged virus writers to create e-mails and Web sites that appear official in order to fool more people into executing malicious code.


The e-mail, which appears to have been sent from [email protected], has the subject line "Windows XP Service Pack 1 (Express) - Critical Update" and directs users to execute the attachment, called winxp_sp1.exe, in order to fix some vulnerabilities in Microsoft's Internet Explorer, Outlook and Outlook Express.


Dunham said that once executed, the attachment downloads a file called msvchost.exe that alters the Windows Registry and opens certain ports in order to listen out for commands from a hacker.


Most antivirus companies have already updated their signatures, but users without up-to-date antivirus applications could be infected, helping the Trojan's author to take control of large numbers of PCs. Dunham said that once a "large army of zombie computers" has been built up, attackers could use them for serious crimes such as ID theft and banking fraud.


Microsoft was not immediately available to comment.


Although Xombe is only likely to be opened by Windows XP users, it affects Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT and Windows Server 2003 systems, as well as Windows XP, according to security company Symantec.


Munir Kotadia of ZDNet UK reported from London.

Link to post
Share on other sites

Just to add to this:

M$ does not send patches through E-mail, and your ISP does not send requests for updated credit card info through E-mail. If you see an E-mail that looks legit from your ISP claiming that your credit card info is outdated, do not answer it with your CC info. It is a spam which is a scam. Contact your ISP if you have any doubts, but delete the message first.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...