Computer Associates warns of massive botnet attack
{{date|June 5, 2005}}

Computer Associates are warning of a current three pronged, co-ordinated [[w:malware|malware]] attack on computers that are using [[w:Microsoft Windows|Microsoft Windows]] and are connected to the [[w:Internet|Internet]]. The attack involves the use of three different [[w:Trojan horse (computing)|Trojan horses]] called Glieder, Fantibag and Mitglieder. The goal is to create a [[w:botnet|botnet]] consisting of a large number of compromised computers. Access to this group of compromised machines will then be available on a black market, at prices as low as five cents per machine.

*Win32.Glieder.AK: The first of the three, this [[w:Trojan horse (computing)|Trojan horse]] attempts to de-activate an extensive list of security/[[w:Anti-virus software|antivirus]] related processes and services running on the target computer. It also attempts to lower security settings in order to facilitate easier access for subsequent [[w:Trojan horse (computing)|Trojan horses]].

*Fantibag: This second [[w:Trojan horse (computing)|Trojan horse]] creates filters on the target machine in order to prevent access to a large number of antivirus companies' Web sites. Thus, not only is the target computer now well and truly compromised, but an average Windows user will be completely unable to remove these violations of their system.

*Mitgleider: Once the first two [[w:Trojan horse (computing)|Trojan horses]] have largely eliminated any possibility that the target will be able to defend itself, this one finishes the job. It opens port 38884 and configures it to act as a SOCKS 4 proxy, but the compromised system can now also be commanded to do the following:-
**Changing the backdoor port number
**Updating the trojan
**Downloading and execute files
**Uninstalling the trojan
**Initiating an SMTP server on TCP port 25, which can be used to relay spam.
**Executing files on the infected computer
**Downloading and executing files via an URL

It should be noted that these [[w:Trojan horse (computing)|Trojan horses]] only affect the [[w:Microsoft Windows|Microsoft Windows]] family of operating systems. No other operating systems (such as [[w:Linux|Linux]] and [[w:Apple Computer|Apple]]'s [[w:Mac OS X|OS X]]) are vulnerable.  In order to prevent infection, [[w:Microsoft Windows|Windows]] users are advised to ensure that they have the latest operating system patches from [[w:Microsoft|Microsoft]], that their chosen [[w:Anti-virus software|antivirus]] software is up to date, and that they are using [[w:firewall (networking)|firewall]] software where appropriate.

==Sources==
*{{source|url=http://www.theregister.co.uk/2005/06/03/malware_blitz/
|title='Hackers plot to create massive botnet'
|author=John Leyden
|pub=The Register
|date=June 3, 2005}}

*{{source|url=http://it.slashdot.org/it/05/06/03/1516247.shtml?tid=172&tid=220&tid=95
|title=CA Warns Of Massive Botnet Attack
|author=Zonk
|pub=Slashdot
|date=June 3, 2005}}

*{{source|url=http://www3.ca.com/securityadvisor/virusinfo/default.aspx
|title=Computer Associates Virus Information Centre
|author=Computer Associates Security Advisor
|pub=Computer Associates
|date=June 1, 2005}}

{{publish}}{{PD-Article}}
{{archive}}
[[Category:Science and technology]]
[[Category:Computing]]
[[Category:Internet]]
Computer Associates are warning of a current three pronged, co-ordinated malware attack on computers that are using Microsoft Windows and are connected to the Internet. The attack involves the use of three different Trojan horses called Glieder, Fantibag and Mitglieder. The goal is to create a botnet consisting of a large number of compromised computers. Access to this group of compromised machines will then be available on a black market, at prices as low as five cents per machine.

*Win32.Glieder.AK: The first of the three, this Trojan horse attempts to de-activate an extensive list of security/antivirus related processes and services running on the target computer. It also attempts to lower security settings in order to facilitate easier access for subsequent Trojan horses.

*Fantibag: This second Trojan horse creates filters on the target machine in order to prevent access to a large number of antivirus companies' Web sites. Thus, not only is the target computer now well and truly compromised, but an average Windows user will be completely unable to remove these violations of their system.

*Mitgleider: Once the first two Trojan horses have largely eliminated any possibility that the target will be able to defend itself, this one finishes the job. It opens port 38884 and configures it to act as a SOCKS 4 proxy, but the compromised system can now also be commanded to do the following:-
**Changing the backdoor port number
**Updating the trojan
**Downloading and execute files
**Uninstalling the trojan
**Initiating an SMTP server on TCP port 25, which can be used to relay spam.
**Executing files on the infected computer
**Downloading and executing files via an URL

It should be noted that these Trojan horses only affect the Microsoft Windows family of operating systems. No other operating systems (such as Linux and Apple's OS X) are vulnerable.  In order to prevent infection, Windows users are advised to ensure that they have the latest operating system patches from Microsoft, that their chosen antivirus software is up to date, and that they are using firewall software where appropriate.

*

*
Science and technology Computing Internet