Stuxnet Worm can come back right away after its removal
By Gina on September 29, 2010 | Malware, Stuxnet worm, malware, infected files, step7 file, vulnerability
Stuxnet worm is one of the most dangerous worms ever. It is able to infiltrate itself in a computer even after it has been already cleaned from the machine. Worm usually targets computers that are used in nuclear plants and other industrial facilities.
Stuxnet has proven it is a piece of headache for the security researchers and analysts because it could affect four flaws that were undiscovered and unpatched. These four were the green light for the worm to spread via USB keys, Windows file shares and etc. Moreover, the worm is very good at infecting industrial-control programs that is created by Siemens.
Symantec researchers have discovered that Stuxnet worm infects Siemens software files that administrators use in their need to fix programs and etc. The so called Step7 file is compromised after the first infection and if the worm targets PC again, it will definitely infect that computer and its files once again.
Symantec's Nicolas Falliere commented: „Stuxnet's ability to infect project files and run when they are opened is yet another propagation vector to add to the list. While we advise operators and programmers to be wary of project files from untrusted sources — internet forums, for instance — the most likely source of infection is likely to be a trusted party whose systems have been compromised by the threat.“
What is more, if Step7 file is held at the central server after the attack worm can compromise machines that are downstream from that central computer. N. Falliere pointed out that coming back from the dead is one of Stuxnet worm’s capabilities and features. “Infected projects restored from backups may reintroduce the infection to previously cleaned machines so administrators should exercise caution when restoring files in this manner,“ – he said.
More Malware news
Danger! Facebook private messages and Instant Messengers are infected by worm
According to TrendLabs, infected messages are spreading on Facebook which contain a malicious link pointing to an archive file “May09-Picture18.JPG_www.facebook.com.zip”. Zipped archive itself has a file titled “May09-Picture18.JPG_www.facebook.com” and uses the extension “.com”. Malware within is able to terminate services and processes related to AV which quickly shuts down AV from detection or removal of the worm. This detected malware is named WORM_STECKCT.EVL. Read more.- Wikipedia warns: Ads on Wikipedia page informs about malware within your PC
- Beware of fake Instragram app
- New tricky anti-virus intimidates file-sharers
- Android may have bootkit threats
- Attention! Google malware is circulating online
- Rogue YouTube site targets Syrian activists and brings malware
- ZBot Trojan makes its notice again!
- Mac security news: Flashback Trojan is back
- Be careful! Malware group spreads quickly
- Attention! Keylogger comes via rogue Facebook message
