Pirated Windows 7 RC builds botnet

 

Summary

A Trojan horse embedded in a pirated version of the latest Windows OS has already created tens of thousands of bots, according to security researchers.

Events

Social Media World Forum
22 - 23 Sep 2010

Suntec, Singapore

Governmentware 2010
28 - 30 Sep 2010

Suntec, Singapore

The 5th Annual CIO Forum Asia
28 Sep 2010

Singapore

IDC's Asia/Pacific Cloud Computing Conference 2010
31 Aug 2010

Marriott Hotel, Singapore

A pirated version of Windows 7 Release Candidate (RC) infected with a Trojan horse has created a botnet with tens of thousands of bots under its control, according to researchers at security firm Damballa.

The software, which first appeared on 24 April, spread as quickly as several hundred new bots per hour, and controlled roughly 27,000 bots by the time Damballa took over the network's command and control server on 10 May, the firm said on Tuesday.

The pirated software was spread via popular piracy sites and online forums, Damballa said.

The software is primarily designed to download and install other malicious packages under a 'pay-per-install' scheme, under which the botmasters are paid based on the number of other pieces of malware they cause to be installed, Damballa said.

Infected installations are continuing to appear at a rapid rate, according to the company.

"We continue to see new installs happening at a rate of about 1,600 per day with broad geographic distribution," said Tripp Cox, Damballa's vice president of engineering, in a statement. "Since our takedown (of the command and control server), any new installs of this pirated distribution of Windows 7 RC are inaccessible by the botmaster."

However, the botmaster still controls the existing installations, Damballa said. The infected systems are mainly concentrated in the United States, with 10 percent, and the Netherlands and Italy, with 7 percent each.

Windows 7 RC has been used as a lure by other malware distributors since its launch on 5 May, according to security experts. On Monday, Trend Micro said it found the Trojan horse TROJ_DROPPER.SPX masquerading as a copy of the release candidate.

Botnets are one of the most serious threats on the internet, according to security experts, and are typically used to carry out denial-of-service attacks or phishing schemes or to send junk mail. Last month, SecureWorks researcher Joe Stewart suggested that technology was not enough to stop botnets, arguing the IT industry should look to new law-enforcement measures.

The legitimate version of Windows 7 RC is available from Microsoft's Web site.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment
HP Data Protector delivers high-performance data protection at up to 70% lower TCO.
Tech Vendor: HP
Did you know?
Did you know?

ZDNet Asia Live

Brand new Google Instant: a search-as-you-type engine and Google SG will soon get a taste of it. See http://bit.ly/cm7kzy and @zdnetasia

#Force #Cloud S'pore: Social media trumps paid keyword ads: Microsoft aiming to hone CRM pitch: SAN FRANCISCO-... http://bit.ly/do6ECA #TCN

Iwebslog.com-Multi-task tricks of the Table Move handle in Word: Click or double-click the Table Move handle... http://dlvr.it/4xkZW #Excel

41 minutes ago by learnexcel on topsy

S'pore: Social media trumps paid keyword ads http://bit.ly/96gvyw

Microsoft aiming to hone CRM pitch: As it gears up to start testing a new version of its product, Redmond says it'... http://bit.ly/cCRyE6

10 things you should know about NoSQL databases: The relational database model has prevailed for deca... http://bit.ly/9kJeXc - #Asia #News

Multi-task tricks of the Table Move handle in Word: Click or double-click the Table Move handle to qu... http://bit.ly/b7UBPf - #Asia #News

Microsoft aiming to hone CRM pitch: SAN FRANCISCO--Microsoft is tired of seeing Salesforce.com get all the headlin... http://bit.ly/d6Uf6U

Microsoft aiming to hone CRM pitch: SAN FRANCISCO--Microsoft is tired of seeing Salesforce.com get all the headlin... http://bit.ly/9vsZxf

who would've thunk it?? increasingly important medium.. 'S'pore: Social media trumps paid keyword ads' - ZDNet Asia - http://bit.ly/axe88O

RT @zdnetasia: Oracle's Hurd for Phillips swap: What's the customer relations impact? http://ur1.ca/1jqms

Salesforce chief: Enterprise tech lacks innovation: Consumer tech makers such as Twitter are setting ... http://bit.ly/ca4KYi - #Asia #News

Adobe warns of zero-day hole in Reader, Acrobat: Critical vulnerability could allow an attacker to ta... http://bit.ly/bY9Xe6 - #Asia #News

Microsoft aiming to hone CRM pitch http://bit.ly/dn8jno

3 hours 39 minutes ago by superstarch on topsy

Link to the Dual Roles of the CIO: http://www.ciodashboard.com/cio-careers/cio-dual-roles/

12 hours 52 minutes ago by cbcurran on Boeing CIO: IT key to drive business growth

Here's another view of the dual roles of the CIO that I think is consistent. What we've found, however, is that only about 1 in 4 CIOs o...

12 hours 53 minutes ago by cbcurran on Boeing CIO: IT key to drive business growth

I agree with the author's sentiment in that Oracle seems to be set on a course to building an anti-open-source reputation. I don't agree ...

13 hours 56 minutes ago by sisto on Could Oracle fracture open source community?

Hi Rick, I like your point that there is a time and a place for automation, and that it can be quite effective when used properly. One su...

16 hours 17 minutes ago by XebiaLabs on Agile drivers for new project management tools

sorry for the double entry just a mistake

19 hours 28 minutes ago by notek on 5 ways to avoid removable media malware

Amazing and very informative blog one point i'd like to point out is that, for number 2 instead of completely restraining the use of remo...

19 hours 29 minutes ago by notek on 5 ways to avoid removable media malware

S'pore: Social media trumps paid keyword ads http://bit.ly/9Z7dNd

19 hours 46 minutes ago by lenwilton on topsy

Hi. My name is Philippe de Passorio, head of Total Immersion office in Apac. Since we have opened our subsidiary in Hong Kong 1 year ago,...

20 hours 31 minutes ago by philippe on APAC lags in augmented reality adoption

Haha, thought long and hard about how to phrase it... no worries, you owe me lunch then, ;)

23 hours 32 minutes ago by yedwin on Is M'sia's online world ready for free speech?

Nice post man. Looks like I don't have to write one on this now.

23 hours 54 minutes ago by davidlian on Is M'sia's online world ready for free speech?

The only reason Oracle has a leg to stand on here is that Sun didn't open source all of Java. The saw that Java as a desktop application...

1 day 36 minutes ago by txtechdog on Could Oracle fracture open source community?

I recently made some good experiences with CopyRight2 from Sys-Manage. You can download a trial version here: http://www.sys-manage.com/P...

1 day 14 minutes ago by JPatrick on Migrate shares from one Windows NT server to another

I have to disagree with the author's statement "If Oracle destroys OpenOffice and MySQL the Linux operating system would be left with, wh...

1 day 34 minutes ago by schumacr on Could Oracle fracture open source community?

Oracle may well kill OpenOffice and MySQL but the FOSS community has a better DB in PostgreSQL, and OOo will be forked to get out from un...

1 day 2 minutes ago by GreyGeek on Could Oracle fracture open source community?

sir want create my own accounting software but i dont know anythink abount the programing i try to improave my self with learn of some ex...

1 day 35 minutes ago by parveenidhi on Create a shortcut to a custom Word template