Panda Software's TruPrevent(TM) Technologies Prevent Any New Threat From Exploiting Sony's Anti-Piracy System12 November 2005
The polemic anti-piracy system that Sony has incorporated on several music CDs is being used by malicious code to carry out attacks. PandaLabs has detected the appearance of Ryknos.A and Ryknos.B, two new Trojans that exploit this system to avoid being detected on the computers they infect. TruPrevent(TM) Technologies -- more specifically, the Genetic Heuristic Engine -- have proactively neutralized both of these Trojans and, therefore, users have been protected from these threats. Additionally, TruPrevent(TM) Technologies prevent any new threat from exploiting this anti-copy system to hide on computers. "Whenever a new security risk is uncovered, it doesn't take long for malware writers to start spreading their creations," says Luis Corrons, director of PandaLabs. "The short time it has taken for this problem to be exploited suggests that it is highly probable that many more specimens that try to use this anti-piracy system through conventional music CDs will appear. For this reason, it is important to have proactive technologies, like TruPrevent(TM), which can block threats by studying their behavior and not because they have previously been identified. This avoids the risk of infection during the time it takes for security companies to prepare the vaccine." Sony's anti-piracy system is installed on computers when a protected music CD is run and hides any file whose name starts with the characters $SYS$. Under this methodology, it can control the number of copies made of the CD, without user knowledge. It is precisely this cloaking feature that the Ryknos Trojans exploit. When a user runs a file containing one of these malicious codes, it will copy itself to the computer under the following names $sys$drv.exe (Ryknos.A) or $sys$xp.exe (Ryknos.B). This makes these Trojans difficult to locate and eliminate. When installed on computers, these Trojans connect to port 8080 of certain IP addresses, allowing them to receive and run commands from a remote attacker. These commands could include downloading and executing files and deleting certain files. However, due to a programming error, Ryknos.A cannot execute when the computer starts up. Ryknos.B, however, is fully functional. Panda Software has made the updates to detect and eliminate the Ryknos Trojans available to all its users. To help as many users as possible scan and disinfect their systems, Panda Software offers its free, online anti-malware solution, Panda ActiveScan, which now also detects spyware, at http://www.pandasoftware.com/home/default.asp. Webmasters who would like to include ActiveScan on their websites can get the HTML code, free from http://www.pandasoftware.com/partners/webmasters. Panda Software also offers users Virus Alerts, an e-bulletin in English and Spanish that gives immediate warning of the emergence of potentially dangerous malicious code. To receive Virus Alerts just visit Panda Software's website (http://www.pandasoftware.com/about/subscriptions/) and complete the corresponding form. For further information about these and other computer threats, visit Panda Software's Encyclopedia. About PandaLabs Since 1990, its mission has been to analyze new threats as rapidly as possible to keep our clients safe. Several teams, each specialized in a specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc), work 24/7 to provide global coverage. To achieve this, they also have the support of TruPrevent(TM) Technologies, which act as a global early-warning system made up of strategically distributed sensors to neutralize new threats and send them to PandaLabs for in-depth analysis. According to Av.Test.org, PandaLabs is currently the fastest laboratory in the industry in providing complete updates to users (more info at http://www.pandasoftware.com/pandalabs.asp). For more information: Carolina Sanabria Public Relations Manager Panda Software, USA pr@pandasecurity.com Tel: (818) 543-6909
Source: PR Newswire
All trademarks and copyrighted information contained herein are the property of their respective owners.
The Shield Pro 2006
Related Articles
|
