We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,258 News Articles

Emergency Windows patch issued; 200 PCs infected

Microsoft security release to tackle Trojan

Only 200 computers were affected by the Trojan horse virus that caused Microsoft to issue a security release on October 23, according to a security researcher.

Joe Stewart, director of malware research at SecureWorks, tracked down 'Gimmiv', the Trojan that started the rush to patch. By accessing three control servers used by Gimmiv's makers, downloading log files and then decrypting the encrypted data, Stewart was able to pinpoint its origin, the first evidence of its spread and the overall number of infected PCs.

Microsoft warned of the critical vulnerability in the Windows Server service, which is used by all versions of the operating system, including client editions, to connect to file and print servers on a network. Hackers were already exploiting the bug in what Microsoft called "limited, targeted attacks," the company said as it issued a patch outside its normal second-Tuesday-of-the-month schedule.

Gimmiv, which Microsoft tagged as 'Win32/MS08067.gen!A' instead, was identified as the malware that prompted the emergency patch.

It first popped up August 20 and was probably written by a South Korean hacker, said Stewart. According to the log files, however, the Trojan was present at only two IP addresses in August, and then only briefly.

"One of these IP addresses, located in Korea, we can tell was running Gimmiv in a VMware virtual machine, exactly the kind of thing you might expect someone testing a piece of malicious mobile code to do," said Stewart.

Not until September 29, however, did Gimmiv show up 'in the wild' as log files noted an infected PC in Hanoi, Vietnam. All told, approximately 200 machines in 23 countries were successfully attacked by Gimmiv between September 29 and October 23, when Microsoft released its out-of-cycle fix. Many of the machines were on two networks in Malaysia, and few systems outside of Asia were compromised.

The log files recorded just one hacked machine in North America, for instance.

"But we had just as many questions after this as before," said Stewart, who ticked off a long list of unusual characteristics of Gimmiv. "They weren't the worst programmers ever, but it seemed like this was put together quickly. It almost felt like a half-finished program."

NEXT PAGE: Code that led to nowhere


IDG UK Sites

Windows 9 launch event live: Windows 9 launch live blog - find out first as the new Windows is...

IDG UK Sites

Windows 9 and the death of the OS as a must-have product

IDG UK Sites

Video trends: 4K is here โ€“ HDR video, VR and 3D audio is coming

IDG UK Sites

Best iPhone 6, iPhone 6 Plus deals: iPhone 6, iPhone 6 Plus tariffs, contracts and prices UK