China Warns About Return of Destructive Panda Virus

PC World ^ | 11/27/09

[nickcarraway]

A computer worm that China warned Internet users against is an updated version of the Panda Burning Incense virus, which infected millions of PCs in the country three years ago, according to McAfee.

The original Panda worm, also known as Fujacks, caused widespread damage at a time when public knowledge about online security was low, and led to the country's first arrests for virus-writing in 2007. The new worm variant, one of many that have appeared since late 2006, adds a malicious component meant to make infection harder to detect, said Vu Nguyen, a McAfee Labs researcher.

"It has gotten more complex with the addition of a rootkit," said Nguyen. "It definitely makes it more challenging for users to clean up and even to know that their systems have been compromised."

A rootkit burrows into a system to try to hide the existence of malware.

The first Panda worm gained fame in China for switching the icons of infected files with an image of a panda holding three incense sticks. The same image would also flash across a victim's screen, but the worm's final goal was to install password-stealing Trojan horses. The worm infected millions of PCs, according to Chinese state media. Its author was ordered to write a removal tool for the worm and later sentenced to four years in prison.

China's national virus response center warned about the updated worm earlier this week, but it dubbed the virus Worm_Piloyd.B and did not link it to Panda. The center said it had found a worm spreading online that infected executables and html files. The worm blocked a victim's PC from restoring infected files, turned off active antivirus software and directed the machine to

[GreyFriar]

This sounds like what my daughter’s computer got hit with 2 weeks ago. She had to have it completely wiped and restored to get rid of the worm.

[The Comedian]

This is a lot like the Democrats "warning" people about ACORN: They created it, they control it, and it works for their benefit.

Frowning takes 68 muscles.
Smiling takes 6.
Pulling this trigger takes 2.
I'm lazy.

[zot]

That is grim. I wonder how your daughter’s computer got it. Does it go past or through firewalls and such?

[GreyFriar]

Apparently so. Her computer internet connection goes through a college firewall and it as McAffee virus detector on it. When she tried to get McAffee to clean the computer she got a message saying that McAffee was disabled and would not function.