Frankenmalware Has Been Unleashed

Game over man, game over: Frankenmalware has been unleashed

photo/ related story

So it finally happened. Unplug your computer from the internet now and save yourself from what’s about to explode upon the unwitting, Farmville-playing masses. Experts have found what they are calling “Frankenmalware”; that is, a worm that has been infected by a virus.

To be clear, viruses and worms are two really similar things. The difference is that a worm doesn’t need to attach itself to an existing application in order to function, like a virus does. So when a virus attaches itself to a worm, it’s a recipe for double trouble because the worm’s functions become available to the virus. Viruses modify or corrupt the files they attach themselves to in order to hide and release their payload, and worms are universally bad for the neighborhood because they tend to clog network traffic and take up bandwidth, as well as often stealing personal information via keyloggers and the like.

The hybrid — in a worst case scenario — could create two different backdoors on your computer that communicate with completely different command and control servers, each having different goals. Each part of the hybrid would have different infection tactics and ways to spread, as well twice the methods of hiding itself from detection.

The most interesting (and creepy) part of this is that the infection can happen completely outside of human intervention. Viruses that infect executable files will eventually infect a worm as they propagate through a host system, as worms are often executables themselves. When the worm moves to the next host, it takes the virus with it in its “DNA”. The combined features of this new bug can be exponentially more harmful than either parent alone — the virus and worm would work in tandem as the virus utilizes the worm’s capabilities to wreak havoc. There’s also the chance that the hybrid could be discovered by an antivirus but seen as a normal file just infected by a virus. In cleansing, the file signature is changed and considered “clean” by the host, creating a mutant virus strain that may go unnoticed in further host machines. Mutated worms that scan as normal system files are exactly what antivirus makers don’t want.

more here