Topic: Worm eyes up credit card details

[Clive]

Windows users are being warned about a virus that is "aggressively stealing" credit card numbers and passwords.

The Korgo virus debuted on 22 May and since then has been steadily racking up victims.

Although the virus is not widespread, security firms are issuing warnings because it is proving so effective at stealing confidential data.

Those infected by Korgo are being urged to change passwords and credit cards if they have been used online recently.

Korgo exploits the same vulnerability that the Sasser web worm used so effectively when it struck early last month.

Like Sasser, the Korgo worm spreads around the net by itself.

Despite the fact that many people patched their PC to remove the threat from Sasser, anti-virus firms are advising people to be on their guard against Korgo.

The virus opens up a backdoor on PCs it infects which allows its creators to install a key logging program that activates when users fill in forms on websites.

The key logger steals password and credit card information and sends it back to its creators, thought to be a virus writing group called the Hangup Team.

In its web journal, anti-virus firm F-Secure issued a stark warning for those infected by Korgo.

"Change your passwords and cancel your credit cards. Especially the ones you've used during last week," wrote the anti-virus researchers. "This is not a joke."

"This is quite an effective one," said Mikael Albrecht, product manager at F-Secure.

"There's a real danger that your online banking ID would get into the wrong hands," he said.

Security firm Symantec has also upgraded its warning about Korgo as the numbers of the virus circulating increased and new variants started to appear. In total seven variants of Korgo have been found.

But Symantec added that the threat from the virus was "well-contained".

Korgo has appeared during a month of almost unprecedented virus activity.

Anti-virus firms Sophos reported that it caught 959 new viruses during May, the highest number of novel viruses since December 2001.

Sophos estimates that there are now more than 90,000 viruses in circulation.

"The Sasser and Netsky worms may have captured the headlines, but many more viruses have been written this month," said Carole Theriault, one of Sophos' security consultants.

 
http://news.bbc.co.uk/1/hi/technology/3776247.stm