Attack on over half a million Web pages worldwide.

Trend Micro has identified over half a million Web pages that have been compromised by a Web attack. Affected websites are injected with a malware script (JS_SMALL.QT) resulting from a poor PHP Bulletin Board (aka, phpBB, a popular Internet forum software programme) implementation. Upon visiting affected websites, visitors are infected with a variant of the ZLOB family (TROJ_ZLOB.CCW) which poses as a video codec installer. When users download the purported video codices they are actually downloading several Trojan horse programmes:

TROJ_DNSCHANG.CS

TROJ_ALUREON.AE

TROJ_ALUREON.AH

TROJ_ALUREON.AI

These types of Trojans are known for changing an affected system's DNS server and Internet browser settings, thus making the system vulnerable to additional threats. Many of the Websites have already been compromised with fake pharmaceutical and pornographic spams. It appears that the first infection occurred in February 2008. The infections appear to have been carried out in forums and guest books. The original forum and guest book pages are now inaccessible as they redirect visitors to a porn site to download the fake video codec. The malware is hosted on servers located in Columbus (OH), Concord (CA) and Moscow. This attack is potentially the work of a Russian/Ukrainian criminal gang that have initiated previous ZLOB attacks over the course of the past year.