New Virus Reportedly Puts Windows PowerShell At Risk - InformationWeek
04:19 PM
Building Security for the IoT
Nov 09, 2017
In this webcast, experts discuss the most effective approaches to securing Internet-enabled system ...Read More>>

New Virus Reportedly Puts Windows PowerShell At Risk

McAfee's Avert Labs is warning users of Windows XP, Server 2003, Vista, and Longhorn about the shell script virus, which uses the same infection methods as other shells.

McAfee's Avert Labs has been tracking a new Windows proof-of-concept virus that could affect users of Windows XP, Server 2003, Vista and Longhorn.

The virus, MSH/Cibyz, targets Windows PowerShell. It was released last week by the RRLF virus group. PowerShell is a command-line shell and task-based scripting technology that provides control and administration of system administration tasks. It is supposed to eventually replace the Windows default command interpreter shell, but is not yet installed by default.

MSH/Cibyz is a shell script virus using the same infection methods as other shells. According to Avert Labs researchers, "It cannot achieve memory residency nor possess rootkit capabilities, however malicious code written in Windows PowerShell can be modified to drop a Win32 executable on an infected system to achieve the above mentioned features."

The researchers add that because Windows PowerShell allows users "to do anything one can do from the graphical user interface via a command line shell, it makes it an attractive platform for malware authors to write next-generation viruses."

This is the third proof-of-concept virus targeting Vista that members of the RRLF group have released in the past year, after MSH/Danom and W32/Usined (alias MSIL/Idonus).

"The ones before this were not nearly as sophisticated as this one," says Allysa Myers, a McAfee virus research engineer. "This shows the continuing interest among the virus-writing community in this scripting language."

Myers says solution providers should counsel their customers that threats can come from a much wider array of sources than just .exe files.

"Users seem to think that only certain types of files can hurt you, but they need to look at the greater whole; you need to be aware of what files you're receiving and only open ones that you're expecting," Myers says. "The lines of safety are getting blurrier and blurrier, so having multiple layers of defense is very important."

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll