Spammers get fussy as zombie army grows

Is your Internet connection actually worth infecting? The Bobax worm tests PCs first to see if they'll be good spam zombies. The Bobax worm, which is less than a week old but has already spawned four variants, is one of the first worms to conduct a bandwidth test on its infected host to see if it is worthy of being used as a spam zombie. Bobax uses a combination of the Windows vulnerabilities exploited by the Sasser worm and the MSBlast worm. Although Bobax is unlikely to spread very far because larger companies have already applied the relevant Microsoft patches, its behaviour shows that virus writers and professional spammers have taken control of more than enough computers to fulfil their requirements -- and are now able to get fussy about which ones to use.

Mikko Hyppönen, director of antivirus research at Finnish company F-Secure, said that although the Bobax worm infects any vulnerable machine, it has a bandwidth testing utility built in, which is used to help the virus authors decide if the infected machine has a fast enough Internet connection to be worthy of recruitment into their army of zombie spam relays.

Read Full Story