Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Iran's Computer Emergency Response Team (CCCERT) has released to SC a removal tool designed to detect and remove the Flame worm described as "the most sophisticated cyber weapon yet unleashed".
The worm was detected attacking nations in the Middle East. The specific industries it targeted were unknown.
The CCERT tool can be downloaded here. It will also be available on the CCERT web site.
Users download and run the tool at their own risk.
In a VirusTotal check it was passed by 41 of 42 anti-virus tools and flagged as TrojanDownloader.Adload.rxs by Chinese security firm Jiangmin, a result which could be a false positive.
CCERT said the Windows removal tool should be run as administrator in safe mode after which it generates three zip files. It will pull infected files and logs.
The CERT said yesterday the malware could be linked to "mass breaches" in the country and was related to infamous malware application Stuxnet and Duqu.
Flame (Worm.Win32.Flame) had existed since 2010 and spread via removable media according to the CERT and by exploiting a patched Microsoft printer hole -- the same tapped by Stuxnet.
It contained a backdoor and trojan and had worm-like features, allowing it to replicate in a local network and on removable media if it was commanded so.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.
