Worm.Win32.Flame -- Dump Windows

Another major malware infestation for Windows. Amazing how many articles I
had to read to finally find an author who would say this virus affects the
Malware Magnet OS -- although the name should make it obvious.

~~
Flame espionage virus has targeted Iran for last 2 years

Since March 2010 Iran has been targeted by a data monitoring and
collecting piece of malware now known as Flame. Analysts say the malware
is so complex in nature that they believe it could only have been
developed by a government agency or state with a very big budget. The
purpose of the Flame malware is to gather data and send it to its command
and control servers of which there are approximately 80 known to exist.

Crysys Lab, a special unit that investigates computer viruses at Budapest
University said of Flame “It covers all major possibilities to gather
intelligence, including keyboard, screen, microphone, storage devices,
network, Wi Fi, Bluetooth, USB and system processes. Information gathering
from a large network of infected computers was never crafted as carefully”.

The “Worm.Win32.Flame” malware infects Windows based computers and weighs
in at a rather large 20MB. Unlike single-shot predecessors Stuxnet and Duqu
Flame is a complete attack toolkit that can steal data from many different
sources. For example rather than just recording VoIP calls the program can
turn on the computer microphone and begin recordings at will, while
simultaneously taking screenshots of interesting apps (usually instant
messaging apps).
~~
http://snipurl.com/23po8kg

But, strangely enough, this article from the Wall Street Journal never
mentions that it only attacks the Malware Magnet OS. Nor did several other
articles I found about the malware. I wonder why they wouldn't mention
that?

~~
Advanced Malware Targets Middle East

Computer malware described as "the most sophisticated cyberweapon yet
unleashed" has been uncovered in computers in the Middle East and may have
infected machines in Europe, according to reports from antivirus
researchers and software makers in Russia, Hungary and Ireland.

The malware, dubbed Worm.Win32.Flame, is unusual in its complexity, size
and the multitude of ways it has of harvesting information from an
infected computer including keyboard, screen, microphone, storage devices,
network, Wi-Fi, Bluetooth, USB and system processes.

The malware is called "Flame" by Kaspersky Labs, a Moscow-based antivirus
software maker, but also known as sKyWIper by the Hungarian Laboratory of
Cryptography and System Security (CrySyS Lab).

Both Kaspersky Labs and CrySyS Lab said it was likely the malware was
developed by a government-sponsored entity.
~~
http://snipurl.com/23po9gi

It's not just hitting Iran. Israel has the second most number of
infections.

RonB
Registered Linux User #498581
CentOS 5.8 or VectorLinux Deluxe 6.0
or Linux Mint 10