Phishing-program Kardphisher masks as a Windows program

12th May 2007

One of the leading American anti-virus companies, Symantec, reports about a new ploy for obtaining confidential information about users. Fishing-program Kardphisher is a counterfeited form of OS Windowsâ€™s activation (Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003 and Windows XP). Once the program is installed on a victimâ€™s HDD, it automatically creates a file of dynamic library keylog.dll, making some changes in the register of the operating system. Then, on a computer screen appears a window Â«Microsoft piracy control", indicating the need to reactivating the operating system. If the user cancels the reactivation process, the system automatically turns off the computer. If the customer agrees to undergo reactivation, it proposes to enter your credit card data in a special form. After you have sent the filled forms, all of the information goes to phishers. Symantec notes that the dialog boxes of phishing-programs are of very high quality and, thus are very difficult to distinguish from those of the system ones. Kardphisherâ€™s distinguishing feature is the complete block of any commands and processes: users will not be able to cause any Task Manager or switch to another application, but this very activating window. According to Symantec, Kardphisher has not been widely spread yet, but experts say that in some cases the Windows platform does require reactivation, but the corporation will never require any confidential information about the credit card.