Trojan Installs Anti-Virus Software To Boot Competition Off Computer

The trojan game has been upped an ante.

Gregg Keize of of informationweek.com reports:

A Trojan horse now making the rounds takes the unusual self-defense step of installing anti-virus software to scrub the victimized PC of competing malware, a security researcher said.

According to Joe Stewart of Atlanta-based SecureWorks, the SpamThru Trojan adds a pirated copy of Kaspersky Lab’s AntiVirus for WinGate to a cloaked folder on the compromised machine. The illegitimate anti-virus program scans the system for malicious code — passing over SpamThru’s own files — and then deletes what malware it finds when the PC next boots.

Typical Trojan techniques stop at disabling existing anti-virus software, preventing AV products from retrieving signature updates, and to defeat the competition, blocking specific pieces of malware. "SpamThru takes the game to a new level," said Stewart in an online brief posted last week on the SecureWorks’ Web site. "Ten minutes after the download of the DLL, it begins to scan the system."

source

Written by pinolobu on November 14th, 2006 with no comments.
Read more articles on news.