Skip to main content

Trojan Installs Anti-Virus, Removes Other Malware

SpamThru takes the game to a new level.

The new virus uses an anti-virus engine to remove potential 'rival' infectious code." From the article: "At start-up, the Trojan requests and loads a DLL from the author's command-and-control server. This then downloads a pirated copy of Kaspersky AntiVirus for WinGate into a concealed directory on the infected system. It patches the license signature check in-memory in the Kaspersky DLL to avoid having Kaspersky refuse to run due to an invalid or expired license, Stewart said. Ten minutes after the download of the DLL, it begins to scan the system for malware, skipping files which it detects are part of its own installation.

Comments

Popular posts from this blog

Iran: A Rummy Guide

To borrow a phrase used for Iraq, there are 'things we now know we don't know.'Back in June 2002, as the Bush administration started pushing hard for war with Iraq by focusing on fears of the unknown—terrorists and weapons of mass destruction—Secretary of Defense Donald Rumsfeld explained that when it came to gathering intelligence on such threats, "absence of evidence is not evidence of absence." Elaborating, Rumsfeld told a news conference: "There are things we know that we know. There are known unknowns; that is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we do not know we don't know."Now there's a crisis brewing with Iran. And the same basic problem applies: what is known, what is suspected, what can be only guessed or imagined? Is danger clear and present or vague and distant? Washington is abuzz now, as it was four years ago, with "sources" talking of sanctions…