The Register - Be careful what you invite in
Miscreants have begun creating malware that overwrites software update applications from Adobe and others.
Email malware that poses as security updates from trusted companies is a frequently used hacker ruse. Malware posing as update utilities, rather than individual updates, represents a new take on the ruse.
Vietnam-based anti-virus firm Bkis said the tactic is a logical follow-on from earlier approaches where viruses replace system-files and startup-program files.
Nguyen Minh Duc, director of Bkis Security, writes that the recently detected Fakeupver trojan establishes a backdoor on compromised systems while camouflaging its presence by posing as an Adobe update utility. The malware camouflages itself by using the same icons and version number as the official package.
Variants of the malware also pose as updaters for Java and other software applications.
Duc explains: "From analysis, we found that malware is written in Visual Basic, faking such popular programs as Adobe, DeepFreeze, Java, Windows, etc. In addition, on being executed, they immediately turn on the following services: DHCP client, DNS client, Network share and open port to receive hacker's commands."
By John Leyden - The Register
Related articles:
Computerworld: New malware overwrites software updaters
Dark Reading: Malware Takes Over Windows, Adobe Updaters
*Note: Bkis is the former trademark of Bkav. Since January 1st, 2010, Bkav has been consistenntly used as the official trademark globally.
