Posted on 01/11/2008 9:40:46 AM PST by Aristotelian
Security experts are warning about a stealthy Windows virus that steals login details for online bank accounts. In the last month, the malicious program has racked up about 5,000 victims - most of whom are in Europe.
Many are falling victim via booby-trapped websites that use vulnerabilities in Microsoft's browser to install the attack code.
Experts say the virus is dangerous because it buries itself deep inside Windows to avoid detection.
Old tricks
The malicious program is a type of virus known as a rootkit and it tries to overwrite part of a computer's hard drive called the Master Boot Record (MBR).
This is where a computer looks when it is switched on for information about the operating system it will be running.
"If you can control the MBR, you can control the operating system and therefore the computer it resides on," wrote Elia Florio on security company Symantec's blog.
Mr Florio pointed out that many viruses dating from the days before Windows used the Master Boot Record to get a grip on a computer.
Once installed the virus, dubbed Mebroot by Symantec, usually downloads other malicious programs, such as keyloggers, to do the work of stealing confidential information.
Most of these associated programs lie in wait on a machine until its owner logs in to the online banking systems of one of more than 900 financial institutions.
The Russian virus-writing group behind Mebroot is thought to have created the torpig family of viruses that are known to have been installed on more than 200,000 systems. This group specialises in stealing bank login information.
(Excerpt) Read more at news.bbc.co.uk ...
rootkit
If it can’t be removed while the computer is running, how the heck is it removed?
ping
So my McAffee won’t be able to detect/delete it? Dang.
So my McAffee won’t be able to detect/delete it? Dang.
See, I’m already infected. Causing double posts!
THE ANSWER...
http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-010718-3448-99&tabid=3
Ping!
You might also have to format /mbr.
Hmmm. We use symantec, in fact it just finished its daily scan on this machine a few minutes ago.
That said, I don’t do online banking for the reasons found in this article.
Read the full article...
http://news.bbc.co.uk/2/hi/technology/7183008.stm
~SNIP~ Independent security firm GMER has produced a utility that will scan and remove the stealthy program ~SNIP~
GMER HERE...
It’s really bad form to suggest destructive commands.
I hope most people will know what that does. Unfortunately, it probably won’t really clean off the rootkit.
Free tools such http://killbox.net/ and http://www.snapfiles.com/get/removereboot.html will delete files upon reboot.
No, I’m going to allow it to go gray naturally.
The Russian virus-writing group behind Mebroot is thought to have created the torpig family of viruses that are known to have been installed on more than 200,000 systems. This group specialises in stealing bank login information.Thank goodness Putin cracked down on all those corrupt oil company and media tycoons. Hate to think of the crime wave that could have happened. I mean, yeah, he's a rough guy, but it's not as if he sells kalishnikov factories and advanced fighters to Venezuela.
You would have to boot from a CD and then clear out the mbr..
Europeans seem to get more viruses because they are also the same people less likely to have antivirus programs installed. I once saw a statistic that showed most viruses found in Europe and Asia almost ten times as many as North America even though North America has more computers. I don’t remember which antivirus company had the stat.
I think you meant fdisk /mbr.
Does anyone know if AVG Free Edition Antivirus will find this?
You're right.
AVAST.COM
How do I know this GMER is safe? (no offense to you) Has it been peer revied or tested, etc?
just google GMER
Instead of getting screwed the first time, how about installing a SW firewall and a hardware firewall? I crawled around the floor with 5 U-320 HDs and that will not happen again. 14 fans and everything in there is happy now. The problem with SCSI is assigning IDs to everything. After that, everything work well at 15k RPM.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.