« Free Anti-Spyware Software | Main | Potential Problems with e-Voting »

An interesting development in the realm of malware is the battle for exclusive control of the infected host.
In recent years, we've seen how certain trojans and worms can eliminate other competing malware even while infecting the host with its specific malicious code. Here are a couple of examples -

The W32/Nachi worm would target hosts vulnerable to the W32/Lovesan (blaster) worm. In the process, it would eliminate the blaster worm and even go as far as to download the patch from the Microsoft site, protecting the host from further possible infection from the MS03-026 vulnerability. Later variants of Nachi such as W32/Nachi.worm.b would also eliminate competing viruses/worms.

Now Joe Stewart from SecureWorks writes about the Spamthru trojan that serves up spam from an infected host. It appears that Spamthru does not play nice with other spamming trojans, leveraging the Kaspersky Antivirus to eliminate other malware on the system while leaving its own in place. Here's what Joe tells us how Spamthru does
this -

"SpamThru takes the game to a new level, actually using an antivirus engine against potential rivals. At startup, SpamThru requests and loads a DLL from the control server. This DLL in turn downloads a pirated copy of Kaspersky AntiVirus for WinGate from the control server into a concealed directory on the infected system. It patches the license signature check in-memory in the Kaspersky DLL in order to avoid having Kaspersky refuse to run due to an invalid or expired license. Ten minutes after the download of the DLL, it begins to scan the system for malware, skipping files which it detects are part of its own installation. Any other malware found on the system is then set up to be deleted by Windows at the next reboot. "

Of course, Spamthru also does bad stuff like acting as a proxy for spammers as well as serve up obfuscated spam using GIF randomization techniques.

This cannot be a good sign when malware like trojans, worms and spam/spyware engines have to compete for hosts. Do you think we have a serious problem?

Posted by andreyee in Odds and Ends |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/871