A new variant of the Russian Trojan Gozi is circulating on the Web, this time armed with a keylogging function and the ability to scramble itself so it is difficult to detect by anti-virus software. The new Trojan is believed to have been spreading since April 17 and like the original, which was discovered earlier in 2007, it steals data from encrypted Secure Sockets Layer streams. The latest variant was uncovered May 7 by Don Jackson, a security researcher at SecureWorks in Atlanta. Jackson also found one data cache from the Gozi variant that contained 2,000 new victims and several thousand bank and credit card account numbers, Social Security numbers and other personal information. SecureWorks researchers suspect that this not the only server with stolen Gozi data that exists.
"If you were infected before mid-May, then it will act like a rootkit and hide itself on your PC and will make itself undetectable by most anti-virus software," he said. To remedy this, he suggested that home users reboot their computers in Safe Mode and run an anti-virus scan assuming their anti-virus vendors have a signature for the Gozi variant. The newest instalment of Gozi has a compression component that it uses to uncompress the blocks of code that it needs to run. When it no longer needs those blocks of code, it recompresses them, making it almost impossible to see everything the variant is doing in memory and that much harder for anti-virus scans to detect.
News source: Physorg
13 Comments - Add comment