Trojan poses as Adobe update utility
03:17:00 | 12-04-2012

The Register - Be careful what you invite in

Miscreants have begun creating malware that overwrites software update applications from Adobe and others.

Email malware that poses as security updates from trusted companies is a frequently used hacker ruse. Malware posing as update utilities, rather than individual updates, represents a new take on the ruse.

Vietnam-based anti-virus firm Bkis said the tactic is a logical follow-on from earlier approaches where viruses replace system-files and startup-program files.

Nguyen Minh Duc, director of Bkis Security, writes that the recently detected Fakeupver trojan establishes a backdoor on compromised systems while camouflaging its presence by posing as an Adobe update utility. The malware camouflages itself by using the same icons and version number as the official package.

Variants of the malware also pose as updaters for Java and other software applications.

Duc explains: "From analysis, we found that malware is written in Visual Basic, faking such popular programs as Adobe, DeepFreeze, Java, Windows, etc. In addition, on being executed, they immediately turn on the following services: DHCP client, DNS client, Network share and open port to receive hacker's commands." 

By John Leyden - The Register

Related articles:

 Computerworld: New malware overwrites software updaters

 Dark Reading: Malware Takes Over Windows, Adobe Updaters

 

*Note: Bkis is the former trademark of Bkav. Since January 1st, 2010, Bkav has been consistenntly used as the official trademark globally.