The creators of the virus are after bank logins and personal data

 

Security experts are warning about a stealthy Windows virus that steals login details for online bank accounts.

In the last month, the malicious program has racked up about 5,000 victims - most of whom are in Europe.

 

Many are falling victim via booby-trapped websites that use vulnerabilities in Microsoft's browser to install the attack code.

 

Experts say the virus is dangerous because it buries itself deep inside Windows to avoid detection.

 

Old tricks

 

The malicious program is a type of virus known as a rootkit and it tries to overwrite part of a computer's hard drive called the Master Boot Record (MBR).

 

This is where a computer looks when it is switched on for information about the operating system it will be running.

 

"If you can control the MBR, you can control the operating system and therefore the computer it resides on," wrote Elia Florio on security company Symantec's blog.

 

Mr Florio pointed out that many viruses dating from the days before Windows used the Master Boot Record to get a grip on a computer.

 

Once installed the virus, dubbed Mebroot by Symantec, usually downloads other malicious programs, such as keyloggers, to do the work of stealing confidential information.

 

Most of these associated programs lie in wait on a machine until its owner logs in to the online banking systems of one of more than 900 financial institutions.

 

The Russian virus-writing group behind Mebroot is thought to have created the torpig family of viruses that are known to have been installed on more than 200,000 systems. This group specialises in stealing bank login information.

 

Security firm iDefense said Mebroot was discovered in October but started to be used in a series of attacks in early December.

 

Between 12 December and 7 January, iDefense detected more than 5,000 machines that had been infected with the program.

 

Analysis of Mebroot has shown that it uses its hidden position on the MBR as a beachhead so it can re-install these associated programs if they are deleted by anti-virus software.

 

Although the password-stealing programs that Mebroot installs can be found by security software, few commercial anti-virus packages currently detect its presence. Mebroot cannot be removed while a computer is running.

 

Independent security firm GMER has produced a utility that will scan and remove the stealthy program.

 

Computers running Windows XP, Windows Vista, Windows Server 2003 and Windows 2000 that are not fully patched are all vulnerable to the virus.

 

http://news.bbc.co.uk/1/hi/technology/7183008.stm

Also watch out XP users, as the latest version of mircosoft's spyware called the Genuine Advantage Tool is doing the rounds on the windows update.

Yeah it tried to install itself a few times,what is it's purpose,other than to annoy?

Good thing it's a Windows virus, I'm on Ubuntu Linux ;)

Yeah it tried to install itself a few times,what is it's purpose,other than to annoy?

 

The WGA tool?

 

It's supposed to tell microsoft and the user if your copy of the operating system is genuine, which is a good idea in theory, however it sends data to the Microsoft server every day, even trying to dial-up to the internet, and some pre-installed windows from mass manufactures like Dell came up as non-genuine due to the factory people using the same discs over and over, but giving new discs in the boxes

Oh good that i don't have it then,spyware is evil!!

UGH:veryangry:! I got nailed by something nasty last week. I'm still picking up the peices. These people , o, parasites, piss me off so much! They have nothing better to do with their 'lives' than destroy inoocent people's systems/files/lives! Luckily, I'm a little paranoid and I don't do ANY online banking. Sorry for the rant, but last weekend was HELL on wheels trying to keep up.

 

THanks for posting, Ian.

Online Banking is the way forward...

 

If the criminals want access to your data, no-matter what you try and use they will get around it and steal your data.