Spam Trojan Installs Own Anti-Virus Scanner

Spam Trojan Installs Own Anti-Virus Scanner

Quote:
"...the SpamThru Trojan—a piece of malware designed to send spam from an infected computer. The Trojan, which uses peer-to-peer technology to send commands to hijacked computers, has been fitted with its own anti-virus scanner—a level of complexity and sophistication that rivals some commercial software...Malicious hackers battling for control over an infected system have also removed competing malware by killing processes, removing registry keys, or setting up mutexes that fool the other malware into thinking it is already running and then exiting at start....SpamThru takes the game to a new level, actually using an anti-virus engine against potential rivals.

At start-up, the Trojan requests and loads a DLL from the author's command-and-control server. This then downloads a pirated copy of Kaspersky AntiVirus for WinGate into a concealed directory on the infected system. It patches the license signature check in-memory in the Kaspersky DLL to avoid having Kaspersky refuse to run due to an invalid or expired license...Ten minutes after the download of the DLL, it begins to scan the system for malware, skipping files which it detects are part of its own installation..."

http://www.eweek.com/article2/0,1895,2034680,00.asp

:eek::eek:....where is all this going?.....it's bizarre!!!