Warning on stealthy Windows virus

dubbed Mebroot by Symantec

[WiseWebDude]

Security experts are warning about a stealthy Windows virus that steals login details for online bank accounts.
In the last month, the malicious program has racked up about 5,000 victims - most of whom are in Europe.

Many are falling victim via booby-trapped websites that use vulnerabilities in Microsoft's browser to install the attack code.

[news.bbc.co.uk ]

[tedster]

So it's a rootkit exploit that opens a backdoor for further potential invasion. "It uses its hidden position on the MBR as a beachhead so it can re-install these associated programs if they are deleted by anti-virus software." After the backdoor is set-up, then the keylogger can be installed.

Symantec, who named the trojan, does not currently rate it as a major thread, possibly because distribution has been limited so far (2 websites.) From some other articles I've read, it looks like it may be a "proof of concept" thing for the criminals rather than a major effort.

I wonder why the BBC article used the phrase "Microsoft's browser" and never explicitly said Internet Explorer or even IE.

[WiseWebDude]

Yea, I wondered the same thing as well, why not just say IE? Well, I went and got that rootkit checker that was mentioned in the article anyway (gmer), LOL. Checked out fine. Phew.

:)

[Samizdata]

As webmasters we sometimes forget that a large number of people equate "the internet" with a blue icon on their desktop and don't know the name of their browser (or even that it is called a browser).

I never encountered an AOL user who knew they were using Internet Explorer either, but even the BBC probably balks at dumbing down that far.

[Xapti]

Yeah I was thinking that was the reason too. Whether you know the name or not, it's an accurate enough description for pretty much anyone to know what they're talking about.