New trojan atack on Windows help (Muster.e, imepaden.hlp, upgraderU.exe)

Custom Search

Hack in The Box
Free PC Security
TechAirlines
Freeware
OnlineSchutz
NewsApp Portal
Electronic Parts
Laser Printer
Search Engine Optimisation
Chicago Attorney's
Electricity Prices
Texas Electricity
Electricity Rates in Texas
Electric Companies in Texas
iPod Touch Games
Sharepoint Consultants

[Welcome to SCforum.info - Security [CENTRAL] Forum]

Welcome to SCforum.info - Security [CENTRAL] Forum, a home of the SCF Community devoted to provide Computer related News, Alerts, Downloads and FREE Help in such a way that even the novice computer user can understand.

Getting started using our community is extremely easy, check the two steps below:

Step 1: Create an account by clicking here. It's completely free with no hidden strings attached.

Step 2: If you have a computer problem and need some help, or just want to take part in opened discussions, simply visit scForum. Once you *Register an account, you can quickly post your questions and comments.

(*Registered Members get: free support, also, they can communicate privately with other members via PM, removal of this message, see fewer ads and much more...)

[Samker]

Security researchers have spied malware that stashes a copy of itself in a Windows help file to ensure victim computers remain infected.

The trojan, dubbed Muster.e by anti-virus provider McAfee, infects a Windows file called imepaden.hlp so it stores the main components of the malware in encrypted form. In the event the installed malware is removed, the secret payload is decrypted into an executable file called upgraderUI.exe and run by a companion installation file that automatically runs as a Windows service.

"This is hiding in plain site," said Craig Schmugar, a threat researcher at McAfee Labs. "The help file trick is pretty new to us. Usually on the client, we don't see this very often."

The technique ensures Muster.e remains installed on an infected PC even if most of the files associated with the malware are removed. No doubt it's also perplexed its share of users who for the life of them can't figure out how their PCs keep getting reinfected.

McAfee has more here: http://www.avertlabs.com/research/blog/index.php/2010/02/02/be-careful-on-help-files/

(Register)