Topic: New Trojan poses antivirus updates and infect systems (IME, input method editor)

[Samker]

Security watchers have discovered a Trojan that uses built-in Windows functionality to overwrite security software and compromise systems.

The malware - which poses as an antivirus update - uses Windows input method editor (IME) to inject a system, technology that normally creates a means for users to enter characters not supported with their input device. For example, PC users with a 'Western' keyboard would take advantage of the technology to input Chinese or Japanese characters.

Security firm Websense, which has written a detailed write-up of the malware, explained: "The trojan can install itself as an IME, then it kills any running antivirus processes and deletes the installed antivirus executable files: http://community.websense.com/blogs/securitylabs/archive/2010/07/05/trojan-using-input-method-inject-technology.aspx
The original executable file of this trojan disguises itself as an antivirus update package."

As Websense notes, the attacks show that malware writers have begun using Windows input methods to infect vulnerable systems.

(ElReg)