Trojan Hearse spells doom for surfers

>From http://www.pcadvisor.co.uk/news/index.cfm?newsid=5869

Beware geeks bearing rootkits
Robert McMillan

Security researchers at Sana Security are warning of a new type of malicious
software designed to steal usernames and passwords from web surfers. The
malware, dubbed "rootkit.hearse", uses rootkit-cloaking techniques, making
it extremely difficult to detect. 

To steal information, however, the software must first be downloaded on to a
user's system. This can be done by tricking the user into downloading the
malicious code, or by infecting a computer with some other form of malware.
Once installed, it sends the sensitive information to a server in Russia,
that appears to have been in operation since 16 March, Sana said. 

The software has two components: a Trojan horse application that
communicates with the Russian server, as well as rootkit software that
cloaks the malicious software from system tools and antivirus programs. Sana
has observed the software being downloaded in conjunction with the
Win32.Alcra worm. 

Rootkit.hearse uses the same kind of cloaking techniques made infamous by
Sony's XCP rootkit software, making it hard to find, according to Sana chief
technology officer Vlad Gorelik. 

As of late Monday, rootkit.hearse was detected by only five of the 24
security products that Sana tested it against, though that number is
expected to change as word gets out. "I'm sure that there are others who are
beginning to pick it up at this point," Gorelik said. 

The Trojan horse software spends most of its time lurking in the background,
but it springs to life to communicate with the Russian server whenever a
user hits a website that requires authentication. The software can read
password information as it is typed or even when it is automatically stored
and submitted by features such as Internet Explorer's AutoComplete. 

As of Tuesday, the Russian server had stored about 35,000 unique usernames
and logins that could be used on about 7,000 different websites, including
banking, auction and social-networking sites, Gorelik said. 

Sana informed the Russian ISP for the site in question on Monday, Gorelik
said. Sana declined to name the ISP. As of yesterday morning, the Russian
site was still operational, he said. 

Read About It
Information about PWS-Banker.be is located on VIL at:
http://vil.mcafeesecurity.com/vil/content/v_138991.htm

Detection
PWS-Banker.be was first discovered on March 21, 2006 and detection was added
to the 4723 dat files (Release Date: March 21, 2006).

To stay updated and protected download the latest dat files from
http://www.mcafeesecurity.com/us/downloads/default.asp

If you suspect you have PWS-Banker.be, please submit a sample to
http://www.webimmune.net.

Risk Assessment Definition
For further information on the Risk Assessment and AVERT Recommended Actions
please see:
http://www.mcafeesecurity.com/us/security/resources/risk_assessment.htm


Mike Grant
Bytware, Inc.
775-851-2900 

http://www.bytware.com


CONFIDENTIALITY NOTICE:  This e-mail message and any attachment to this e-mail 
message contain information that may be privileged and confidential.  This 
e-mail and any attachments are intended solely for the use of the individual or 
entity named above (the recipient) and may not be forwarded to or shared with 
any third party.  If you are not the intended recipient and have received this 
e-mail in error, please notify us by return e-mail or by telephone at 
775-851-2900 and delete this message.  This notice is automatically appended to 
each e-mail message leaving Bytware, Inc.