Windows Trojan masquerades as Vista hack

A week after Windows Vista's official launch hackers have devised their
first attack, targeting pirates trying to install illegal copies of
Microsoft's operating system.

A supposed Windows Vista crack called Windows Vista All Versions Activation
21.11.06 is reportedly doing the rounds, offering those tempted by the
chance of sticking it to Microsoft the ability to install illegal versions
of Windows Vista.

However, the software is not a Windows Vista crack and pirates get something
they didn't expect - installation of a Trojan called PSW.Win32.LdPinch.aze -
something with a "high" threat level.

Apparently, most anti-virus scanners can recognise the Trojan, but NOD32 and
the latest software from Norton won't.

The installer follows in the footsteps of a Windows XP hack circulated by
the devils0wn group in 2001, which allowed users to bypass product
activation of Windows XP.

Windows Vista is currently available for download only to customers on
Microsoft's volume licensing deals and won't become generally available
until January. The Trojan would therefore likely hit certain business users
and those working in businesses passing on copies to friends, family, or
colleagues.

Worryingly for business users in general, though, is the fact the Windows
Vista DVD has been designed to make it easy for third parties' software to
be inserted with the operating system for mass distribution. That
potentially lets hackers insert their code just as easily as Microsoft
partners.

**************

PWS-LDPinch.dr!4f8fa1f is referred to as "PSW.Win32.LdPinch.aze" within 
the
article.

Read About It
Information about PWS-LDPinch.dr!4f8fa1f is located on VIL at:
http://vil.mcafeesecurity.com/vil/content/v_141040.htm

Detection
PWS-LDPinch.dr!4f8fa1f was first discovered on December 6, 2006 and
detection will be added to the 4913 dat files (Release Date: December 
7,
2006).

Though we consider this a low threat, An EXTRA.DAT file may be 
downloaded
via the McAfee AVERT Extra.dat Request Page:
<https://www.webimmune.net/extra/getextra.aspx>

If you suspect you have PWS-LDPinch.dr!4f8fa1f, please submit a sample 
to
<http://www.webimmune.net>

Risk Assessment Definition
For further information on the Risk Assessment and Avert Labs 
Recommended
Actions please see:
<http://www.mcafee.com/us/threat_center/outbreaks/virus_library/risk_assessm
ent.html>

Best Regards, 

McAfee Avert Labs - Come visit our Blog -
http://www.avertlabs.com/research/blog/

*********

Mike Grant
Bytware, Inc.
775-851-2900 

http://www.bytware.com


CONFIDENTIALITY NOTICE:  This e-mail message and any attachment to this e-mail 
message contain information that may be privileged and confidential.  This 
e-mail and any attachments are intended solely for the use of the individual or 
entity named above (the recipient) and may not be forwarded to or shared with 
any third party.  If you are not the intended recipient and have received this 
e-mail in error, please notify us by return e-mail or by telephone at 
775-851-2900 and delete this message.  This notice is automatically appended to 
each e-mail message leaving Bytware, Inc.